roth-detection-engineering - Apply portable Sigma and YARA detection engineering
Create portable Sigma and YARA detection rules using Florian Roth's methodology, including testing, metadata, false-positive documentation, and SIEM conversion.
Tags
Updated: 2026-10-02Capabilities
Typical Inputs
Typical Outputs
What this skill does
- Write portable Sigma rules
- Create YARA rules
- Convert Sigma to SIEM queries
- Document false positives
- Test detection rules
- Add MITRE ATT&CK tags
- Version-control detection rules
- Share detection rules
Inputs
- Detection requirements
- Log source details
- Detection patterns
- SIEM target
- Rule metadata
Outputs
- Sigma rules
- YARA rules
- SIEM queries
- False-positive documentation