skills.rest
jaskaranhundal
jaskaranhundalCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

detection-engineering

Design, validate, and tune detection rules across SIEM, EDR, and cloud telemetry.

3|3|Updated Mar 8, 2026
Search Tags:#cybersecurity#incident response#threat detection#mitre att&ck#detection engineering#sigma rules
One-click install
npx skills add https://github.com/jaskaranhundal/usap-skills --skill detection-engineering-jaskaranhundal
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: detection-engineering
Source: https://github.com/jaskaranhundal/usap-skills/tree/main/detection/detection-engineering
Command: npx skills add https://github.com/jaskaranhundal/usap-skills --skill detection-engineering-jaskaranhundal

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) and references (resource) and assets (resource) components.

What problem does it solve?

This Skill addresses the critical need for effective and precise threat detection rules, ensuring that security teams can identify and respond to threats quickly while minimizing false positives.

Core Features & Use Cases

  • Detection Rule Authoring: Creates detection logic in formats like Sigma, KQL, SPL, and YARA.
  • Fidelity Assurance: Focuses on high precision and recall, aiming for a low false-positive rate (<5% week 1).
  • Use Case: When a new TTP is discovered by threat hunting, this Skill can be used to rapidly design, validate, and deploy a detection rule to cover that gap across SIEM and EDR platforms.

Quick Start

Use the detection-engineering skill to design a Sigma rule for detecting PowerShell encoded commands.

Frequently Asked Questions about detection-engineering

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I write a Sigma rule to detect encoded PowerShell commands?▼

You can write Sigma rules for detecting encoded PowerShell commands by defining the process execution telemetry, specifying the base64 command-line arguments, and validating the logic to ensure high fidelity. This approach minimizes false positives while covering the specific MITRE ATT&CK TTP.

What is detection engineering and how does it improve threat detection?▼

Detection engineering is the practice of designing, validating, and tuning threat detection rules across SIEM, EDR, and cloud telemetry. It improves threat detection by focusing on TTP-level attacks with measurable ATT&CK coverage, minimizing attacker dwell time and maximizing detection fidelity.

How do I tune SIEM and EDR detections to reduce false positives?▼

Tune SIEM and EDR detections by applying documented fidelity thresholds and validating rules against real telemetry to achieve a false-positive rate below 5% in the first week. This ensures high precision and recall while maintaining effective threat coverage.

Can I use this for creating detection rules across both Splunk SPL and KQL?▼

Yes, you can author and validate detection logic across multiple platforms including Splunk SPL and KQL. The system designs rules to be deployed across SIEM, EDR, and cloud-native detection platforms to ensure comprehensive coverage.

Do I need to know YARA and Sigma to design threat detections?▼

Yes, expertise in Sigma, Splunk SPL, KQL, YARA, and cloud-native detection platforms is required. This knowledge is necessary to design high-fidelity TTP-level detections and effectively validate threat detection rules.

Related Skills

Explore More Software Engineering Skills→
augustoheissaugustoheiss

agency-threat-detection-engineer

Detect attacker behaviors in telemetry and generate tested Sigma-based SIEM rules.

Community
Advanced
riparinoriparino
1

defensive-file-upload

Detect webshell uploads using YARA, Sigma, and KQL queries.

Community
Advanced
copyleftdevcopyleftdev

mitre-attack-framework

Map adversary TTPs to MITRE ATT&CK techniques for detection engineering.

Community
Advanced
masermediagroup-stackmasermediagroup-stack
1

siem-logging

Configure centralized SIEM logging and detection-rule development across cloud and on-prem environments.

Community
Advanced