skills.rest
copyleftdev
copyleftdevCOMMUNITY
Explore all skills by this author →
GitHub

roth-detection-engineering

Create portable YARA and Sigma threat detection rules for malware hunting.

Updated Jan 24, 2026
Search Tags:#threat hunting#security automation#sigma#yara#malware analysis#detection engineering
One-click install
npx skills add https://github.com/copyleftdev/sk1llz --skill roth-detection-engineering
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: roth-detection-engineering
Source: https://github.com/copyleftdev/sk1llz/tree/main/domains/security/threat-hunting/roth
Command: npx skills add https://github.com/copyleftdev/sk1llz --skill roth-detection-engineering

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires PyYAML, and includes scripts (resource) and references (resource) components.

What problem does it solve?

This Skill streamlines the creation and deployment of threat detection rules, making them portable across different security platforms and fostering community collaboration.

Core Features & Use Cases

  • Portable Rule Creation: Write detection logic once using Sigma and deploy it across various SIEMs.
  • Malware Signature Matching: Develop and utilize YARA rules for precise identification of malicious files and memory artifacts.
  • Use Case: A security analyst needs to create a detection rule for a new phishing campaign. They can use this Skill to write a Sigma rule that will work in their Splunk instance, as well as in other teams' Elastic SIEM, ensuring consistent detection coverage.

Quick Start

Use the roth-detection-engineering skill to generate a Sigma rule for detecting suspicious PowerShell download cradles.

Frequently Asked Questions about roth-detection-engineering

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I create Sigma rules for threat hunting across different SIEM platforms?▼

Sigma rules provide a portable format for writing threat detection logic once and deploying it across diverse SIEMs like Splunk or Elastic. This Skill applies Florian Roth's methodology to generate and share these community-driven signatures.

What is the best way to write YARA rules for malware analysis?▼

YARA rules enable precise identification of malicious files and memory artifacts during malware analysis. This Skill helps you develop high-quality YARA signatures based on established detection engineering methodologies for effective threat hunting.

Can I use a single detection rule for both Splunk and Elastic SIEM?▼

Yes, you can write detection logic once using the Sigma format and deploy it across various SIEMs. This approach ensures consistent detection coverage for threats like phishing campaigns across different teams' security platforms.

How do I detect suspicious PowerShell download cradles using Sigma?▼

You can generate a Sigma rule specifically designed to detect suspicious PowerShell download cradles. This Skill guides the creation of detection logic targeting these scripts while ensuring the rules remain portable across your security infrastructure.

Do I need PyYAML installed to create portable threat detection rules?▼

Yes, PyYAML is required as a dependency to support the creation and parsing of Sigma and YARA rule structures. You need this library installed in your environment to properly generate and manage the YAML-based detection configurations.

What is detection engineering methodology for security automation?▼

Detection engineering is the process of developing high-quality, shareable threat detection signatures using formats like YARA and Sigma. It focuses on creating portable rules that integrate with SIEM platforms to automate the identification of malicious activity.

Related Skills

Explore More Software Engineering Skills→
williamzujkowskiwilliamzujkowski
17

security-operations

Orchestrate SOC incident response and threat hunting across on-premises and cloud environments.

Community
Advanced
incidentfoxincidentfox
654

splunk-analysis

Investigate Splunk logs to identify root causes using SPL queries.

Official
Intermediate
Ramprasad4121Ramprasad4121
1

yara-rule-authoring

Guide YARA-X detection rule authoring for malware identification.

Community
Advanced
UnitOneAIUnitOneAI
44

siem-rules

Develop KQL or SPL SIEM detection rules mapped to MITRE ATT&CK v16 techniques.

Official
Intermediate