skills.rest
imMamdouhaboammar
imMamdouhaboammarCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

agency-threat-intelligence-analyst

Produces threat intelligence reports, MITRE ATT&CK mappings, and Sigma and YARA detection rules.

Updated Jul 27, 2026
Search Tags:#threat intelligence#yara#stix#mitre att&ck#detection engineering#sigma rules#ioc enrichment
One-click install
npx skills add https://github.com/imMamdouhaboammar/Mimera --skill agency-threat-intelligence-analyst-immamdouhaboammar
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: agency-threat-intelligence-analyst
Source: https://github.com/imMamdouhaboammar/Mimera/tree/main/.agents/skills/security-threat-intelligence-analyst
Command: npx skills add https://github.com/imMamdouhaboammar/Mimera --skill agency-threat-intelligence-analyst-immamdouhaboammar

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve? Security teams drown in raw threat data without the analytical rigor to turn indicators into defensive action. This Skill applies structured intelligence tradecraft to track adversaries, map campaigns to MITRE ATT&CK, and produce detection rules and reports with explicit confidence assessments. ## Core Features & Use Cases - Adversary Tracking & Attribution: Build threat actor profiles covering aliases, targeting, TTPs, tooling, and infrastructure, with confidence levels grounded in corroborated evidence. - Detection Engineering: Write and tune Sigma, YARA, and Snort/Suricata rules validated against known samples, with false-positive analysis and MITRE ATT&CK technique tagging. - IOC Enrichment & STIX Export: Classify, validate, and enrich indicators (IPs, domains, hashes, URLs) and export them as STIX 2.1 bundles or CSV for SIEM ingestion. - Use Case: After a phishing campaign hits your sector, ask the analyst to profile the actor, map observed behavior to ATT&CK techniques, and deliver a Sigma rule plus an IOC feed your SOC can deploy the same day. ## Quick Start Analyze these phishing indicators, map the activity to MITRE ATT&CK, and produce a detection rule with a confidence assessment.

Frequently Asked Questions about agency-threat-intelligence-analyst

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I map threat actor behavior to MITRE ATT&CK techniques?▼

Map observed adversary behavior to ATT&CK techniques by citing specific evidence for each mapping, such as log events or malware artifacts. The Skill produces ATT&CK Navigator heatmaps comparing adversary capabilities against your detection coverage to expose gaps.

How do I write a Sigma rule for Kerberoasting detection?▼

Detect Kerberoasting by matching Windows Event ID 4769 with RC4 encryption (0x17), excluding machine accounts and krbtgt, then alerting when one user requests more than 10 service tickets within 5 minutes. The Skill includes this rule with false-positive guidance.

What is the difference between Sigma and YARA rules?▼

Sigma rules detect log-based patterns like suspicious process execution across SIEM platforms, while YARA rules identify malware files or memory artifacts by matching byte patterns and strings. The Skill writes both and validates them against known samples.

Can I export IOCs to STIX format for threat intel sharing?▼

Yes, the included enrichment pipeline classifies indicators, filters private IPs, assigns confidence and TLP markings, and exports STIX 2.1 indicator bundles or CSV files for SIEM ingestion and ISAC sharing.

Why should intelligence reports include confidence assessments?▼

Confidence assessments separate observation from assessment so consumers know what is corroborated versus speculative. The Skill applies Admiralty Code source reliability ratings and never attributes attacks from a single indicator, since IPs and tools are frequently shared or spoofed.

Related Skills

Explore More Software Engineering Skills→
Liberty91LTDLiberty91LTD
15

darkweb-collection

Collects and synthesizes dark web intelligence from surface-web sources into structured summaries.

Official
Intermediate
xalgordxalgord
954

hunting-for-spearphishing-indicators

Detect spearphishing campaigns by hunting indicators across email logs, endpoint telemetry, and network data.

Community
Intermediate
0x0pointer0x0pointer
13

osint

Map target organizations through passive OSINT sources with confidence scoring.

Official
Advanced
Muath2000Muath2000

threat-intel-engineer

Integrate, normalize, and correlate cyber threat data from STIX/TAXII feeds.

Community
Advanced