annatchijova·annatchijova/SKILLS/dual-use-behavior-adjudication/SKILL.md

dual-use-behavior-adjudication

Skill9 starsChanged 4 months agoLicence not identifiedView on GitHub

Decide whether observed activity is malicious when the tool, command, or API call is itself legitimate — the living-off-the-land problem, where the artifact is identical for the admin and the intruder and the verdict lives entirely in context. Use whenever you must call a signal benign or malicious and the signal alone cannot settle it: PowerShell/WMI/PsExec/certutil/rundll32 execution, a valid credential used from a new location, an `AssumeRole` or `iam:PassRole` that is in-policy, RDP/SSH between hosts that do talk, a scheduled task or service install, bulk reads from a share, an admin doing admin things at 3am. Trigger on "is this malicious or is it just IT", "the tool is legitimate", "living off the land", "LOLBin", "false positive or real", "benign twin", "the account is authorized but", "should we escalate this alert", "adjudicate this detection hit", or a SOC queue where every hit is a maybe. Sibling of detection-engineering — that skill builds the rule that fires; this one adjudicates what a firing means. It does not write detection logic, does not reconstruct the full incident timeline (incident-timeline-reconstruction), and never converts "capable of harm" into "did harm".