Coding & Dev Tools

mukul975 Bundle

Extract cached credentials, password hashes, Kerberos tickets, and authentication tokens from memory dumps using Volatility and Mimikatz for forensic investigation.

mukul975 Bundle

Analyze Windows memory dumps for signs of compromise using the Rekall memory forensics framework, including process injection, hidden processes, and rootkit detection.

mukul975 Bundle

Extract, parse, and analyze Windows Event Logs (EVTX) using Chainsaw, Hayabusa, and EvtxECmd to detect lateral movement, persistence, and privilege escalation.

mukul975 Bundle

Hunt for unusual network connections by analyzing outbound traffic patterns, rare destinations, non-standard ports, and anomalous connection frequencies from endpoints.

mukul975 Bundle

Sign build artifacts (binaries, packages, containers) with GPG, Sigstore, and platform-specific tools to ensure integrity and authenticity throughout the software supply chain.

mukul975 Bundle

Designs and implements a ransomware-resilient backup strategy following the 3-2-1-1-0 methodology, including asset classification, immutable storage configuration, credential isolation, and automated restore testing.

mukul975 Bundle

Conducts disk forensics investigations using forensic imaging, file system analysis, artifact recovery, and timeline reconstruction to support incident response cases.

mukul975 Bundle

Conduct a maturity assessment against the NIST Cybersecurity Framework (CSF) 2.0, using Implementation Tiers to measure organizational cybersecurity posture and create improvement roadmaps.

mukul975 Bundle

Reverse engineer malware binaries using NSA's Ghidra disassembler and decompiler to understand internal logic, cryptographic routines, C2 protocols, and evasion techniques at the assembly and pseudo-C level.

mukul975 Bundle

Parse NetFlow v9 and IPFIX records to detect volumetric anomalies, port scanning, data exfiltration, and C2 beaconing patterns using the Python netflow library.

mukul975 Bundle

Captures and analyzes network packet data using Wireshark and tshark to identify malicious traffic patterns, diagnose protocol issues, extract artifacts, and support incident response investigations on authorized network segments.

mukul975 Bundle

Investigate supply chain attack artifacts including trojanized software updates, compromised build pipelines, and sideloaded dependencies to identify intrusion vectors and scope of compromise.

mukul975 Bundle

Extract and analyze Windows Registry hives to uncover user activity, installed software, autostart entries, and evidence of system compromise.

mukul975 Bundle

Facilitate structured post-incident reviews to identify root causes, document what worked and failed, and produce actionable recommendations to improve future incident response.

mukul975 Bundle

Detects ransomware encryption activity in real time using entropy analysis, file system I/O monitoring, and behavioral heuristics.

mukul975 Bundle

Simulates BGP hijacking attacks in isolated lab environments to test RPKI deployment, route origin validation, and BGP monitoring defenses against prefix hijacking and route leak attacks.

mukul975 Bundle

Exploit PHP type juggling vulnerabilities caused by loose comparison operators to bypass authentication, circumvent hash verification, and manipulate application logic through type coercion attacks.

mukul975 Bundle

Baseline the EFI System Partition and hunt malicious EFI binaries (ESPecter, BlackLotus, Bootkitty, Glupteba) by mounting the ESP, hashing and verifying boot loaders, scanning with YARA, and detecting anomalous non-EFI files.

mukul975 Bundle

Proactively hunt for adversary abuse of legitimate system binaries (LOLBins) to execute malicious payloads while evading detection.

mukul975 Bundle

Detect process injection techniques (T1055) including CreateRemoteThread, process hollowing, and DLL injection via Sysmon Event IDs 8 and 10 and EDR process telemetry.

mukul975 Bundle

Detect MITRE ATT&CK T1547.001 registry Run key persistence by analyzing Sysmon Event ID 13 logs and registry queries to identify malicious auto-start entries.

mukul975 Bundle

Configure Fluentd and Fluent Bit for centralized log aggregation, routing, filtering, and enrichment across distributed infrastructure.

mukul975 Bundle

Implement PCI DSS 4.0.1 compliance controls across all 12 requirements, including scoping, network security, data protection, access controls, monitoring, and governance.

mukul975 Bundle

Build a SCIM 2.0-compliant API server and integrate it with Okta for automated user provisioning, deprovisioning, profile updates, and group management.

mukul975 Bundle

Conduct authorized red team initial access using EvilGinx3 adversary-in-the-middle phishing to capture session tokens and bypass multi-factor authentication.

mukul975 Bundle

Execute remote commands on Windows targets using WMI-based lateral movement techniques, including Impacket wmiexec.py, CrackMapExec, and native PowerShell WMI commands for red team engagements.

mukul975 Bundle

Elevate from a low-privilege user account to root access on a compromised Linux system by exploiting misconfigurations, vulnerable services, kernel exploits, and weak permissions.

mukul975 Bundle

Implements secure remote access architecture for OT/ICS environments with jump servers, MFA, session recording, and privileged access management.

mukul975 Bundle

Validate backup integrity through cryptographic hash verification, automated restore testing, corruption detection, and recoverability checks to ensure backups are reliable for disaster recovery and ransomware response scenarios.

mukul975 Bundle

Verify TPM measured boot integrity and remote attestation using tpm2-tools, including PCR reading, event log replay, quote generation and verification, and golden baseline comparison.

mukul975 Bundle

Detect and analyze Linux persistence mechanisms including crontab entries, systemd service units, LD_PRELOAD hijacking, bashrc modifications, and authorized_keys backdoors using auditd and file integrity monitoring.

mukul975 Bundle

Parse Windows PowerShell Script Block Logs (Event ID 4104) from EVTX files to detect obfuscated commands, encoded payloads, and living-off-the-land techniques.

mukul975 Bundle

Parse Windows LNK shortcut files to extract target paths, timestamps, volume information, and machine identifiers for forensic timeline reconstruction.

mukul975 Bundle

Extract Active Directory credentials via DCSync attacks and establish domain persistence by dumping KRBTGT, Domain Admin, and service account hashes for Golden Ticket creation.

mukul975 Bundle

Plan and execute a comprehensive red team engagement covering reconnaissance through post-exploitation using MITRE ATT&CK-aligned TTPs to evaluate an organization's detection and response capabilities.

mukul975 Bundle

Analyze Zeek dns.log files to detect DNS-based data exfiltration by computing Shannon entropy, flagging long subdomain labels, and identifying anomalous query patterns.