Results for “microsoft-defender”

Enables comprehensive security monitoring across Azure subscriptions, including cloud security posture management, workload protection, regulatory compliance assessment, and adaptive security controls.

Proactively hunt for adversary abuse of legitimate system binaries (LOLBins) to execute malicious payloads while evading detection.

Configures memory protection mechanisms including DEP, ASLR, CFG, and Windows Exploit Protection to harden endpoints against buffer overflows, ROP chains, and code injection.

Execute OAuth 2.0 device-code and illicit-consent phishing attacks against Microsoft Entra ID to steal access and refresh tokens, bypass MFA, and pivot across Microsoft 365 services during authorized red-team engagements.

Detects and responds to OAuth token theft and replay attacks in cloud environments, focusing on Microsoft Entra ID token protection, conditional access policies, and sign-in anomaly detection.

Configure Cloudflare DDoS protection with managed rulesets, rate limiting, WAF rules, Bot Management, and origin protection to mitigate volumetric, protocol, and application-layer attacks.

Executes containment strategies to stop active adversary operations and prevent lateral movement during a confirmed security breach, using network segmentation, endpoint isolation, credential revocation, and access control modifications.

Guides authorized Active Directory security research covering Kerberos attacks, AD CS vulnerabilities, BloodHound path analysis, NTLM relay, and domain privilege escalation techniques.

Detect NTFS timestamp manipulation (MITRE T1070.006) by comparing $STANDARD_INFORMATION vs $FILE_NAME timestamps in the MFT using analyzeMFT and Python.

Perform evidence-backed security audits for the Adobe Dispatcher Apache HTTP Server module and related HTTPD configuration in AMS workflows.

Extracts and analyzes malicious VBA macros, XLM macros, DDE, and remote template injections in Microsoft Office documents using olevba, oledump, and deobfuscation techniques to identify download cradles, payload execution, and persistence mechanisms.

Systematically hunt for adversary persistence mechanisms across Windows endpoints including registry, services, startup folders, and WMI subscriptions.

Configures sensitivity labels, DLP policies, and endpoint data protection rules in Microsoft Purview to safeguard sensitive information across Exchange, SharePoint, OneDrive, Teams, and endpoints.

Guides implementing authentication, authorization, input validation, and OWASP Top 10 prevention with secure code patterns and validation checkpoints.

Detect compromised cloud credentials across AWS, Azure, and GCP by analyzing anomalous API activity, impossible travel patterns, unauthorized resource provisioning, and credential abuse indicators using GuardDuty, Defender for Identity, and SCC Event Threat Detection.

Hardens Windows Active Directory environments against ransomware by configuring Group Policy Objects with AppLocker rules, Controlled Folder Access, Attack Surface Reduction rules, and lateral movement restrictions.

Exploit Kerberos Constrained Delegation misconfigurations in Active Directory to impersonate privileged users via S4U2self and S4U2proxy extensions for lateral movement and privilege escalation.

Detect DCOM-based lateral movement by correlating Sysmon process creation and network connection events, WMI event analysis, and RPC endpoint mapper traffic to identify abuse of MMC20.Application, ShellBrowserWindow, and ShellWindows COM objects.

Produces a decision-grade dossier on a specific company, person, nonprofit, or government org by testing the user's hypothesis rather than confirming it. Outputs an editable Word document with verdict, identity facts, 12-month activity timeline, network and reputation signals, and red flags.

Hunt for Mimikatz execution using command-line patterns, LSASS access signatures, binary indicators, and in-memory detection of known modules.

Systematically remove malware, backdoors, and attacker persistence mechanisms from infected systems while ensuring complete eradication and preventing re-infection.

Detect and defend against prompt injection hidden in documents, web pages, and images consumed by an agent.

Microsoft Advertising (Bing Ads) platform expertise. Audit campaigns, keywords, audiences, and UET tracking. Use when the user asks about Microsoft Ads, Bing Ads, search advertising on Microsoft, LinkedIn audience targeting, or Performance Max campaigns on Microsoft.

Reverse-engineers EDR, Defender, and AV hook tables, ETW providers, and AMSI implementations to build targeted bypasses including unhooking, indirect syscalls, ETW patching, and call stack spoofing for authorized red team operations.

Analyze AWS GuardDuty findings, detectors, suppression rules, and member accounts with parallel execution and anti-hallucination guardrails.

Detect DLL side-loading attacks where adversaries place malicious DLLs alongside legitimate applications to hijack execution flow for defense evasion.

Builds a structured SOC incident response playbook for ransomware attacks covering detection, containment, eradication, and recovery phases with specific SIEM queries, isolation procedures, and decision trees.

Restricts unauthorized removable media access on endpoints by implementing USB device control policies via Group Policy, Intune, or EDR platforms to prevent data exfiltration and malware introduction.

Deploy AI and NLP-powered detection systems to identify business email compromise attacks by analyzing writing style, behavioral patterns, and contextual anomalies that evade traditional rule-based filters.