Results for “esmc”

Enumerate SMB, WinRM, LDAP, and MSSQL services, validate credentials, spray passwords, and execute commands on remote hosts using NetExec during authorized penetration tests.

Design, implement, test, and maintain SIEM detection rules mapped to MITRE ATT&CK across Splunk, Elastic, and Sentinel platforms.

Identifies and exploits SMB protocol vulnerabilities using Metasploit Framework during authorized penetration tests to demonstrate risks from unpatched Windows systems, misconfigured shares, and weak authentication in enterprise networks.

Exploit misconfigured Active Directory Certificate Services ESC1 vulnerability to request certificates as high-privileged users and escalate domain privileges during authorized red team assessments.

Builds an external attack surface management (EASM) program using Shodan, Censys, and ProjectDiscovery tools for asset discovery, subdomain enumeration, service fingerprinting, and exposure scoring.

Exploits the MS17-010 (EternalBlue) vulnerability in Microsoft's SMBv1 implementation for authorized security testing, red team exercises, and penetration testing engagements.

Detect DCOM-based lateral movement by correlating Sysmon process creation and network connection events, WMI event analysis, and RPC endpoint mapper traffic to identify abuse of MMC20.Application, ShellBrowserWindow, and ShellWindows COM objects.

Detects defense evasion techniques in endpoint logs, including log tampering, timestomping, process injection, and security tool disabling, using Sysmon, EDR telemetry, and SIEM queries.

Expert Australian Information Security Manual (ISM) advisor for government entities and their supply chains. Use for ISM control selection, gap analysis, system authorisation, IRAP assessment preparation, security documentation, and ASD compliance. Triggers on: ISM controls, ASD compliance, IRAP assessment, PROTECTED system scoping, Essential Eight vs ISM, system authorisation, NC/OS/ PROTECTED/SECRET/TOP SECRET classification markings, security objectives, ISM guidelines or chapters, control applicability markings, cybersecurity documentation for Australian government, and any question about the ASD Information Security Manual framework or Australian government cybersecurity obligations.

Detect authentication attacks, privilege escalation, persistence mechanisms, and lateral movement by analyzing Windows Security, System, and Sysmon event logs in Splunk using SPL queries mapped to MITRE ATT&CK techniques.

Detect malicious scheduled task creation and modification using Sysmon Event IDs 1, 11, and Windows Security Event 4698/4702, correlating task creation with suspicious parent processes, public directory paths, and encoded command arguments to identify persistence and lateral movement.