Loading skill
Install any skill in seconds. Free to start, no credit card required.
Get Started Free →aiskillstore/detection-sigma
Generic detection rule creation and management using Sigma, the universal SIEM rule format. Sigma provides vendor-agnostic detection logic for log analysis across multiple SIEM platforms.
Passed 5 of 24 test cases with the skill, and 19 of 24 without it.
1 fixed18 passed either way2 still failing3 broke
Tokens, turns and time describe resource use, not a dollar price.
A test case the skill fixed. Same model, same prompt, with and without the skill.
Which field modifier handles detection of Base64 encoded strings across variable byte boundary offsets?
| Checked | Without skill | With skill |
|---|---|---|
| Specifies modifier |base64offset. | Missed | Passed |
The instructions your model reads when the skill loads.
Sigma is to log detection what Snort is to network traffic and YARA is to files - a universal signature format for describing security-relevant log events. This skill helps create, validate, and convert Sigma rules for deployment across multiple SIEM platforms, enabling detection-as-code workflows.
Core capabilities:
pip install pysigma pysigma-backend-splunk pysigma-backend-elasticsearch pyyaml
title: Suspicious PowerShell Execution
id: 7d6d30b8-5b91-4b90-a71e-4f5a3f5a3c3f
status: experimental
description: Detects suspicious PowerShell execution with encoded commands
references:
- https://attack.mitre.org/techniques/T1059/001/
author: Your Name
date: YYYY/MM/DD
modified: YYYY/MM/DD
tags:
- attack.execution
- attack.t1059.001
logsource:
category: process_creation
product: windows
test cases passed, vs 19 / 24 without
Published skills whose descriptions closely match this one, with their headline benchmark lift.
More skills from the same source and nearby in the registry, with their headline benchmark lift.