Mahipal

Simulate device-code and app-consent phishing in an explicitly authorized Microsoft Entra ID environment. Assess whether authentication and consent controls prevent token misuse, map reachable Microsoft 365 resources, and document findings with remediation recommendations.

• Run authorized Microsoft 365 phishing exercises
• Validate Conditional Access and MFA controls
• Test restrictions on app consent

Audit Microsoft Entra ID identity settings to uncover weak authentication policies, excessive administrator privileges, inactive accounts, and guest access risks. Review conditional access rules and sign-in logs, then organize findings into a prioritized security report.

• Auditing authentication and administrator access in an Azure tenant
• Assessing identity settings before integrating an acquired tenant
• Finding inactive accounts and privileged guest users

Collect and organize victim postings from ransomware data leak sites through tracking feeds. Analyze group activity over time, compare sector and country patterns, and produce threat reports with risk assessments and defensive recommendations.

• Track monthly activity across ransomware groups
• Assess ransomware exposure by sector or country
• Identify newly observed ransomware groups

Investigate ransomware payment addresses using public blockchain records. Trace transfers, group addresses likely controlled by the same entity, identify links to exchanges or mixing services, and organize findings into a report for incident responders and investigators.

• Investigating a payment address found in a ransom note
• Tracing funds after a ransom payment
• Comparing related wallets across ransomware incidents

Parse Windows Prefetch files, which store traces of program execution, to extract run counts, timestamps, and referenced files. Build execution timelines and compare findings with other forensic evidence when investigating suspicious software or tool usage.

• Checking whether a suspicious program ran
• Building a timeline of investigative tool findings
• Investigating compression and file transfer tool usage

Analyze Zeek and NetFlow records for ransomware-related activity, including regular callbacks to attacker infrastructure, TOR connections, and possible data exfiltration. Combine indicators into risk scores and structured reports with timelines to support threat hunting and incident investigation.

• Hunting for active ransomware network activity
• Investigating possible data theft before encryption
• Checking periodic callbacks and TOR connections

Search Windows PowerShell logs for traces of Empire, a framework used after a system is compromised. Identify characteristic launch commands, encoded code, module calls, and communication paths, then report suspicious events with timelines and severity scores.

• Investigating suspected Empire activity
• Checking encoded commands and communication paths
• Building detection rules from Empire indicators

Investigate security incidents in Splunk by connecting authentication, endpoint, and network logs. Use SPL, Splunk’s search language, to identify suspicious activity, reconstruct event timelines, document findings, and develop detection rules.

• Investigating suspicious logins across multiple log sources
• Reconstructing an incident timeline
• Tracing suspicious processes and outbound traffic

Audit Kubernetes access rules to find excessive permissions and service account token abuse paths. Trace which users or workloads could gain cluster administrator access, then produce prioritized findings and recommendations for reducing permissions.

• Reviewing Kubernetes privilege escalation paths
• Checking permissions after an RBAC change
• Tracing workloads with overprivileged service accounts

Map attacker behaviors and indicators of compromise, or traces of an intrusion, to MITRE ATT&CK techniques. Build coverage heatmaps, compare threat groups, and identify monitoring gaps to guide detection improvements and threat intelligence reporting.

• Mapping attacker behaviors and intrusion traces to ATT&CK techniques
• Visualizing detection coverage with ATT&CK Navigator
• Identifying attack techniques missing from monitoring

Investigate Linux kernel rootkits, malware that hides inside the operating system's core. Analyze memory dumps with Volatility3, compare system views, and run live scans to identify hidden modules, altered calls, and suspicious inconsistencies.

• Investigate suspected Linux rootkit infections
• Find hidden kernel modules in memory dumps
• Compare module lists for signs of concealment

Use Scapy, a Python library for working with network packets, to inspect saved captures or authorized live traffic. Summarize protocols and connections, identify suspicious patterns, craft test packets, and export findings as structured JSON reports.

• Investigating saved network captures
• Summarizing traffic volumes, protocols, and connection endpoints
• Checking for SYN floods and DNS data leakage indicators

Analyze suspicious email headers to trace delivery routes and assess sender spoofing. Review SPF, DKIM, and DMARC sender authentication results, compare sender and reply addresses, and examine links and attachment hashes for phishing indicators.

• Triaging a suspicious email reported by a user
• Checking whether a sender domain was spoofed
• Tracing the delivery route of a phishing email

Assess exposure of Windows secrets protected by DPAPI, the operating system’s data protection service, during authorized security tests. Guide examination and decryption of saved credentials and browser data using available user sessions, credentials, or backup keys.

• Assessing saved credential exposure in authorized tests
• Examining collected DPAPI files offline
• Reviewing protected browser and RDP credentials

Analyze memory dumps with Volatility3 to find heap spraying, an attack that fills memory with attacker-controlled data. Examine suspicious allocations and repeated byte patterns, extract suspicious code, and report affected processes and memory regions in JSON.

• Investigating suspected heap spraying in a memory dump
• Extracting suspicious code from memory
• Organizing evidence for detection rule development

Review Cuckoo or AnyRun behavior reports for signs that malware is avoiding an analysis environment. Identify timing checks, virtual machine detection, and user activity checks, then produce a JSON report with evidence, technique mappings, and an evasion sophistication score.

• Investigating malware that stays inactive in a sandbox
• Reviewing behavior reports for analysis evasion
• Developing detections for anti-analysis behavior

Review Active Directory permissions with ldap3, a Python library for directory queries. Identify excessive access granted to non-administrative accounts, explain potential privilege escalation paths, and produce a JSON report with affected objects and remediation recommendations.

• Auditing excessive Active Directory permissions
• Investigating privilege escalation paths from ordinary accounts
• Reporting affected objects and permission remediation recommendations

Investigate suspicious URLs with URLScan.io by reviewing screenshots, redirects, page content, and network requests. Extract domains, IP addresses, and file hashes as indicators of compromise, then compare findings with threat intelligence sources.

• Investigating suspicious links in emails
• Checking pages for brand impersonation and credential forms
• Tracing redirects and extracting domains, IPs, and hashes

Analyze access logs from AWS S3, GCS, and Azure Blob Storage to spot unusual downloads, unfamiliar IP addresses, and request spikes. Compare activity with normal patterns and prioritize findings for suspected data theft investigations.

• Investigating suspected data theft from cloud storage
• Finding bulk downloads outside normal working hours
• Checking unfamiliar IP addresses and sudden request spikes

Investigate captured network traffic and connection records with Wireshark, Zeek, and NetFlow analysis. Identify communications with attacker infrastructure, trace movement between internal systems, estimate data transfers, and produce findings linked to packet evidence and timestamps.

• Investigating suspicious periodic connections
• Measuring the volume and destination of data transfers
• Tracing attacker movement between internal systems

Inspect suspicious PDFs without opening them in a document viewer. Use peepdf, pdfid, and pdf-parser to examine internal objects, extract embedded code and files, and report threat indicators such as URLs and hashes.

• Triaging suspicious PDF email attachments
• Investigating PDF exploit documents
• Extracting embedded JavaScript and files

Analyze malware network captures to investigate command-and-control traffic, data theft, and downloaded files. Use packet analysis tools to identify suspicious destinations and recurring connections, extract artifacts, and create detection rules from observed patterns.

• Analyzing malware sandbox network captures
• Investigating command-and-control traffic
• Tracing data theft and file downloads

Compare evidence from cyber operations to assess which attacker may be responsible. Weigh shared infrastructure, attack methods, malware similarities, timing, and language clues against competing explanations, then report attribution findings with justified confidence levels.

• Assessing possible attackers during an incident investigation
• Comparing infrastructure and attack methods across campaigns
• Evaluating conflicting evidence against multiple hypotheses

Analyze Cobalt Strike communication profiles and Beacon payload configurations to extract request paths, headers, timing, and process injection settings. Turn these indicators into a JSON report and network detection rules for Suricata or Snort.

• Analyzing a captured Malleable C2 profile
• Extracting communication settings from a Beacon payload
• Creating Suricata or Snort detection rules