Results for “waf-evasion”

Analyze WAF logs from ModSecurity, AWS WAF, or Cloudflare to detect SQL injection attack campaigns, classify injection types, and generate incident reports with OWASP classification.

Configure ModSecurity WAF with OWASP Core Rule Set for web application logging, tune rules to reduce false positives, and analyze audit logs for attack detection.

Detect sandbox evasion techniques in malware samples by analyzing timing checks, VM artifact queries, user interaction detection, and sleep inflation patterns from Cuckoo/AnyRun behavioral reports.

Guides authorized Wi-Fi security assessments including handshake capture, PMKID collection, rogue AP detection, and offline password policy evaluation using aircrack-ng, hashcat, and Wireshark.

Detects defense evasion techniques in endpoint logs, including log tampering, timestomping, process injection, and security tool disabling, using Sysmon, EDR telemetry, and SIEM queries.

Protect API Gateway endpoints with AWS WAF by configuring managed rule groups, rate limiting, bot control, IP reputation filtering, and monitoring.

Analyze AWS GuardDuty findings, detectors, suppression rules, and member accounts with parallel execution and anti-hallucination guardrails.

Systematically audits a web application against the OWASP 2021 Top 10, producing severity-rated, file-level findings with fixes for each category.

Enforces OWASP Top 10:2025 compliance on code touching security-relevant domains, using cached cheat sheets and verifying fixes against OSV.dev.

Detect and respond to Adversary-in-the-Middle (AiTM) phishing attacks that use reverse proxy kits like EvilProxy, Evilginx, and Tycoon 2FA to bypass MFA and steal session tokens.

Detect WMI-based lateral movement by analyzing Windows Event ID 4688 process creation and Sysmon Event ID 1 for WmiPrvSE.exe child process patterns, remote process execution, and WMI event subscription persistence.

Detect container escape attempts in real-time using Falco runtime security rules that monitor syscalls, file access, and privilege escalation.

Hunt for adversary persistence through Windows Management Instrumentation event subscriptions by monitoring WMI consumer, filter, and binding creation events that execute malicious code triggered by system events.

Performs a full-stack security posture assessment with 0-100 risk scoring, scanning dependencies, code patterns, configuration, and data handling, then produces a prioritized report and routes to specialized skills.