Security

Recover deleted records, analyze freelist pages, WAL files, and unallocated space in SQLite databases for digital forensics and incident response.

Scan container images for known vulnerabilities using Anchore Grype with SBOM-based matching and configurable severity thresholds.

Monitor and map adversary-controlled assets including C2 servers, phishing domains, and exploit kit hosts using passive DNS, certificate transparency logs, Shodan/Censys scanning, WHOIS analysis, and network fingerprinting.

Analyzes bootkit and rootkit malware that infects MBR, VBR, or UEFI firmware for pre-OS persistence, covering boot sector analysis, UEFI module inspection, and anti-rootkit detection.

Detect PowerShell Empire framework artifacts in Windows event logs by identifying Base64 encoded launcher patterns, default user agents, staging URL structures, stager IOCs, and known Empire module signatures in Script Block Logging events.

Architect C2 redirectors with nginx and Apache, derive filter rules from malleable profiles, and apply OPSEC controls for resilient red-team infrastructure.

Builds SOC performance metrics and KPI tracking dashboards measuring Mean Time to Detect (MTTD), Mean Time to Respond (MTTR), alert quality ratios, analyst productivity, and detection coverage using SIEM data.

Deploy and integrate open-source CTI tools (MISP, OpenCTI, TheHive, Cortex) into a unified threat intelligence platform for collecting, analyzing, enriching, and disseminating threat intelligence.

Responds to phishing incidents by analyzing reported emails, extracting indicators, assessing credential compromise, quarantining malicious messages, and remediating affected accounts.

Configure secure OAuth 2.0 authorization flows including Authorization Code with PKCE, Client Credentials, and Device Authorization Grant, covering flow selection, PKCE implementation, token lifecycle management, scope design, and alignment with OAuth 2.1 security requirements.

Correlates security events in IBM QRadar SIEM using AQL queries, custom rules, building blocks, and offense management to detect multi-stage attacks across network, endpoint, and application log sources.

Detects and analyzes fileless malware that operates entirely in memory using PowerShell, WMI, .NET reflection, registry-resident payloads, and living-off-the-land binaries (LOLBins) without writing traditional executable files to disk.

Identifies lateral movement techniques in enterprise networks by analyzing authentication logs, network flows, SMB traffic, and RDP sessions using Zeek, Velociraptor, and SIEM correlation rules to detect attackers moving between systems.

Detect abuse of legitimate Windows binaries (LOLBins) used for living off the land attacks by monitoring process creation, command-line arguments, and parent-child relationships.

Hunt for Mimikatz execution using command-line patterns, LSASS access signatures, binary indicators, and in-memory detection of known modules.

Audits Azure Storage accounts for misconfigurations including public blob access, weak network rules, missing encryption, permissive SAS tokens, and disabled logging using Azure CLI, PowerShell, and Defender for Storage.

Deploys and configures Zeek network security monitor to passively analyze traffic, generate structured logs, detect anomalous behavior, and create custom detection scripts for threat hunting and incident response.

Configures Fail2ban with custom filters and actions to detect port scanning, SSH brute force, and network reconnaissance, automatically banning offending IPs and alerting security teams.

Detect process hollowing (T1055.012) by analyzing memory-mapped sections, hollowed process indicators, and parent-child process anomalies in EDR telemetry.

Escalate from standard domain user to Domain Admin by exploiting the noPac vulnerability chain (CVE-2021-42278 sAMAccountName spoofing and CVE-2021-42287 KDC PAC confusion) in Active Directory environments.

Hardens the Docker daemon by configuring daemon.json with user namespace remapping, TLS authentication, rootless mode, and CIS benchmark controls.

Enables comprehensive security monitoring across Azure subscriptions, including cloud security posture management, workload protection, regulatory compliance assessment, and adaptive security controls.

Analyze AWS CloudTrail logs for security monitoring, threat detection, and forensic investigation using Athena, CloudWatch Logs Insights, and SIEM integration.

Deploy kernel-level runtime security monitoring on Linux hosts or Kubernetes clusters using eBPF and Cilium Tetragon for process execution tracking, network observability, file access auditing, and runtime enforcement.

Enforce deploy-time security controls that ensure only trusted, attested container images are deployed to Google Kubernetes Engine and Cloud Run.

Deploy and configure Tofino industrial firewalls to protect SCADA systems and PLCs using deep packet inspection for OT protocols including Modbus, EtherNet/IP, OPC, and S7comm, enforcing granular access control between ICS security zones.

Design and implement security zones and conduits for industrial automation and control systems per IEC 62443-3-2, including zone partitioning, firewall configuration, and validation through traffic analysis and penetration testing.

Investigate phishing email incidents from initial user report through header analysis, URL/attachment detonation, impacted user identification, and containment actions using SOC tools like Splunk, Microsoft Defender, and sandbox analysis platforms.

Audits Kubernetes pods for container escape vectors by analyzing privileged mode, dangerous capabilities, host namespace sharing, and writable hostPath mounts using the Kubernetes Python client.

Recover files from disk images and unallocated space using Foremost's header-footer signature carving to extract evidence regardless of file system state.

Test GraphQL APIs for depth limit vulnerabilities by sending deeply nested recursive queries to identify denial-of-service risks.

Crack password hashes using Hashcat for authorized penetration testing and password policy assessment, supporting dictionary, brute-force, rule-based, and hybrid attacks.

Detects lateral movement techniques including Pass-the-Hash, PsExec, WMI execution, RDP pivoting, and SMB-based spreading using SIEM correlation of Windows event logs, network flow data, and endpoint telemetry mapped to MITRE ATT&CK Lateral Movement (TA0008) techniques.

Executes Atomic Red Team tests mapped to MITRE ATT&CK techniques, performs coverage gap analysis, and runs detection validation loops to measure blue team visibility.

Detect and exploit second-order SQL injection vulnerabilities where malicious input is stored in a database and later executed in an unsafe SQL query during a different application operation.

Exploit path normalization discrepancies between CDN caching layers and origin servers to cache and retrieve authenticated content.