skills.rest
sammysparks000
sammysparks000COMMUNITY
Explore all skills by this author →
WebsiteGitHub

agency-threat-intelligence-analyst

Produces threat intelligence reports, MITRE ATT&CK mappings, and Sigma and YARA detection rules.

Updated Sep 10, 2026
Search Tags:#threat intelligence#yara#stix#mitre att&ck#detection engineering#sigma rules#ioc enrichment
One-click install
npx skills add https://github.com/sammysparks000/skillshare --skill agency-threat-intelligence-analyst-sammysparks000
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: agency-threat-intelligence-analyst
Source: https://github.com/sammysparks000/skillshare/tree/main/skills/security-threat-intelligence-analyst
Command: npx skills add https://github.com/sammysparks000/skillshare --skill agency-threat-intelligence-analyst-sammysparks000

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve? Security teams drown in raw threat data without the analytical rigor to turn indicators into defensive action. This Skill applies structured intelligence tradecraft to track adversaries, attribute campaigns, and produce detection rules that catch real intrusions. ## Core Features & Use Cases - Adversary Tracking & Attribution: Build threat actor profiles with alias mapping, targeting analysis, TTP documentation, and confidence-scored attribution following the Diamond Model and Admiralty Code standards. - Detection Engineering: Write and tune Sigma, YARA, and Snort/Suricata rules mapped to MITRE ATT&CK techniques, with false positive analysis and validation guidance. - IOC Enrichment & STIX Export: Classify, validate, and enrich indicators of compromise, then export them as STIX 2.1 bundles or CSV for SIEM ingestion. - Use Case: A SOC receives a phishing campaign alert. Use this Skill to extract and enrich the IOCs, map the observed behavior to ATT&CK techniques, attribute the campaign to a known actor with a confidence assessment, and deliver a Sigma rule plus blocking recommendations. ## Quick Start Analyze the attached phishing email indicators, map the activity to MITRE ATT&CK, and produce a tactical intelligence report with detection rules.

Frequently Asked Questions about agency-threat-intelligence-analyst

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I write a YARA rule to detect malware?▼

YARA rules match files or memory using string patterns, byte sequences, and conditions. This Skill generates rules with meta blocks, characteristic strings like C2 pipe names and reflective loader markers, and layered conditions to minimize false positives.

How to map threat actor behavior to MITRE ATT&CK?▼

Map each observed behavior to a specific ATT&CK technique ID with supporting evidence, such as T1558.003 for Kerberoasting. The Skill produces ATT&CK Navigator heatmaps comparing adversary capabilities against your detection coverage.

What is the difference between Sigma and YARA rules?▼

Sigma rules detect log-based events like suspicious PowerShell execution in SIEM platforms, while YARA rules identify files or memory patterns such as malware payloads. This Skill writes both formats depending on the detection layer.

Can I export IOCs to STIX format for threat intel sharing?▼

Yes, the included enrichment pipeline classifies indicators by type, filters private IPs, assigns confidence scores, and exports STIX 2.1 bundles or CSV files for SIEM ingestion and ISAC sharing with TLP markings.

Why does attribution require multiple indicators?▼

Single indicators are unreliable because IP addresses are shared, tools are stolen, and false flags exist. The Skill corroborates infrastructure overlap, code reuse, TTPs, and operational patterns across independent sources before assigning confidence levels.

Related Skills

Explore More Software Engineering Skills→
xalgordxalgord
954

collecting-indicators-of-compromise

Collects, enriches, and distributes indicators of compromise using STIX/TAXII and threat intelligence platforms.

Community
Advanced
jaskaranhundaljaskaranhundal
3

detection-engineering

Design, validate, and tune detection rules across SIEM, EDR, and cloud telemetry.

Community
Advanced
UseOSINTUseOSINT
38

find-hidden-subdomains

Enumerate subdomains and sibling domains from Certificate Transparency logs and passive DNS.

Official
Advanced
AxxxxxxaaannAxxxxxxaaann

automating-ioc-enrichment

Enrich raw indicators of compromise with multi-source threat intelligence context.

Community
Advanced