Results for “non-intentional-action”

Executes containment strategies to stop active adversary operations and prevent lateral movement during a confirmed security breach, using network segmentation, endpoint isolation, credential revocation, and access control modifications.

Detect and defend against prompt injection hidden in documents, web pages, and images consumed by an agent.

Audit Android component configurations and Intent handling to prevent Intent Redirection and unauthorized access.

Use to measure customer effort from behavioural signals instead of CES surveys, and to audit whether a composite effort score is honest. Trigger for "customer effort score", "behavioural CES", effort without survey, repeat contacts and channel switches, transfers and reopens, or "our CES doesn't match operational data".

Detect malicious scheduled task creation and modification using Sysmon Event IDs 1, 11, and Windows Security Event 4698/4702, correlating task creation with suspicious parent processes, public directory paths, and encoded command arguments to identify persistence and lateral movement.

Facilitates discussion-based tabletop exercises for SOC teams to test incident response procedures, communication workflows, and decision-making under pressure without impacting production systems.

Detect anomalous user activities including impossible travel, unusual access patterns, privilege abuse, and insider threats using SIEM-based behavioral baselines and statistical analysis.

Conduct authenticated and unauthenticated vulnerability scans using Tenable Nessus to identify known vulnerabilities, misconfigurations, and missing patches, with prioritized remediation guidance.