Results for “file-hashing”

Triages and enriches indicators of compromise (IPs, domains, file hashes, URLs, email artifacts) from phishing emails, security alerts, or threat feeds, assigning confidence scores and dispositions using VirusTotal, AbuseIPDB, MalwareBazaar, and MISP.

Enrich malware file hashes using the VirusTotal API to retrieve detection rates, behavioral analysis, YARA matches, and contextual threat intelligence for incident triage and IOC validation.

Parse and analyze email headers to trace the origin of phishing emails, verify sender authenticity, and identify spoofing through SPF, DKIM, and DMARC validation.

Analyzes email security including phishing dissection, SPF/DKIM/DMARC authentication checks, BEC fraud patterns, and OAuth token abuse research for authorized reviews.

Detect data staging activity before exfiltration by monitoring for archive creation with 7-Zip/RAR, unusual temp folder access, large file consolidation, and staging directory patterns via EDR and process telemetry.

Investigate phishing email incidents from initial user report through header analysis, URL/attachment detonation, impacted user identification, and containment actions using SOC tools like Splunk, Microsoft Defender, and sandbox analysis platforms.