Initial commit - 611 cybersecurity skills across all subdomains

skills/performing-yara-rule-development-for-detection/references/standards.md

@@ -0,0 +1,35 @@
+# YARA Rule Development Standards
+
+## Rule Naming Convention
+- `Malware_Family_Variant`: For specific malware variants
+- `APT_Group_Tool`: For threat actor associated tools
+- `Exploit_CVE_YYYY_NNNN`: For exploit payloads
+- `Technique_Name`: For generic technique detection
+
+## Rule Quality Metrics
+| Metric | Target | Description |
+|--------|--------|-------------|
+| True Positive Rate | >99% | Detection of known samples |
+| False Positive Rate | <0.1% | Matches on clean files |
+| Scan Speed | >1000 files/s | Processing performance |
+| Maintenance Burden | Low | Frequency of updates needed |
+
+## String Types Reference
+| Type | Syntax | Use Case |
+|------|--------|----------|
+| ASCII text | `"text" ascii` | Plain text strings |
+| Wide text | `"text" wide` | UTF-16LE encoded strings |
+| Case-insensitive | `"text" nocase` | Variable casing |
+| Hex pattern | `{ AA BB CC }` | Byte sequences |
+| Wildcard hex | `{ AA ?? CC }` | Single byte wildcard |
+| Jump hex | `{ AA [2-4] CC }` | Variable length gap |
+| Regex | `/pattern/` | Complex pattern matching |
+
+## MITRE ATT&CK Relevance
+- T1027 - Obfuscated Files: Rules detect packed/encoded malware
+- T1036 - Masquerading: Rules identify file mimicry
+- T1059 - Command Interpreter: Rules detect malicious scripts
+
+## References
+- [YARA Documentation](https://yara.readthedocs.io/)
+- [YARA Performance Guidelines](https://yara.readthedocs.io/en/stable/writingrules.html)

skills/performing-yara-rule-development-for-detection/references/workflows.md

@@ -0,0 +1,34 @@
+# YARA Rule Development Workflows
+
+## Workflow 1: Sample-Driven Rule Creation
+```
+[Malware Sample] --> [Static Analysis] --> [Extract Unique Strings] --> [Draft Rule]
+                                                                            |
+                                                                            v
+                                                                 [Test Against Samples]
+                                                                            |
+                                                                            v
+                                                                 [Test Against Clean Files]
+                                                                            |
+                                                                            v
+                                                                 [Deploy to Production]
+```
+
+## Workflow 2: Family-Wide Detection
+```
+[Multiple Samples] --> [Cross-Sample Analysis] --> [Find Common Patterns]
+                                                          |
+                                                          v
+                                                  [Build Generic Rule]
+                                                          |
+                                                          v
+                                                  [Validate Coverage]
+```
+
+## Workflow 3: Threat Hunt Integration
+```
+[Intelligence Report] --> [Extract IOCs] --> [Convert to YARA] --> [Retrohunt]
+                                                                       |
+                                                                       v
+                                                              [Triage New Matches]
+```