skills.rest
riparino
riparinoCOMMUNITY
Explore all skills by this author →
GitHub

defensive-initial-access

Detect malicious Office macros, drive-by downloads, and phishing via Sigma rules and KQL signals.

1|Updated Apr 27, 2026
Search Tags:#detection#kql#signin-logs#initial-access#sigma#mde
One-click install
npx skills add https://github.com/riparino/Claude-Cyber --skill defensive-initial-access
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: defensive-initial-access
Source: https://github.com/riparino/Claude-Cyber/tree/main/Claude-Blue/Skills/defensive-initial-access
Command: npx skills add https://github.com/riparino/Claude-Cyber --skill defensive-initial-access

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Detects initial access attempts such as malicious Office macros, drive-by/browser exploits, and phishing campaigns by applying Sigma rules and KQL signals across endpoint and identity telemetry to accelerate SOC triage and IR workflows.

Core Features & Use Cases

  • Sigma-based detection for initial access vectors (macros, phishing attachments/links)
  • KQL-powered queries for MDE DeviceProcessEvents, EmailEvents, and SigninLogs
  • SOC triage guidance and incident response playbooks to isolate devices and hunt for persistence
  • Cross-domain visibility spanning endpoints and identity signals for rapid containment

Quick Start

Load the Initial Access Detection skill into your Claude workspace and start surfacing macro, drive-by, and phishing-related events immediately.

Frequently Asked Questions about defensive-initial-access

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I detect initial access attempts using KQL and Sigma rules?▼

Detect initial access attempts by applying Sigma rules and KQL queries across MDE DeviceProcessEvents, EmailEvents, and SigninLogs to identify malicious Office macros, drive-by downloads, and phishing campaigns.

What KQL queries are needed to identify malicious Office macros and drive-by downloads?▼

KQL queries targeting MDE DeviceProcessEvents and EmailEvents are needed to identify malicious Office macros and drive-by downloads, providing cross-domain visibility for SOC triage and incident response workflows.

Can I use this for impossible travel detections across identity signals?▼

Yes, you can detect impossible travel and phishing-based initial access by applying KQL signals to SigninLogs, extending visibility across endpoints and identity telemetry for rapid containment.

How do I respond to initial access alerts in a SOC triage workflow?▼

Respond to initial access alerts using incident-response playbooks that guide SOC analysts to isolate compromised devices and hunt for persistence mechanisms following detection.

Do I need Microsoft Defender for Endpoint to run these initial access detections?▼

Yes, you need Microsoft Defender for Endpoint (MDE) to query DeviceProcessEvents, alongside EmailEvents and SigninLogs, to execute the Sigma rules and KQL signals required for initial access detection.

What is the best way to detect phishing-based initial access across email and endpoints?▼

The best way to detect phishing-based initial access is by running Sigma-based detections and KQL queries across EmailEvents and MDE DeviceProcessEvents to surface malicious attachments and links.

Related Skills

Explore More Data & Analytics Skills→
bouwerpbouwerp

threat-hunting-sigma

Interpret and adapt Sigma rules for SIEM-based threat hunting.

Community
Advanced
dreadnodedreadnode
11

config-and-persistence-review

Review iOS backup artifacts for persistence mechanisms and security misconfigurations.

Official
Advanced
riparinoriparino
1

defensive-detection-engineering

Automates Sigma rule development, validation, and deployment with MITRE Navigator mapping and FP tuning for SIEM pipelines.

Community
Advanced
woohyun212woohyun212
21

siem-rule

Convert threat objectives into Sigma rules and cross-platform SIEM detection queries.

Community
Advanced