Detection Rule Bypass Analyzer

Helps detection engineers identify coverage blind spots in system command execution detection rules, evaluate bypass risks, and reduce false negatives. Strictly limited to system command execution rules; not applicable to browser credential theft or abnormal process creation without command semantics.

6 starsOther

Install

skills CLI (Claude Code, Cursor, Codex and more)

npx skills add DetectEng-SOCLabs/detection-rule-bypass-analyzer --skill detection-rule-bypass-analyzer

Manual install

git clone --depth 1 https://github.com/DetectEng-SOCLabs/detection-rule-bypass-analyzer.git /tmp/detection-rule-bypass-analyzer
mkdir -p ~/.claude/skills
cp -r /tmp/detection-rule-bypass-analyzer/. ~/.claude/skills/detection-rule-bypass-analyzer

Personal skills live in ~/.claude/skills. Use .claude/skills in a project folder to share a skill with your team.

From the SKILL.md

# Detection Rule Bypass Analyzer

## 1. Overview
Trigger this Skill when a user asks "**Is it possible to bypass this rule?**" or "**Is the detection logic comprehensive?**". This Skill is exclusively designed to analyze **system command execution** detection rules. By deconstructing the rule logic and combining it with real OS command parsing characteristics (e.g., POSIX standards, Windows command-line parsing mechanisms), it accurately pinpoints blind spots in parameter coverage, order, aliases, and abbreviations, and outputs specific bypass test cases.

**Core Principle**: Do not stay at the surface level of syntax. You must complete the full analytical chain: "Understand attack intent -> Deconstruct matching logic -> Verify real command semantics -> Determine bypass feasibility -> Output bypass cases".

## 2. Scope and Boundaries
Applicable only when the rule targets **system command execution** and the user's goal is to **find detection blind spots/bypass methods**.

| Scenario | Applicable | Description |
| :--- | :---: | :--- |
| Asking if a detection rule (e.g., Sigma, EQL, SPL) can be bypassed | ✅ Yes | The core target must be system command execution. |
| Seeking variant/equivalent commands to achieve the same malicious goal | ✅ Yes | Must deduce based on real system command semantics. |

Read the full skill on GitHub

Details

Skill name: detection-rule-bypass-analyzer
Repository: DetectEng-SOCLabs/detection-rule-bypass-analyzer
License: MIT
Repo updated: 8 April 2026

FAQ

What does the Detection Rule Bypass Analyzer skill do?

How do I install the Detection Rule Bypass Analyzer skill?

skills CLI (Claude Code, Cursor, Codex and more): npx skills add DetectEng-SOCLabs/detection-rule-bypass-analyzer --skill detection-rule-bypass-analyzer. Skills go in ~/.claude/skills (personal) or .claude/skills (project), and Claude loads them automatically when a task matches the description.

Is Detection Rule Bypass Analyzer popular?

It lives in DetectEng-SOCLabs/detection-rule-bypass-analyzer, which has 6 GitHub stars and 0 forks.

Related skills

Ground Truth

glichtenthal/ground-truth

Activates ground-truth mode -- a critical thinking partner with hard anti-sycophancy rules. Use whenever someone shares a plan, idea, decision, interpretation, or work product and might be seeking reassurance instead of honest assessment. Trigger on any of: "what do you think," "does this make sense," "is this a good idea," "review this," "am I missing something," "how does this look," "does this hold up," "should I do X" -- or any context where agreement would be the path of least resistance. Default mode is calibrated honesty, not pushback for its own sake. This skill is the advisor who will

Other

100 Angles

dx2020z/100-angles

书籍百维拆解术 — 对任意书籍执行 100 个维度的深度认知拆解，生成结构化分析报告与可视化图谱。 14 大认知域（解剖/翻译/应力测试/网络/时间/生成/对抗/数学/迁移/考古/负空间/多体/涌现/特殊）× 100 角度。触发场景：想深度读懂一本书、提取可行动方法论、批判其论证漏洞、跨书对比、做读书/教学内容、写书评或文献综述。典型说法："拆解这本书""从多个角度分析XX""这本书的隐藏前提是什么""用对抗视角看XX" "把XX和YY对比分析""这本书的负空间在哪""帮我拆《XXX》"。

Other

Pravo Grammatika

sky-magenta/pravo-grammatika

Грамматика юридического текста на практике РФ — третий скилл тривиума (грамматика · логика · риторика). Проверяет ФОРМУ ВЫРАЖЕНИЯ: говорит ли формулировка однозначно то, что задумано, или допускает два прочтения. Ядро — синтаксическая неоднозначность и пунктуация, порождающие споры о толковании договора: проблема последнего антецедента, область действия «и/или» и «в том числе», границы сроков («до»/«не позднее»), анафора и отсылки, деонтическая модальность (вправе/обязан). Используй, когда нужно: найти двусмысленность («проверь формулировку»), проверить пунктуацию или модальность («вправе или

Other

Wangxiaobo Perspective

nuwa-skills/wangxiaobo-skill

以王小波的自由精神与黑色幽默进行写作当用户明确要求使用这一人物的视角、提到“wangxiaobo-perspective”，或希望应用其核心方法分析问题时使用；不要因一般性问题自动触发。

Other

Qq Group Digest

Kirisame-Marisa1/qq-group-digest

本地解密 QQ 聊天数据库并总结群聊。当用户问「QQ群聊了什么」「总结一下XX群」「今天各群都在聊什么」「现在群里在聊什么」「某关键词在哪个群出现过」或要求统计群消息量/趋势/话题/观点时使用。全程本地、不登录、不联网；也用于查询/更新群聊关键词库。

Other

Taxue Solar Polaroid

taxueseek/taxue-solar-polaroid

将二十四节气、季节主题、地点记忆或任意短句编译为有真实证据、自然中文文案和动态视觉结构的原创编辑视觉提示词；支持单张、多张解释矩阵、纸本档案、摄影与混合媒介，不把主题硬编码为固定物件、色卡或版式。当用户提到节气海报、季节视觉、编辑海报、节气组图、拍立得、纸本摄影、季节中文文案、美学提示词，或只输入“冬至”“春去秋来”等主题时使用。

Other

Browse the most popular Claude skills, all other skills, or write your own with the skills generator.