← all publishers

jihedbfr-art

@jihedbfr-art source repo

Report this profile Claim this profile

• 260 skills
• 0 followers
• 11 hours ago last updated

1. ▌
   Exfiltration Simulation · jihedbfr-art bundle

   Use when testing data-loss controls in an authorised engagement — simulating exfiltration with dummy data to see whether the organisation detects and prevents data leaving.
   0 installs
2. ▌
   Reporting A Sample · jihedbfr-art bundle

   Use when writing up a malware analysis — a report that gives IR, detection, and leadership what each needs from the sample, turning analysis into action.
   0 installs
3. ▌
   Attack Emulation Planning · jihedbfr-art bundle

   Use when planning an adversary emulation — mapping a real threat actor's behaviour to a scenario grounded in MITRE ATT&CK, so the engagement tests defences against threats that actually matter.
   0 installs
4. ▌
   Initial Access Tradecraft · jihedbfr-art bundle

   Use when planning the initial-access phase of an authorised engagement — how adversaries get the first foothold (phishing, exposed services) and, for defenders, how to detect and prevent it.
   0 installs
5. ▌
   Ad Enumeration Bloodhound · jihedbfr-art bundle

   Use when you have a domain foothold and need to map Active Directory attack paths — collecting data with SharpHound and analysing it in BloodHound — plus what to fix.
   0 installs
6. ▌
   Privilege Escalation Chains · jihedbfr-art bundle

   Use when emulating privilege escalation in an authorised engagement — chaining local escalations and misconfigurations into higher privilege, and how defenders break the chains.
   0 installs
7. ▌
   Building A Malware Lab · jihedbfr-art bundle

   Use before analysing any malware — building an isolated environment where a sample can run and be observed without escaping to your network or the internet.
   0 installs
8. ▌
   Disassembly With Ghidra · jihedbfr-art bundle

   Use when you need to read a malware sample's compiled code — using Ghidra to disassemble and decompile, and knowing what to look for instead of reading everything.
   0 installs
9. ▌
   C2 And Network Analysis · jihedbfr-art bundle

   Use when analysing how malware communicates with its command-and-control — the protocols, beaconing, and encoding — to understand the channel and produce network detections.
   0 installs
10. ▌
    Dcsync And Credential Dumping · jihedbfr-art bundle

    Use when demonstrating how domain and host credentials get harvested — DCSync, LSASS dumping, and cached secrets — and the controls and detections that stop it.
    0 installs
11. ▌
    Scoping And Rules Of Engagement · jihedbfr-art bundle

    Use before any offensive engagement to define scope, authorisation, and boundaries in writing — the document that separates authorised testing from a crime.
    0 installs
12. ▌
    Dynamic Analysis Sandboxing · jihedbfr-art bundle

    Use when detonating a malware sample in an isolated sandbox to observe its behaviour — the files, registry, processes, and network activity it produces — safely.
    0 installs
13. ▌
    Analysing Scripts And Macros · jihedbfr-art bundle

    Use when analysing script-based malware — malicious Office macros, PowerShell, JavaScript, and the deobfuscation that reveals what a dropper actually does.
    0 installs
14. ▌
    Hypothesis Driven Hunting · jihedbfr-art bundle

    Use when you want to proactively hunt for threats the alerts missed — framing a testable hypothesis, searching the telemetry to prove or kill it, and turning findings into detections.
    0 installs
15. ▌
    Enrichment Pipelines · jihedbfr-art bundle

    Use when building automated enrichment for indicators — adding context (reputation, WHOIS, relationships, geolocation) to raw IoCs so they become actionable intelligence.
    0 installs
16. ▌
    Containment Strategies · jihedbfr-art bundle

    Use once an incident is confirmed and scoped — deciding how to stop the spread without destroying evidence or tipping off the attacker prematurely.
    0 installs
17. ▌
    Security Headers · jihedbfr-art bundle

    Use when reviewing or hardening a web app's HTTP response headers — CSP, HSTS, and the rest — knowing which actually reduce risk and which are theatre.
    0 installs
18. ▌
    S3 Bucket Misconfiguration · jihedbfr-art bundle

    Use when checking AWS S3 (or S3-compatible) buckets for public read/write exposure — the classic cloud data leak — and locking them down.
    0 installs
19. ▌
    Kms And Secrets Management · jihedbfr-art bundle

    Use when managing encryption keys and secrets in the cloud — key policies, envelope encryption, and secret stores — so encrypted data and stored credentials stay actually protected.
    0 installs
20. ▌
    Taint Tracking By Hand · jihedbfr-art bundle

    Use when reviewing source for injection-class bugs — following untrusted input from where it enters (source) to where it does damage (sink) to decide if a path is exploitable.
    0 installs
21. ▌
    Deserialization Review · jihedbfr-art bundle

    Use when reviewing code that turns bytes back into objects — spotting the unsafe deserialisation paths that lead to RCE, across Java, Python, .NET, and friends.
    0 installs
22. ▌
    Systemd Hardening · jihedbfr-art bundle

    Use when hardening Linux services with systemd unit directives — sandboxing a daemon so a compromise of it can't reach the rest of the system.
    0 installs
23. ▌
    JWT And Token Crypto · jihedbfr-art bundle

    Use when signing and verifying JWTs or similar tokens — choosing the algorithm, managing signing keys, and avoiding the cryptographic footguns that let tokens be forged.
    0 installs
24. ▌
    Patch Management · jihedbfr-art bundle

    Use when building a patch process that actually closes vulnerabilities — rolling fixes out reliably and on time without breaking production, and knowing when you can't patch.
    0 installs
25. ▌
    Spf Dkim Dmarc · jihedbfr-art bundle

    Use when configuring email authentication to stop spoofing of your domain — SPF, DKIM, and DMARC, the records that keep attackers from sending mail as you.
    0 installs
26. ▌
    Writing Sigma Rules · jihedbfr-art bundle

    Use when you want to write portable detection logic — a Sigma rule that expresses a detection once and converts to any SIEM's query language — and tune it to fire on the right thing.
    0 installs
27. ▌
    Edr Detection Logic · jihedbfr-art bundle

    Use when writing endpoint behavioural detections — the process, file, and behaviour patterns EDR telemetry exposes, and detecting attacker techniques rather than specific tools.
    0 installs
28. ▌
    Log Source Coverage · jihedbfr-art bundle

    Use when assessing whether you collect the telemetry your detections need — mapping what you can and can't see, because you can only detect what you're logging.
    0 installs
29. ▌
    Tactical Vs Strategic · jihedbfr-art bundle

    Use when producing intelligence for different audiences — understanding the tactical, operational, and strategic levels so intel reaches the SOC, IR, and leadership in the form each needs.
    0 installs
30. ▌
    Cloud Incident Response · jihedbfr-art bundle

    Use when responding to an incident in a cloud environment where there's no server to unplug — the API-driven, identity-centric response that differs from on-prem IR.
    0 installs
31. ▌
    Ir Playbook Development · jihedbfr-art bundle

    Use when writing incident response playbooks before you need them — turning a scenario into concrete, tested steps so the response isn't improvised at 3am.
    0 installs
32. ▌
    Port And Service Scanning · jihedbfr-art bundle

    Use when you need to know what's actually listening on a host or range — open ports, the services behind them, and their versions — before assessing or hardening it.
    0 installs
33. ▌
    Mobile Auth And Biometrics · jihedbfr-art bundle

    Use when assessing mobile authentication and biometric (Face ID / fingerprint) implementations — the local-auth mistakes that let an attacker bypass the lock without the biometric.
    0 installs
34. ▌
    Secure Runners · jihedbfr-art bundle

    Use when securing CI/CD build runners — especially self-hosted ones that persist state and run untrusted code, closing a common foothold into the build environment.
    0 installs
35. ▌
    Policy As Code · jihedbfr-art bundle

    Use when codifying security gates so they can't be skipped — expressing policy as versioned, testable code enforced automatically in the pipeline instead of relying on manual review.
    0 installs
36. ▌
    Auditd And Logging · jihedbfr-art bundle

    Use when setting up Linux audit logging — configuring auditd to record the security-relevant events that let you detect and investigate compromise, without drowning in noise.
    0 installs
37. ▌
    Eradication And Recovery · jihedbfr-art bundle

    Use after containment — removing the attacker's foothold completely and restoring to clean, trustworthy operation without reintroducing the compromise or leaving persistence behind.
    0 installs
38. ▌
    Disk Imaging And Hashing · jihedbfr-art bundle

    Use when you need a forensically sound copy of a disk before analysis — acquiring a bit-for-bit image, hashing to prove integrity, and preserving chain of custody.
    0 installs
39. ▌
    Anti Forensics Awareness · jihedbfr-art bundle

    Use when investigating a system where an attacker may have tried to destroy or falsify evidence — recognising log clearing, timestomping, wiping, and the traces these techniques leave.
    0 installs
40. ▌
    Sensitive Data Leakage · jihedbfr-art bundle

    Use when an LLM app could reveal data it shouldn't — secrets in the prompt, other users' data, training data, or PII — and the controls that keep sensitive data out of model output.
    0 installs
41. ▌
    Asn And Ip Mapping · jihedbfr-art bundle

    Use when tying an organisation's IP ranges back to it — mapping ASNs, netblocks, and cloud allocations so you know the full IP footprint that belongs to the target.
    0 installs
42. ▌
    Cloudtrail And Audit Logging · jihedbfr-art bundle

    Use when setting up or reviewing cloud audit logging — making sure API activity is recorded, protected from tampering, and actually usable during an investigation.
    0 installs
43. ▌
    Certificate Management · jihedbfr-art bundle

    Use when managing TLS/PKI certificates across their lifecycle — issuance, renewal, revocation, and inventory — so certificates don't expire in production or become an unmanaged sprawl.
    0 installs
44. ▌
    Post Quantum Readiness · jihedbfr-art bundle

    Use when assessing where post-quantum cryptography matters now versus later — the 'harvest now, decrypt later' risk, and the pragmatic first steps toward quantum-resistant crypto.
    0 installs
45. ▌
    Shift Handover · jihedbfr-art bundle

    Use when handing over between SOC shifts — the structured handoff that ensures ongoing investigations, watch items, and context transfer cleanly so nothing falls through the cracks.
    0 installs
46. ▌
    Siem Migration · jihedbfr-art bundle

    Use when migrating from one SIEM to another — moving detections, data sources, and operations to a new platform without going blind during the transition.
    0 installs
47. ▌
    Browser And App Forensics · jihedbfr-art bundle

    Use when reconstructing user activity from browser and application data — history, downloads, cached data, and app databases that reveal what a user did and when.
    0 installs
48. ▌
    Github Secret Recon · jihedbfr-art bundle

    Use when checking whether an organisation has leaked API keys, credentials, or internal infrastructure details in public git repositories.
    0 installs
49. ▌
    Metadata Extraction · jihedbfr-art bundle

    Use when mining an organisation's public documents for hidden metadata — usernames, software versions, internal paths, and names that leak from published files.
    0 installs
50. ▌
    Shodan Censys Recon · jihedbfr-art bundle

    Use when fingerprinting an organisation's internet-facing services through search engines that scan the whole internet — finding exposed services without sending them a packet yourself.
    0 installs
51. ▌
    Sast Integration · jihedbfr-art bundle

    Use when wiring static application security testing into the pipeline — catching code vulnerabilities on every build without drowning developers in false positives.
    0 installs
52. ▌
    Saml Security · jihedbfr-art bundle

    Use when an app uses SAML SSO — testing for signature-wrapping, unsigned-assertion, and comment-injection attacks that forge authentication, plus correct validation.
    0 installs
53. ▌
    Reporting Culture · jihedbfr-art bundle

    Use when building a culture where people report suspicious activity — making reporting easy, safe, and rewarded, so users become a detection layer instead of hiding mistakes.
    0 installs
54. ▌
    Takedown Workflow · jihedbfr-art bundle

    Use when getting malicious lookalike sites, phishing pages, and impersonation content removed — the process for reporting and taking down infrastructure that targets your organisation.
    0 installs
55. ▌
    Soar Automation · jihedbfr-art bundle

    Use when automating SOC work with SOAR — playbooks that handle the repetitive parts of triage and response so analysts focus on judgement, without automating away control of consequential actions.
    0 installs
56. ▌
    Prompt Injection Testing · jihedbfr-art bundle

    Use when testing an LLM-backed app or agent for prompt injection — getting the model to ignore its instructions via user input or retrieved content — and the mitigations that reduce it.
    0 installs
57. ▌
    Insecure Output Handling · jihedbfr-art bundle

    Use when an app passes an LLM's output into another system — a browser, shell, database, or API call — testing whether model output can become an injection, and how to contain it.
    0 installs
58. ▌
    Rate Limiting And Resource Abuse · jihedbfr-art bundle

    Use when testing whether an API limits how often and how heavily it can be called — the missing controls that enable brute force, scraping, and cost/DoS attacks.
    0 installs
59. ▌
    Dynamic Instrumentation Frida · jihedbfr-art bundle

    Use when analysing a running mobile app by hooking its functions with Frida — observing and modifying behaviour at runtime to test logic, bypass checks, and inspect data.
    0 installs
60. ▌
    Error Handling And Logging · jihedbfr-art bundle

    Use when reviewing how code fails and what it records — catching info leaks in errors, swallowed failures that mask security events, and log injection.
    0 installs
61. ▌
    Kev Catalog Workflow · jihedbfr-art bundle

    Use when wiring CISA's Known Exploited Vulnerabilities catalog into prioritisation — treating confirmed in-the-wild exploitation as the signal that jumps a vuln to the front.
    0 installs
62. ▌
    Metrics And Mttr · jihedbfr-art bundle

    Use when measuring SOC performance honestly — the metrics that show whether the SOC is effective and where it's struggling, avoiding the vanity numbers that look good and mean nothing.
    0 installs
63. ▌
    Account Compromise Response · jihedbfr-art bundle

    Use when a user or service account is suspected compromised — containing the stolen identity, understanding what it touched, and restoring it without leaving the attacker a way back.
    0 installs
64. ▌
    Subdomain Enumeration · jihedbfr-art bundle

    Use when you need to map an organisation's subdomains to find hosts and services outside the obvious www — the first recon step that feeds web, API, and cloud testing.
    0 installs
65. ▌
    SQL Injection Testing · jihedbfr-art bundle

    Use when checking whether a web parameter reaches a database unsafely — covers manual confirmation, sqlmap, and the parametrised-query fix.
    0 installs
66. ▌
    Broken Object Level Authorization · jihedbfr-art bundle

    Use when testing whether an API lets one user access another user's objects by changing an ID — the BOLA/IDOR flaw that tops the OWASP API list, plus the server-side fix.
    0 installs
67. ▌
    Pipeline Hardening · jihedbfr-art bundle

    Use when securing the CI/CD pipeline itself — least-privilege runners, pinned actions, protected branches, and the controls that stop the pipeline from becoming an attack path to production.
    0 installs
68. ▌
    Artifact Integrity · jihedbfr-art bundle

    Use when ensuring build artifacts aren't tampered with between build and deploy — signing outputs and verifying them before deployment so only trusted builds run.
    0 installs
69. ▌
    Sbom Generation · jihedbfr-art bundle

    Use when you need a complete inventory of what's inside a build — every dependency and its version — as an SBOM you can scan, track, and hand to auditors.
    0 installs
70. ▌
    Reviewing A Pr For Security · jihedbfr-art bundle

    Use as a repeatable, time-boxed checklist for the security pass on an everyday pull request — where to look first, what to wave through, when to block.
    0 installs
71. ▌
    Oidc Validation · jihedbfr-art bundle

    Use when an app uses OpenID Connect for login — validating ID tokens correctly so an attacker can't forge or replay an identity, and the checks that are commonly skipped.
    0 installs
72. ▌
    Mfa And Step Up · jihedbfr-art bundle

    Use when adding or reviewing multi-factor and step-up authentication — choosing factors that resist real attacks and enforcing them so they can't be bypassed.
    0 installs
73. ▌
    Token Lifecycle · jihedbfr-art bundle

    Use when designing how access and refresh tokens are issued, stored, refreshed, and revoked — closing the gaps that let stolen or stale tokens keep working.
    0 installs
74. ▌
    Mfa Fatigue Defence · jihedbfr-art bundle

    Use when defending against MFA fatigue (push bombing) — where an attacker with a stolen password spams push prompts until the user approves one, and the controls that stop it.
    0 installs
75. ▌
    Reducing False Positives · jihedbfr-art bundle

    Use when a detection is too noisy — tuning it to cut false positives without creating blind spots, so alerts stay trustworthy and the SOC doesn't learn to ignore them.
    0 installs
76. ▌
    Ioc Collection And Vetting · jihedbfr-art bundle

    Use when gathering indicators of compromise from feeds and reports — collecting them without drowning in junk, and vetting them so you don't act on false or stale data.
    0 installs
77. ▌
    Mapping Intel To Detection · jihedbfr-art bundle

    Use when turning threat intelligence into detections and hunts — closing the loop so intel drives defence instead of sitting in a platform as unused reports.
    0 installs
78. ▌
    Incident Triage And Severity · jihedbfr-art bundle

    Use at the start of a suspected security incident to decide quickly whether it's real, how bad it is, and what response it warrants — before jumping to containment.
    0 installs
79. ▌
    Social Media Profiling · jihedbfr-art bundle

    Use when mapping an organisation's people and technology from public social and professional profiles — the human attack surface for phishing and pretexting — done within ethical and legal bounds.
    0 installs
80. ▌
    Authentication Testing · jihedbfr-art bundle

    Use when testing how an app handles login, credentials, lockout, and password reset — the weaknesses that let an attacker log in as someone else — and the fixes.
    0 installs
81. ▌
    Reverse Engineering Protections · jihedbfr-art bundle

    Use when assessing or implementing a mobile app's anti-reversing defences — root/jailbreak detection, obfuscation, and anti-tampering — understanding what they achieve and their limits.
    0 installs
82. ▌
    Dependency Scanning · jihedbfr-art bundle

    Use when scanning project dependencies for known vulnerabilities in CI — catching vulnerable third-party packages before they ship, and telling exploitable from merely-flagged.
    0 installs
83. ▌
    Build Provenance · jihedbfr-art bundle

    Use when attesting where and how software was built — generating build provenance so consumers can verify an artifact came from the expected source and pipeline, uncompromised.
    0 installs
84. ▌
    Third Party Risk · jihedbfr-art bundle

    Use when assessing the security risk of a third-party component, library, or vendor before depending on it — evaluating what you're taking on when you adopt someone else's code or service.
    0 installs
85. ▌
    Dependency And Config Review · jihedbfr-art bundle

    Use when reviewing dependencies and configuration for the insecure default nobody changed — vulnerable libraries, dangerous framework settings, and debug flags left on.
    0 installs
86. ▌
    Password Storage · jihedbfr-art bundle

    Use when implementing or reviewing how user passwords are stored — choosing a slow password hash, setting its parameters, and avoiding the storage mistakes that make a breach catastrophic.
    0 installs
87. ▌
    Vulnerability Scanning · jihedbfr-art bundle

    Use when running vulnerability scans that find real issues — authenticated scanning, sane scope, and getting results you can act on instead of a raw dump.
    0 installs
88. ▌
    Threat Informed Detection · jihedbfr-art bundle

    Use when deciding which detections to build — driving the priorities from real threat intelligence about what attackers targeting you actually do, not from guesses or convenience.
    0 installs
89. ▌
    Reporting And Dissemination · jihedbfr-art bundle

    Use when writing and delivering threat-intel reports — producing intelligence people actually read and act on, and getting it to the right consumers in the right form and time.
    0 installs
90. ▌
    Nis2 And Eu Obligations · jihedbfr-art bundle

    Use when mapping EU cybersecurity regulatory duties to controls — NIS2, GDPR security obligations, and DORA — so the organisation meets its legal requirements, not just best practice.
    0 installs
91. ▌
    Evidence And Audit Prep · jihedbfr-art bundle

    Use when collecting compliance evidence and preparing for audits — gathering proof that controls operate continuously, so audits are routine instead of a last-minute scramble.
    0 installs
92. ▌
    Ntlm Relay · jihedbfr-art bundle

    Use when testing whether NTLM authentication can be relayed to authenticate to other services — a classic AD attack — and the signing/channel-binding that shuts it down.
    0 installs
93. ▌
    Cis Benchmark Automation · jihedbfr-art bundle

    Use when applying and verifying a Linux hardening baseline at scale — automating CIS Benchmark checks and remediation so hosts start hardened and don't drift.
    0 installs
94. ▌
    Risk Acceptance And Sla · jihedbfr-art bundle

    Use when defining remediation SLAs and handling the vulnerabilities you won't fix immediately — turning "not fixed" into a documented, owned decision instead of silent neglect.
    0 installs
95. ▌
    Log Pipeline Design · jihedbfr-art bundle

    Use when designing the pipeline that gets logs into a SIEM — collection, parsing, and normalisation so the right data arrives usable, because everything downstream depends on it.
    0 installs
96. ▌
    Communication During Incidents · jihedbfr-art bundle

    Use during an incident to manage who gets told what, when — internal coordination, stakeholder updates, and external/legal notifications — without leaking or misinforming.
    0 installs
97. ▌
    Jailbreak Resistance Testing · jihedbfr-art bundle

    Use when evaluating how well an LLM app's guardrails hold under adversarial pressure — testing jailbreaks honestly and interpreting the results without overclaiming safety.
    0 installs
98. ▌
    Certificate Transparency · jihedbfr-art bundle

    Use when discovering an organisation's hosts and subdomains through public Certificate Transparency logs — a passive source that reveals names as soon as a certificate is issued.
    0 installs
99. ▌
    Build Provenance Slsa · jihedbfr-art bundle

    Use when establishing verifiable build provenance — proving how and where an artifact was built using the SLSA framework, so consumers can trust the build wasn't subverted.
    0 installs
100. ▌
     Lockfile Integrity · jihedbfr-art bundle

     Use when ensuring reproducible, verified dependencies — using lockfiles with integrity hashes so you install exactly the packages you vetted, and nothing gets swapped.
     0 installs