Skill UI

Creates portable Sigma detection rules from threat intelligence, validating syntax and converting to Splunk, Elastic, or Sentinel queries so SOC teams can map rules to MITRE ATT&CK and reuse them in CI/CD pipelines.

Detect abuse of Living Off the Land binaries such as certutil, regsvr32, mshta, and rundll32 by ingesting Sysmon and Windows event telemetry, generating Sigma rules, and analyzing parent-child process chains to score alerts and report MITRE ATT&CK mappings.

Crafts Splunk/Sigma-based SIEM correlation rules to detect APT lateral movement by chaining Windows authentication, process execution, and network telemetry across hosts, automating sigma-cli conversion and Splunk ES API deployment.

Maps observed adversary behaviors, security alerts, and detection rules to MITRE ATT&CK techniques to quantify detection coverage, expose blind spots, and guide control prioritization when building Navigator layers, tagging Sigma rules, aligning defenses to threat playbooks, or reporting risk.