Skills detection-sigma

📦

detection-sigma

Name: detection-sigma
Author: AgentSecOps

v0.1.0 Content revision r2 High Risk 🌐 Network access⚙️ External commands

Build Portable Sigma Detection Rules

SIEM-specific rules are difficult to reuse and maintain across platforms. This skill structures Sigma detections, conversions, ATT&CK mappings, and compliance coverage.

Supports: Claude Codex Code(CC)

⚠️ 38 Poor

Stop for confirmation before installing.

Review the plan and obtain explicit user consent before changing files.

Install with my Agent

Copy this request to your Agent. It includes the canonical Skill page and manifest.

Agent request

Review the Skillstore skill "detection-sigma" from https://skillstore.io/skills/agentsecops-detection-sigma.md and its manifest at https://skillstore.io/api/skills/agentsecops-detection-sigma/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.

Your Agent should still show its plan and request any confirmation required by the security policy.

Agent-readable resources

Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.

Markdown detail GET /skills/agentsecops-detection-sigma.md Signed manifest GET /api/skills/agentsecops-detection-sigma/manifest Signed lockfile GET /api/skills/agentsecops-detection-sigma/lockfile

Test it

Using "detection-sigma". Create a Windows detection for encoded PowerShell commands.

Expected outcome:

A rule outline identifies process-creation logs, PowerShell image matching, encoded-command indicators, expected administrative false positives, medium severity, and ATT&CK T1059.001.

Using "detection-sigma". Tune a noisy failed-login rule.

Expected outcome:

The review recommends grouping failures by account and source, setting a time window, excluding approved scanners, and testing lockout and service-account behavior.

Using "detection-sigma". Map audit monitoring to NIST 800-53.

Expected outcome:

The coverage plan connects audit controls to authentication, process, account-management, and policy-change logs, then lists missing sources and required validation evidence.

Security Audit

High Risk

v10 • 7/23/2026 Open versioned report

Most static findings are false positives from defensive selectors, ATT&CK labels, citations, Markdown fences, and SIEM query examples. One network finding is confirmed because the deployment example performs an authenticated request. Separate findings cover disabled TLS verification, administrator placeholders, and unpinned dependencies.

Files scanned

2,883

Lines analyzed

Review items

False positives ignored

Confirmed security concerns (2)

High

references/backend-support.md:265-277

Insecure Splunk Deployment Example

The Splunk example embeds administrator placeholders and disables certificate verification. Copying it can expose credentials to interception and normalize insecure TLS.

The credential tuple and disabled certificate verification appear together in one deployment example, making the unsafe pattern explicit.

Medium

SKILL.md:14-16 SKILL.md:42-44

Unpinned Security Tool Dependencies

Dependency metadata and installation instructions omit versions. Future package compromise or incompatible updates could change installed behavior without review.

Both the declared package list and pip command name packages without version constraints.

Capability review items (1)

These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.

Medium

references/backend-support.md:277

Python HTTP libraries

response = requests.post(url, auth=auth, data=data, verify=False)

This example performs an authenticated HTTP POST to a Splunk administrative endpoint, so it has real network and credential-handling effects.

Risk Factors

🌐 Network access (21)

⚙️ External commands (50)

Audited by: codex View Audit History →

Share & cite this report

Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.

Open versioned report

Copy report link

https://skillstore.io/skills/agentsecops-detection-sigma/audits/10?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown badge

[![Skillstore security assessment](https://skillstore.io/badges/skills/agentsecops-detection-sigma/security.svg)](https://skillstore.io/skills/agentsecops-detection-sigma?utm_source=security_passport_badge)

HTML badge

<a href="https://skillstore.io/skills/agentsecops-detection-sigma?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/agentsecops-detection-sigma/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

Embed card

<iframe src="https://skillstore.io/embed/skills/agentsecops-detection-sigma.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

Academic citations (APA · BibTeX · CFF)

APA citation

AgentSecOps. (2026). detection-sigma security audit report (audit version 10) [Author version 0.1.0]. Skillstore. https://skillstore.io/skills/agentsecops-detection-sigma/audits/10

BibTeX citation

@techreport{agentsecops-agentsecops-detection-sigma-2026,
  author = {AgentSecOps},
  title = {detection-sigma security audit report (audit version 10)},
  institution = {Skillstore},
  year = {2026},
  number = {10},
  url = {https://skillstore.io/skills/agentsecops-detection-sigma/audits/10},
  note = {Author version 0.1.0}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "detection-sigma security audit report (audit version 10)"
version: "0.1.0"
type: report
authors:
  - name: "AgentSecOps"
date-released: "2026-07-23"
url: "https://skillstore.io/skills/agentsecops-detection-sigma/audits/10"
identifiers:
  - type: other
    value: "skillstore:agentsecops-detection-sigma:audit:10"
    description: "Skillstore immutable audit report identifier"

Skillstore Score

Why this score Evidence Confidence: Medium

Architecture

100

Maintainability

Content

Community

Spec Compliance

What You Can Build

Draft SOC Detections

Create structured Sigma rules from observed behaviors, required log sources, and known false positives.

Plan SIEM Migrations

Compare backend query forms and identify field mappings or unsupported features before migration.

Map Compliance Coverage

Connect monitoring controls to log sources, Sigma tags, rules, and documented coverage gaps.

Try These Prompts

Create a Basic Rule

Create a Sigma rule for [behavior] using [log source]. Include metadata, detection logic, false positives, severity, and ATT&CK tags.

Review and Tune a Rule

Review this Sigma rule for syntax, field modifiers, condition logic, and false positives. Suggest targeted corrections and test cases: [rule].

Plan Backend Conversion

Translate this Sigma rule concept for [SIEM]. Explain field mappings, unsupported features, and manual adjustments. Do not assume access to deployment credentials.

Design Detection Coverage

Design a coverage plan for [framework or threat set]. Map controls or techniques to log sources, Sigma rules, gaps, and validation evidence.

Best Practices

Test every rule against known-positive and representative benign logs before deployment.
Confirm field names and backend mappings with the target SIEM.
Keep rules experimental until owners document tuning, false positives, and change history.

Avoid

Do not deploy examples without replacing placeholder endpoints, credentials, dates, and identifiers.
Do not disable TLS verification or embed credentials in deployment examples.
Do not treat ATT&CK or compliance tags as proof of detection coverage.