Results for “attack-path-analysis”

Analyzes .NET project code coverage and CRAP (Change Risk Anti-Patterns) scores to identify risk hotspots, methods blocking coverage gains, and prioritize where to add tests.

Red team tactics principles based on MITRE ATT&CK. Attack phases, detection evasion, reporting.

Hunt for Pass-the-Hash attacks by analyzing NTLM authentication patterns, identifying Type 3 logons where Kerberos is expected, and correlating with credential dumping indicators.

Analyzes malware-generated network traffic from PCAP files to identify C2 protocols, data exfiltration, DNS tunneling, and beaconing patterns using Wireshark, Zeek, Suricata, and Python.

Detect and prevent ARP spoofing attacks using ARPWatch, Dynamic ARP Inspection, Wireshark analysis, and custom Python monitoring scripts to protect against man-in-the-middle interception.

Red team tactics principles based on MITRE ATT&CK. Attack phases, detection evasion, reporting.

Detect dangerous ACL misconfigurations in Active Directory by querying and parsing nTSecurityDescriptor attributes to identify GenericAll, WriteDACL, WriteOwner, and GenericWrite abuse paths.

Investigate supply chain attack artifacts including trojanized software updates, compromised build pipelines, and sideloaded dependencies to identify intrusion vectors and scope of compromise.

Detect sophisticated cyber-physical attacks that modify PLC logic while spoofing sensor readings, covering PLC integrity monitoring, process anomaly detection, and multi-stage attack chain detection.

Performs a static-analysis penetration test to find exploitable vulnerabilities, providing proof-of-concept payloads and fixes. Covers injection, XSS, authentication bypass, authorization flaws, path traversal, command injection, CSRF, SSRF, hardcoded secrets, and insecure deserialization, with a full attack surface.

Detects credential stuffing attacks by analyzing authentication logs for login velocity anomalies, ASN diversity, password spray patterns, and geographic distribution of failed logins using statistical analysis on Splunk or raw log data.

Imported skill analyze from langchain

Use this when the system needs clear analysis of trusted versus untrusted execution contexts, external inputs, client/server boundaries, provider callbacks, or admin-level code paths. Trigger on requests about trust boundaries, attack surfaces, or where verification must happen.

Investigate Active Directory compromise by analyzing authentication logs, replication metadata, Group Policy changes, and Kerberos ticket anomalies to identify attacker persistence and lateral movement paths.