agentsclimarketplace

Author detection content

Skill gaelic-ghost/socket/skills/author-detection-content

The Source for macOS Agent Workflows

Install
npx -y skills add gaelic-ghost/socket --skill author-detection-content

Assembled from the repository path, not quoted from the project. Check it against their README if it does not work.

One thing to look at

  • 6 stars6 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.

What its author says it does

Copied from the file, not written here

Turn validated security behavior into tested detection content. Use for Sigma, osquery, YARA-X routing, endpoint queries, SIEM rules, cloud or application detections, correlation logic, alert enrichment, or regression fixtures when telemetry prerequisites, provenance, expected matches, benign negatives, false-positive controls, performance, severity, response, deployment, and maintenance ownership must be explicit.

SKILL.md

2.2 KB, as published. Nobody here has run it

Author Detection Content

Overview

Detect the validated behavior at the most reliable telemetry layer. Use author-yara-x-rules for artifact pattern rules; use this workflow for event, query, correlation, and alert content.

Read references/detection-quality.md before choosing logic or deployment severity.

Workflow

  1. Define objective and response.
    • State the behavior, threat/finding source, protected surface, expected alert consumer, urgency, and action.
  2. Identify telemetry prerequisites.
    • Record source/product/version, event types/fields, collection permissions, normalization, retention, latency, and known blind spots.
  3. Select durable features.
    • Prefer behavior and context combinations over mutable infrastructure or one noisy field.
    • Map to ATT&CK only when evidence supports it.
  4. Author content.
    • Include title/ID, description, status, author/date, references, log source, logic/query, fields, false positives, level/severity, tags, and test notes as the target format permits.
  5. Test fixtures.
    • Include validated positive events, benign near-misses, missing/renamed fields, ordering/time-window cases, duplicate events, volume/performance, and known platform variants.
  6. Tune and validate response.
    • Improve logic before adding exclusions; verify enrichment and runbook lead an analyst to decisive evidence.
  7. Deploy and maintain.
    • Record target environments, owner, version, rollout, alert volume, suppression/exception expiry, health checks, and review triggers.

Output

Return detection content, telemetry contract, evidence provenance, fixture results, false positives/limits, performance, severity/response, deployment plan, and owner/review date.

Keep looking

Skills are one crate of 328,083. Ordering is by how many stacks a row turns up in, so the top of any crate is what has actually been picked rather than what has the most stars.