Results for “pr”

Hunt for adversary persistence and execution via Windows scheduled tasks by analyzing task creation events, suspicious task properties, and unusual execution patterns.

Inventory cryptographic assets, deploy hybrid X25519 and ML-KEM key exchange, and prioritize migration of harvest-now-decrypt-later data.

Extract, parse, and analyze Windows Event Logs (EVTX) using Chainsaw, Hayabusa, and EvtxECmd to detect lateral movement, persistence, and privilege escalation.

Build network traffic baselines from NetFlow/IPFIX data using Python pandas for statistical analysis, z-score anomaly detection, and hourly/daily traffic pattern profiling.

Simulates BGP hijacking attacks in isolated lab environments to test RPKI deployment, route origin validation, and BGP monitoring defenses against prefix hijacking and route leak attacks.

Implements secure remote access architecture for OT/ICS environments with jump servers, MFA, session recording, and privileged access management.

Automates alert triage, IOC enrichment, containment actions, and incident response playbooks using Splunk SOAR (Phantom) to reduce manual analyst work and standardize response procedures.

Analyze volatile memory dumps using Volatility 3 to extract running processes, network connections, loaded modules, and evidence of malicious activity.

Scan open-source dependencies for known vulnerabilities using Snyk, including CI/CD integration, automated fix PRs, license compliance, and continuous monitoring.

Design and execute a social engineering penetration test including phishing, vishing, smishing, and physical pretexting campaigns to measure human security resilience and identify training gaps.

Map adversary TTPs against organizational assets using the MITRE ATT&CK framework, assess detection coverage gaps, and prioritize defensive investments.

Build structured communication templates for malware incidents including stakeholder notifications, executive briefings, technical advisories, and regulatory disclosures with severity-based escalation procedures.

Audits Snapchat Ads measurement, Snap Pixel, Conversions API, mobile and app campaigns, creative formats, audiences, budgets, brand safety, and reporting.

Generates task-oriented technical documentation with progressive disclosure for READMEs, API docs, architecture docs, and security reports after reverse engineering, penetration testing, or CTF tasks.

Applies ISO/IEC 42001 to establish, audit, or certify an AI Management System, mapping controls to clauses 4-10 and producing governance plans.

Implements AI safety guardrails including input validation, output filtering, robustness testing, human oversight, and monitoring to prevent harmful outputs and ensure system reliability.

You're a developer who has shipped dozens of Firebase projects. You've seen the "easy" path lead to security breaches, runaway costs, and impossible migrations. You know Firebase is powerful, but you also know its sharp edges.

Ensure HIPAA compliance when handling PHI (Protected Health Information). Use when writing code that accesses user health data, check-ins, journal entries, or any sensitive information. Activates for audit logging, data access, security events, and compliance questions.

Review code changes for correctness, completeness, bugs, edge cases, and quality. Load when the user explicitly asks to review code, check a PR, review a diff, audit recent changes, or verify an implementation matches requirements. Also triggers on "review this code", "check this PR", "review my changes", "code review", "did this implement correctly", "audit this diff", or any explicit request for a formal code review. Do NOT load for "review changes for context" or "review what happened" — those are requests to read code, not to perform a formal review.

Detect anomalous user activities including impossible travel, unusual access patterns, privilege abuse, and insider threats using SIEM-based behavioral baselines and statistical analysis.

Deploys and configures CrowdStrike Falcon EDR sensors across Windows, macOS, and Linux endpoints, sets prevention and response policies, validates deployment, and integrates with SIEM platforms.

Deploy and operationalize Amazon GuardDuty for continuous threat detection across AWS accounts and workloads, including enabling protection plans, interpreting findings, and building automated response workflows.

Deploy MISP, configure threat feeds, use the PyMISP API for programmatic access, and build automated collection pipelines that aggregate IOCs from multiple community and commercial sources.

Automate AWS GuardDuty threat detection findings processing using EventBridge and Lambda to enable real-time incident response, automatic quarantine of compromised resources, and security notification workflows.

Simulate an insider threat or post-breach attacker to identify lateral movement paths, privilege escalation vectors, and sensitive data exposure within a corporate network.

Detects defense evasion techniques in endpoint logs, including log tampering, timestomping, process injection, and security tool disabling, using Sysmon, EDR telemetry, and SIEM queries.

Map application dependencies, create granular network policies, visualize east-west traffic flows, and enforce least-privilege communication between workloads using Akamai Guardicore Segmentation.

Provides a comprehensive penetration testing toolchain with 20+ security tools (Nmap, Nuclei, SQLMap, FFUF, Hashcat, etc.) exposed via MCP servers for authorized vulnerability scanning, exploitation, and reporting.

Analyzes vendor security patches via binary diffing to reverse-engineer vulnerabilities, write proof-of-concept exploits, and weaponize N-day exploits against unpatched systems.

Provides structured reverse engineering techniques for analyzing compiled, obfuscated, packed, or virtualized targets including binaries, APKs, WASM, firmware, and custom VMs using static and dynamic analysis workflows.

Audits Claude Code configuration files for security vulnerabilities, misconfigurations, and injection risks using AgentShield, covering CLAUDE.md, settings.json, MCP servers, hooks, and agent definitions.

Audits source code across C++, Android, iOS, and Web to classify files, detect embedded third-party libraries, and produce four-level verdicts with interactive HTML reports.

Generates specific, implementable fixes for each vulnerability finding, producing code patches, configuration changes, dependency updates, and IaC fixes with before/after code and verification steps.

You're a developer who has shipped dozens of Firebase projects. You've seen the "easy" path lead to security breaches, runaway costs, and impossible migrations. You know Firebase is powerful, but you also know its sharp edges.

Variable name improvement, function extraction, magic number constants, dead code removal, and code review. For refactoring and PR review — does not change behavior. Don't use for bug/security (Judge), new tests (Radar), architecture (Atlas), or feature implementation (Builder).

Scans a codebase for security, database, deployment, code quality, AI/LLM, dependency, frontend, and observability issues before deployment. Intercepts deploy commands and blocks until critical items pass.