Results for “attack-surface-reduction”

Builds an external attack surface management (EASM) program using Shodan, Censys, and ProjectDiscovery tools for asset discovery, subdomain enumeration, service fingerprinting, and exposure scoring.

Guides authorized Active Directory security research covering Kerberos attacks, AD CS vulnerabilities, BloodHound path analysis, NTLM relay, and domain privilege escalation techniques.

Map adversary TTPs against organizational assets using the MITRE ATT&CK framework, assess detection coverage gaps, and prioritize defensive investments.

Implement API abuse detection using token bucket, sliding window, and adaptive rate limiting algorithms to prevent DDoS, brute force, and credential stuffing attacks.

Compares Trailmark code graphs at two source code snapshots to surface security-relevant structural changes that text diffs miss, such as new attack paths, blast radius growth, and privilege boundary modifications.

Maps observed adversary behaviors, security alerts, and detection rules to MITRE ATT&CK techniques and sub-techniques to quantify detection coverage and guide control prioritization.

Map MITRE ATT&CK coverage to identify detection gaps, prioritize rule development, and measure SOC detection maturity against adversary techniques.

Detect and test for OWASP API3:2023 Broken Object Property Level Authorization vulnerabilities including excessive data exposure and mass assignment attacks.

Performs a static-analysis penetration test to find exploitable vulnerabilities, providing proof-of-concept payloads and fixes. Covers injection, XSS, authentication bypass, authorization flaws, path traversal, command injection, CSRF, SSRF, hardcoded secrets, and insecure deserialization, with a full attack surface.

Detect authentication attacks, privilege escalation, persistence mechanisms, and lateral movement by analyzing Windows Security, System, and Sysmon event logs in Splunk using SPL queries mapped to MITRE ATT&CK techniques.

Reverse-engineers EDR, Defender, and AV hook tables, ETW providers, and AMSI implementations to build targeted bypasses including unhooking, indirect syscalls, ETW patching, and call stack spoofing for authorized red team operations.