Results for “threat-analysis”

Systematically evaluates evidence to determine which threat actor is responsible for a cyber operation using the Diamond Model and Analysis of Competing Hypotheses.

Map threat actor behavior to the MITRE ATT&CK framework, build technique coverage heatmaps, identify detection gaps, and produce actionable intelligence reports.

Evaluate industry dynamics and market attractiveness by analyzing competitive rivalry, supplier power, buyer power, threat of substitutes, and threat of new entrants.

Analyzes malware command-and-control (C2) communication protocols to understand beacon patterns, command structures, data encoding, and infrastructure for detection development and threat intelligence.

Deploy Nozomi Networks Guardian sensors for passive OT network traffic analysis to achieve asset visibility, threat detection, and vulnerability assessment across industrial control systems.

Map adversary TTPs against organizational assets using the MITRE ATT&CK framework, assess detection coverage gaps, and prioritize defensive investments.

Implement a structured threat intelligence lifecycle encompassing planning, collection, processing, analysis, dissemination, and feedback stages to produce actionable intelligence for organizational decision-making.

Guides the end-to-end cyber threat intelligence lifecycle from planning and direction through collection, processing, analysis, dissemination, and feedback to establish or mature a CTI program.

Conducts HIPAA risk analysis per 45 CFR §164.308(a)(1) following OCR guidance methodology. Covers threat identification, vulnerability assessment, likelihood and impact determination, risk scoring, and mitigation planning for electronic protected health information. Keywords: HIPAA risk analysis, OCR guidance, threat assessment, vulnerability, risk management, ePHI.

Hunt for threats in Windows Event Logs using Chainsaw, a fast Rust-based forensic tool that runs Sigma rules, keyword searches, and artifact analysis offline.

Analyze suspected malware through static, dynamic, and behavioral techniques, including IOC extraction, YARA or Sigma rules, sandboxing, and anti-analysis behavior detection.

Monitors authorized threat intelligence feeds and maps adversary TTPs to MITRE ATT&CK, NIST CSF, and ISO 27001 frameworks to produce actionable intelligence reports with IOCs and defensive recommendations.

Analyze AWS CloudTrail logs for security monitoring, threat detection, and forensic investigation using Athena, CloudWatch Logs Insights, and SIEM integration.

Conduct structured threat modeling for software systems using established methodologies to identify, prioritize, and mitigate security threats before they are exploited. Use when the user requests threat modeling or provides relevant inputs for this workflow.

Ingests, normalizes, and enriches structured and unstructured threat intelligence feeds into STIX 2.1 format, evaluating feed quality and deduplicating indicators for distribution to SIEM, firewall, and EDR platforms.

Assess AI/ML systems for prompt injection, jailbreak vulnerabilities, model inversion risk, data poisoning exposure, and agent tool abuse, with MITRE ATLAS mapping and guardrail recommendations.

Scan files, directories, and memory dumps using YARA rules to identify malware families, suspicious patterns, and IOC matches.

Transform threat intelligence and attack patterns into testable hunting hypotheses for proactive threat detection.

Develops comprehensive threat actor profiles for APT groups, criminal organizations, and hacktivist collectives by aggregating TTP documentation, historical campaign data, tooling fingerprints, and attribution indicators from multiple intelligence sources.

Proactively hunts for Advanced Persistent Threat activity using hypothesis-driven searches across endpoint telemetry, network logs, and memory artifacts.

Conduct a defensible cybersecurity risk assessment using the NIST SP 800-30 Rev 1 methodology, from scoping and threat identification to risk determination and communication.

Use when designing new systems, features, or integrations to identify potential security threats and vulnerabilities before they are exploited. This skill provides a structured approach to threat identification, risk assessment, and mitigation planning.

Detect insider threat behavioral indicators including unusual data access, off-hours activity, mass file downloads, privilege abuse, and resignation-correlated data theft.

Guides blue-team threat hunting and detection engineering with hypothesis-driven workflows, Sigma/YARA rule creation, SIEM query design, and validation using Atomic Red Team in authorized environments.

Enables ultra-granular, line-by-line code analysis to build deep architectural context before vulnerability or bug finding.

Triages security incidents by classifying type, assigning severity based on business impact, enriching with threat intelligence, and routing to appropriate response teams using NIST SP 800-61r3 and SANS PICERL frameworks.

Create data flow diagrams, identify threats using STRIDE and LINDDUN methodologies, and generate threat model reports for secure design review with OWASP Threat Dragon.

Evaluates and selects Threat Intelligence Platform (TIP) products based on organizational requirements including feed integration capability, STIX/TAXII support, workflow automation, analyst interface, and total cost of ownership.

Monitor and analyze ransomware group data leak sites (DLS) to track victim postings, extract threat intelligence on group tactics, and assess sector-specific ransomware risk for proactive defense.

Query MISP event statistics, attribute distributions, threat actor galaxy clusters, and tag trends over time to generate threat landscape reports.