Loading...
New
See what manual alert triage really costs your security team.
New
See what manual alert triage really costs your security team.
See what manual alert triage really costs your security team.
See what manual alert triage really costs your security team.
Loading...
AI Agent skills are packaged instructions, defined in a SKILL.md file, that an Agent loads only when a task matches them. Simbian's AI SOC Agent proposed one from its completed investigations of repeat EDR process hollowing alerts (MITRE ATT&CK T1055.012) on a signed Admin By Request component, and a person approved it before it ran.
The alert said process hollowing. The injecting process was a signed component of Admin By Request, the privilege-elevation tool one of our large enterprise customers runs on managed endpoints, and its EDR repeatedly raised the alert when that component reached into another process.
Our AI SOC Agent handled each one the long way. It pulled everything the host had done and worked through it before closing the alert as legitimate. Then the alert fired again, and the Agent started over.
The usual way to reduce false positives like these is an alert tuning rule that hides or resolves every match.
I would rather tolerate noise, but I cannot tolerate missing a single signal.
Here, that rule would close every alert on a process attackers know you trust before an analyst sees it. The Agent read back its closed investigations of those alerts and wrote itself a skill with three checks and a stopping point, then filed it for approval. A person with approval rights said yes before it ran on a single alert.
No. Process hollowing names a behavior, and legitimate software can trip the same detection. An attacker starts a legitimate program suspended, unmaps its memory, writes their own code into the gap and resumes the thread, so the code runs under a trusted name. MITRE lists the Windows API calls behind it, and process hollowing detection keys on that call sequence. Here, each investigation found the Admin By Request component's injection legitimate.
AI Agent skills are folders of instructions, scripts and reference files built around a SKILL.md file. Anthropic introduced the format in October 2025 and published it as an open standard in December 2025. SKILL.md needs two header fields. One is name, and the other is a description the Agent reads to decide whether the skill fits; the rest of the folder loads only when a task needs it, which Anthropic calls progressive disclosure.
In Simbian, the AI SOC Agent loads a scenario skill when an alert of the matching type arrives. This customer had none for this alert, so the Agent treated every repeat as new.
Yes, though skills an Agent writes before doing the work can hurt it. In SkillsBench 1.1 (June 2026), across three setups, Agents that wrote their own skills before solving a task scored 8.1 to 11.5 points below Agents given none. Curated skills added 18.2 to 24.8 points on the same setups. The benchmark didn't test skills written from finished work, so it can't vouch for ours either way.
Simbian's self-improving defense works from completed investigations. It reads them back, grouped by alert type, and raises a proposal only with high confidence and when the evidence recurs or one failure is severe and well supported. It never proposes allowlists or rules that automate a verdict. Here, the closed investigations followed one long path to one verdict, so the Agent proposed four steps.
---
name: edr-process-hollowing-admin-by-request
description: Triage for EDR alerts that classify injection by the signed Admin By Request component as process hollowing (T1055.012) on a managed endpoint. Use only for this alert type and this component.
---
1. Validate the component. The injecting process is the signed Admin By Request component.
2. Confirm the workflow. The activity fits the managed-endpoint workflow.
3. Check the follow-on. The child processes show no malicious follow-on activity.
4. Stop. End the investigation once steps 1 to 3 pass.
The steps are the Agent's; we put them in SKILL.md format for illustration.
Step three carries the weight. Put the stop ahead of it and the skill becomes an allowlist with paperwork. Admin By Request exists to run software a user asks to elevate, so whatever it starts could be something a user was tricked into running. A malicious DLL side-loaded into the signed component would also pass step one. In both cases, only step three stands between the attack and a benign verdict.
No skill Simbian's AI SOC Agent proposes runs until a person with approval rights signs off; the Agent can only propose. We call this human in control (the industry's usual term is human in the loop). There's no auto-apply setting.
The request joined the approval queue for the customer's Context Lake™, the store of context our Agents investigate with. It named the gap, linked past investigations of this alert with a note on how the skill would have changed each, and previewed the exact diff.
A rejection would have left the context as it was, and the next proposal run would read the reviewer's comment. Once approved, the skill went into that customer's context only, and every verdict it influences links back to the request that created it.
No. Verdict quality and confidence held in a before-and-after comparison reported in August 2026, during the feature's preview. The skill was invoked on 100% of matching process hollowing alerts at that customer. The count comes from the Agent's verdict reasoning, which cites the skill.
Each investigation now stays on the process chain the alert points at, and on that customer's matching alerts the Agent reads 42% fewer input tokens. These results come from one customer and one alert type. Every alert in that comparison was legitimate, so there's no data yet on an attacker side-loading into that component.
Before approving any EDR alert triage skill, ask four questions. For a broader checklist, see the Learning Center on what a reviewer should check before approving an AI's change to its own skills.
Does the scope stop at one component and one alert type?
Does the follow-on check cover everything that runs after the injection, including child processes?
Is the stop the last step?
Can you open every investigation the proposal cites and, months from now, find every verdict the skill touched?
Pick the alert your team closed as legitimate most often this quarter, and book a demo to see what Simbian would propose from your team's closed investigations.
Q: Should a person approve AI Agent skills before they run? Yes, for any skill that changes how alerts are investigated, because an Agent can be confident about a pattern and still be wrong about its scope. In Simbian, a person with approval rights reviews the evidence and the planned diff before any proposed skill runs.
Q: How can you reduce false positives without suppressing alerts? Narrow the investigation and leave the alert visible. With a scoped triage skill, the Agent still investigates every matching alert through short checks that end after the follow-on review. An alert tuning rule hides or resolves matches, and no analyst reads them by default.
Q: Are AI Agent skills a security risk? A skill from an untrusted source can be. Anthropic warns that a malicious skill can direct an Agent to exfiltrate data and recommends installing skills only from trusted sources. A skill built from your own investigations avoids that supply-chain risk but should still go through review as a diff with evidence.
