<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: blue-team
description: >-
  Defensive security operations including detection engineering with Sigma rules,
  SIEM log analysis (Splunk SPL, Elastic KQL), threat hunting, endpoint security
  (Sysmon, auditd, osquery), system hardening (CIS benchmarks), and vulnerability
  management workflows.
domain: cybersecurity
subdomain: defensive-security
tags:
  - detection-engineering
  - sigma-rules
  - siem
  - log-analysis
  - threat-hunting
  - endpoint-security
  - hardening
  - sysmon
  - auditd
  - osquery
version: "1.1"
author: defconxt
license: AGPL-3.0
compatibility: Designed for Claude Code, GitHub Copilot, OpenAI Codex, Cursor, Gemini CLI, and any agentskills.io-compatible agent.
metadata:
  mitre-attack: ["T1059.001", "T1003", "T1053", "T1021", "T1055"]
  nist-csf: ["DE.CM-1", "DE.CM-4", "DE.AE-2", "DE.AE-3", "PR.IP-1"]
  frameworks: ["Sigma", "CIS Controls v8", "NIST SP 800-53"]
---
<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->

---
name: blue-team
description: >
  Defensive security operations including detection engineering, SIEM rules, log analysis,
  threat hunting, endpoint security, hardening, and vulnerability management.
  Use when the operator asks about Sigma rules, CIS benchmarks, auditd, Suricata, Zeek,
  SIEM correlation, incident triage, threat hunting, security monitoring, or defensive architecture.
domain: cybersecurity
subdomain: defensive-security
tags:
  - detection-engineering
  - sigma-rules
  - siem
  - log-analysis
  - threat-hunting
  - endpoint-security
  - hardening
  - cis-benchmarks
  - vulnerability-management
  - network-security-monitoring
  - identity-security
  - incident-response
version: "1.1"
author: defconxt
license: AGPL-3.0
compatibility: Designed for Claude Code, GitHub Copilot, OpenAI Codex, Cursor, Gemini CLI, and any agentskills.io-compatible agent.
metadata:
  mitre-attack:
    - T1053   # Scheduled Task/Job
    - T1055   # Process Injection
    - T1070   # Indicator Removal
    - T1078   # Valid Accounts
    - T1087   # Account Discovery
    - T1190   # Exploit Public-Facing Application
    - T1218   # System Binary Proxy Execution
  nist-csf:
    - DE.AE   # Anomalies and Events
    - DE.CM   # Security Continuous Monitoring
    - DE.DP   # Detection Processes
    - PR.AC   # Identity Management and Access Control
    - PR.IP   # Information Protection Processes
    - PR.PT   # Protective Technology
    - RS.AN   # Analysis
    - RS.MI   # Mitigation
---

# SKILL: Blue Team / Defensive Security

## When to Use

Activate this skill when the operator asks about:
- **Detection engineering** — Sigma rules, SIEM queries (SPL/KQL/EQL), log correlation
- **Log analysis** — Windows Event Logs, Sysmon, auditd, CloudTrail, Zeek logs
- **Threat hunting** — hypothesis-driven hunts, stack counting, frequency analysis
- **Endpoint security** — EDR telemetry, Sysmon config, CrowdSec deployment
- **Network monitoring** — Suricata rules, Zeek analysis, DNS security, IDS tuning
- **Hardening** — CIS benchmarks, SSH config, sysctl, PAM, file permissions
- **Vulnerability management** — CVSS/EPSS prioritization, CISA KEV, scan workflows
- **Identity security** — zero trust, MFA enforcement, PAM hardening, JIT access

## Prerequisites

| Requirement | Purpose |
|---|---|
| Sigma CLI | Rule conversion to SIEM targets (`pip install sigma-cli`) |
| Sysmon (Windows) | Process-level telemetry (EID 1, 3, 7, 8, 10, 11, 22) |
| auditd (Linux) | Syscall and file-access auditing |
| Suricata / Zeek | Network security monitoring and protocol analysis |
| CrowdSec | Community-driven IPS with bouncer enforcement |
| AIDE | File integrity monitoring |
| Ansible + CIS role | Automated CIS benchmark auditing |

## Quick Reference

### Example: Sigma Rule for Suspicious PowerShell

```yaml
title: Suspicious PowerShell Download Cradle
id: 6e3d7a62-4f8b-4c5b-9f1a-2e8d3c4b5a6f
status: experimental
description: Detects PowerShell download cradles commonly used for malware delivery
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    CommandLine|contains|all:
      - 'powershell'
      - 'downloadstring'
  condition: selection
falsepositives:
  - Legitimate software installers using PowerShell
level: high
tags:
  - attack.execution
  - attack.t1059.001
```

### Example: KQL Hunt Query

```kql
DeviceProcessEvents
| where Timestamp > ago(24h)
| where FileName == "powershell.exe"
| where ProcessCommandLine has_any ("downloadstring", "invoke-webrequest", "wget")
| project Timestamp, DeviceName, AccountName, ProcessCommandLine
| sort by Timestamp desc
```


| Task | Command |
|---|---|
| Convert Sigma rule (Splunk) | `sigma convert -t splunk -p splunk_cim rules/rule.yml` |
| Convert Sigma rule (Elastic) | `sigma convert -t elastic -p ecs_windows rules/rule.yml` |
| Auditd suspicious process | `ausearch -k exec_priv --start today -i` |
| Failed logins (auth.log) | `grep "Failed password" /var/log/auth.log \| awk '{print $11}' \| sort \| uniq -c \| sort -rn` |
| CrowdSec decisions | `cscli decisions list` |
| CrowdSec manual ban | `cscli decisions add -i 1.2.3.4 -t ban -d 24h` |
| SUID binary audit | `find / -perm -4000 -type f 2>/dev/null` |
| Sysctl hardening check | `sysctl -a \| grep -E "rp_filter\|syncookies\|log_martians\|accept_redirects"` |
| Zeek port scan detect | `cat /var/log/zeek/conn.log \| zeek-cut id.orig_h proto duration \| awk '$3 < 0.01' \| sort \| uniq -c \| sort -rn` |
| UFW log review | `grep UFW /var/log/ufw.log \| grep -v DPT=22 \| tail -50` |
| AIDE integrity check | `/usr/bin/aide --config /etc/aide/aide.conf --check` |
| CIS audit (dry run) | `ansible-playbook -l target ansible-cis-ubuntu-2204/site.yml --check` |
| Listening services | `ss -tlnp` — map every port to approved service inventory |
| Suricata config test | `suricata -T -c /etc/suricata/suricata.yaml` |

## Workflow

### 1. Detection Engineering

Write Sigma rules as primary detection output. Translate to SPL/KQL/EQL on request.
Apply the rule quality rubric: FP rate, data source availability, ATT&CK mapping, detection
coverage vs. evasion potential.

→ **Deep reference:** [references/detection-engineering.md](references/detection-engineering.md)
  - Sigma rule templates and logsource mappings
  - Windows Event Log critical IDs (4624–7045, 1102)
  - Sysmon event ID reference (EID 1–22)
  - Linux auditd rule sets
  - Cloud audit log sources (AWS/Azure/GCP)
  - Log correlation anti-patterns

### 2. Threat Hunting

Hypothesis-driven hunting: define hypothesis → identify data sources → baseline →
query → evaluate hits → update detections.

→ **Deep reference:** [references/threat-hunting.md](references/threat-hunting.md)
  - Hypothesis-driven framework with KQL/SPL examples
  - Stack counting and frequency analysis patterns
  - Hunt hypotheses catalog (T1053, T1078, T1070, T1190)
  - Endpoint security: EDR gap analysis, Sysmon config, CrowdSec deployment
  - Network monitoring: Suricata rules, Zeek log analysis, DNS security
  - Vulnerability management prioritization (CISA KEV → EPSS → CVSS)
  - Identity security: zero trust, PAM hardening, MFA hierarchy

### 3. Hardening & Architecture

Apply CIS benchmarks systematically. Validate with Ansible check mode before enforcing.

→ **Deep reference:** [references/hardening-baselines.md](references/hardening-baselines.md)
  - SSH hardening (CIS Section 5.1)
  - Kernel sysctl hardening
  - PAM configuration (faillock, pwquality, password history)
  - File permission targets
  - Kernel module blacklisting
  - AIDE file integrity setup
  - Logging architecture (journald, auditd, SIEM forwarding)
  - UMASK and session timeout enforcement

### Key Chains

#### Detection to Response: Lateral Movement via Pass-the-Hash
1. Suricata/Zeek fires on SMB authentication anomaly (new source→dest pair, off-hours)
2. Correlate in SIEM: Windows EID 4624 Type 3 (network logon) from non-standard workstation
3. Verify in Sysmon: EID 10 on lsass.exe from suspicious process (credential dump)
4. Hunt backwards: EID 4688 — what spawned the credential dumper? (parent = Word.exe = phishing)
5. Contain: isolate host at switch port (VLAN move) or via EDR network isolation
6. Preserve: pull memory dump before eradication (`winpmem_x64.exe -o mem.raw`)
7. Eradicate: kill persistent implant (scheduled task EID 4698 trace), reset compromised credentials
8. Update detection: new Sigma rule for the specific parent-child relationship observed

#### CIS Hardening Workflow: New Ubuntu 22.04 Server
1. Baseline scan: `ansible-playbook --check -l newhost ansible-cis-ubuntu-2204/site.yml`
2. Apply SSH hardening → test with `sshd -T | grep -i permit`
3. Apply sysctl → verify with `sysctl -a`
4. Apply file permissions (shadow/passwd/sshd_config/cron)
5. Configure PAM (faillock + pwquality + password history)
6. Deploy auditd → `augenrules --load` + verify `auditctl -l`
7. Configure AIDE → `aideinit` baseline snapshot
8. Deploy CrowdSec (install + collections + bouncer)
9. Re-run Ansible check → verify score improvement

#### Threat Hunt: Persistence via Cron (Linux)
1. Hypothesis: attacker installed cron job after initial access via web shell
2. Data sources: auditd (`-w /var/spool/cron -p wa -k cron_changes`), `/var/log/auth.log`
3. Query: `ausearch -k cron_changes --start today`
4. Stack count: `crontab -l` for all users; check `/etc/cron.d/`, `/etc/cron.daily/`, `/var/spool/cron/crontabs/`
5. Correlate: what web process was running when the cron change occurred?
6. Verify malicious: inspect content — encoded payloads, wget/curl to external IPs, reverse shells
7. Remove: `crontab -r -u www-data`; block C2 IP at firewall
8. Sigma rule: alert on new cron file creation by web service user

## Verification

| Check | Method |
|---|---|
| Sigma rule valid | `sigma check rules/rule.yml` — no errors |
| Suricata config valid | `suricata -T -c /etc/suricata/suricata.yaml` — exit 0 |
| Auditd rules loaded | `auditctl -l` — rules present and active |
| Sysmon running | `sysmon -c` — shows active configuration |
| CIS compliance delta | Ansible `--check` before/after — failure count decreases |
| AIDE baseline current | `aide --check` — no unexpected changes |
| CrowdSec enforcing | `cscli decisions list` — bouncer active |

## Detection Opportunities

Every defensive engagement should identify where attackers could be caught:

| Technique | Detection Source | Key Indicator |
|---|---|---|
| T1053 Scheduled Tasks | EID 4698/4702 | Tasks from non-admin accounts or %TEMP% paths |
| T1078 Valid Accounts | EID 4624 | Logon from user not seen in 30 days |
| T1070 Indicator Removal | EID 1102 | Audit log cleared |
| T1190 Exploit Public App | Web server logs | Web process spawning sh/cmd child |
| T1055 Process Injection | Sysmon EID 8/10 | CreateRemoteThread to lsass.exe |
| T1218 LOLBin Execution | Sysmon EID 1 | regsvr32/mshta/wscript with network activity |
| Pass-the-Hash | EID 4624 Type 3 | Network logon from non-standard workstation |
| Credential Dumping | Sysmon EID 10 | ProcessAccess targeting lsass.exe |
| DNS Tunneling | Zeek dns.log | TXT records > 100 chars or high-entropy domains |
| Cron Persistence | auditd cron_changes | Cron file created by web service UID |

---
v1.1 | Validated: 2026-03-13
