skills.rest
SherifEldeeb
SherifEldeebCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

detection

Detect security threats across network, endpoint, identity, cloud, application, and email vectors.

5|Updated Jan 12, 2026
Search Tags:#cybersecurity#detection#endpoint#network#threat-hunting#rule-management
One-click install
npx skills add https://github.com/SherifEldeeb/agentskills --skill detection
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: detection
Source: https://github.com/SherifEldeeb/agentskills/tree/main/skills/cybersecurity/detection
Command: npx skills add https://github.com/SherifEldeeb/agentskills --skill detection

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) and references (resource) components.

What problem does it solve?

This Skill enables security teams to identify threats across multiple vectors by applying comprehensive detection logic to reduce dwell time and improve response.

Core Features & Use Cases

  • Network detections: port scanning, DNS tunneling, C2 beaconing, lateral movement, data exfiltration.
  • Endpoint and identity detections: malware behavior, credential dumping indicators, brute force, impossible travel.
  • Cloud and application detections: IAM abuse, cryptomining activity, web exploits, API abuse.
  • Detection rule management and threat hunting: create, test, and tune rules; run proactive threat hunts and investigations.

Quick Start

Use detection_utils detectors (NetworkDetector, EndpointDetector, IdentityDetector, CloudDetector, ApplicationDetector, EmailDetector), + rule management with DetectionRule and ThreatHunter to analyze representative logs and generate detections.

Frequently Asked Questions about detection

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I detect security threats like DNS tunneling and C2 beaconing in network traffic?▼

Security threat detection across network vectors is handled by applying comprehensive detection logic to analyze logs for port scanning, DNS tunneling, C2 beaconing, lateral movement, and data exfiltration using modular Python detectors.

What is the best way to build and tune custom detection rules for SOC operations?▼

The best way to build and tune detection rules is using rule management tools that allow security teams to create, test, and tune logic to reduce dwell time and improve response across multiple security vectors.

Can I use Python to detect endpoint threats like credential dumping and malware behavior?▼

Yes, you can detect endpoint threats like credential dumping and malware behavior using Python 3.9+ standard libraries with modular EndpointDetector components designed to analyze security events and identify malicious activity.

Do I need external dependencies to analyze cloud IAM abuse and API exploitation?▼

You do not need external dependencies to analyze cloud IAM abuse and API exploitation; the detection tools run using Python 3.9+ standard libraries with modular CloudDetector and ApplicationDetector components requiring zero external packages.

How do I run proactive threat hunting and investigate identity anomalies like impossible travel?▼

To run proactive threat hunting and investigate identity anomalies like impossible travel, use the ThreatHunter and IdentityDetector modules to analyze representative security logs and generate actionable detections.

Related Skills

Explore More Software Engineering Skills→
bahayonghangbahayonghang
3

kb-ingest

Register and normalize new or changed sources into raw/_manifest.yaml.

Community
Intermediate
tekgrunttekgrunt

incident-responder

Coordinate incident response workflows across detection, containment, eradication, and recovery.

Community
Advanced
refractionPOINTrefractionPOINT
29

threat-report-evaluation

Evaluate threat reports to extract IOCs and behaviors across LimaCharlie organizations.

Official
Advanced
KaiserWhoLearnsKaiserWhoLearns

threat-detection

Detect port scans, DoS events, and beaconing using exact threshold rules.

Community
Advanced