skills.rest
tcvdog
tcvdogCOMMUNITY
Explore all skills by this author →
GitHub

Threat Detection Engineer

Writes Sigma detection rules and maps MITRE ATT&CK coverage for SIEM security operations.

2|Updated May 21, 2026
Search Tags:#Splunk#threat hunting#SIEM#security operations#MITRE ATT&CK#detection engineering#sigma rules
One-click install
npx skills add https://github.com/tcvdog/agency-agents-hermes --skill threat-detection-engineer-tcvdog
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: Threat Detection Engineer
Source: https://github.com/tcvdog/agency-agents-hermes/tree/main/engineering/threat-detection-engineer
Command: npx skills add https://github.com/tcvdog/agency-agents-hermes --skill threat-detection-engineer-tcvdog

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve? Security operations teams struggle with noisy SIEM alerts, untested detection rules, and unknown MITRE ATT&CK coverage gaps that let attackers operate undetected. This Skill builds high-fidelity behavioral detections, validates them against real log data, and systematically closes coverage gaps. ## Core Features & Use Cases - Sigma Rule Development: Write vendor-agnostic Sigma detection rules and compile them to Splunk SPL, Microsoft Sentinel KQL, and Elastic EQL. - MITRE ATT&CK Coverage Mapping: Assess detection coverage per tactic and technique, identify critical gaps prioritized by threat intelligence, and build quarterly detection roadmaps. - Detection-as-Code Pipelines: Version-control rules in Git, validate syntax and ATT&CK mappings in CI, test against sample logs, and deploy automatically to SIEMs. - Threat Hunting: Execute structured hunt playbooks (e.g., LSASS credential dumping via Sysmon Event 10) and convert findings into automated detections. - Use Case: A SOC drowning in 500 daily false positives uses this Skill to audit its rule catalog, tune alert thresholds, map coverage against ATT&CK, and deploy a tested Sigma rule for encoded PowerShell execution within 48 hours of new threat intelligence. ## Quick Start Ask the agent to write a Sigma detection rule for a specific MITRE ATT&CK technique and compile it to your SIEM platform.

Frequently Asked Questions about Threat Detection Engineer

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I write a Sigma detection rule for my SIEM?▼

Write the rule in vendor-agnostic Sigma YAML with title, id, level, logsource, detection logic, ATT&CK tags, and falsepositives fields. Then compile it to Splunk SPL, Sentinel KQL, or Elastic EQL using sigma-cli with the appropriate pySigma backend.

How to map SIEM detection coverage to MITRE ATT&CK?▼

Tag every detection rule with ATT&CK technique IDs, then aggregate coverage per tactic and platform in a coverage report. Prioritize gaps by threat intelligence showing which techniques real adversaries use against your industry.

What is detection-as-code and how do I implement it?▼

Detection-as-code treats rules like software: store Sigma rules in Git, validate syntax and required fields in CI, test against sample logs, and deploy to SIEMs via pipeline. This Skill provides a GitHub Actions workflow using sigma-cli for validation and compilation.

Why does my SIEM rule generate too many false positives?▼

High false positive rates usually come from overly broad matching logic without parent process, user, or host context. Add allowlists for known benign tools, tune thresholds against historical data, and disable rules that consistently produce noise without remediation.

Can Sigma rules detect LSASS credential dumping?▼

Yes, using Sysmon Event ID 10 (ProcessAccess) to detect processes accessing lsass.exe with suspicious access masks like 0x1010. Baseline legitimate access from EDR and security tools first, since direct syscall-based dumping requires kernel telemetry beyond standard logs.

When should I use behavioral detections instead of IOC matching?▼

Prefer behavioral detections targeting attacker techniques like process chains and anomalous patterns, since IOCs such as IP addresses and hashes expire within hours as attackers rotate infrastructure. Use IOC feeds only as a supplementary signal layer.

Related Skills

Explore More Software Engineering Skills→
xalgordxalgord
954

analyzing-security-logs-with-splunk

Investigate security incidents using Splunk SPL queries for log correlation and timeline reconstruction.

Community
Intermediate
googlegoogle
513

secops-triage

Triage security alerts and cases using the Alert Triage Protocol.

Official
Intermediate
xalgordxalgord
954

implementing-threat-modeling-with-mitre-attack

Maps adversary TTPs against detection coverage using MITRE ATT&CK to identify and prioritize gaps.

Community
Advanced
doanchienthangdevdoanchienthangdev
4

Model Monitoring

Detect data drift and track performance metrics in deployed machine learning models.

Community
Advanced