mukul975

Investigate suspicious privilege increases, including Windows UAC approval bypasses and Linux sudo or setuid abuse. Use registry changes, process relationships, and permission changes to identify possible abuse and document affected hosts, methods, and risk levels.

中文简介正在准备中。当前显示英语简介。

• Investigating Windows UAC bypass activity
• Tracing how administrative access was obtained
• Monitoring Linux sudo and setuid abuse

Configure Fail2ban to detect port scans, repeated SSH login attempts, and suspicious web requests from server logs. Create custom detection patterns, automatically block source IP addresses, and set up notifications and longer bans for repeat offenders.

中文简介正在准备中。当前显示英语简介。

• Automatically blocking port scans against public servers
• Defending SSH against repeated login attempts
• Detecting suspicious paths in Nginx access logs

Use CloudFox to inspect AWS and Azure resources through read-only queries. Identify exposed endpoints, secrets, permissions, and role trust relationships, then organize findings into files for reviewing configuration weaknesses and potential paths to broader access.

中文简介正在准备中。当前显示英语简介。

• Inventorying an unfamiliar AWS or Azure account
• Finding internet-facing resources
• Mapping role trust relationships and permissions

Review application permissions and consent audit logs in Microsoft Entra ID using Microsoft Graph API. Identify overly broad access, unverified publishers, and suspicious consent patterns, then produce a JSON risk report with remediation recommendations.

中文简介正在准备中。当前显示英语简介。

• Investigating suspicious application consent
• Reviewing apps with broad mail or file access
• Tracing consent events through audit logs

Investigate suspicious mobile apps by examining permissions, network traffic, and runtime behavior. Use observed evidence to identify signs of data theft, SMS interception, credential stealing, or communication with attacker control servers, then classify the suspected malware.

中文简介正在准备中。当前显示英语简介。

• Triaging suspicious APK or IPA samples
• Investigating possible data leaks from mobile apps
• Checking for SMS interception and credential theft

Monitor Modbus traffic in industrial control networks to identify unauthorized writes, unusual commands, and departures from normal communication. Use packet analysis and intrusion detection rules to investigate suspected controller changes and produce reports with recommended actions.

中文简介正在准备中。当前显示英语简介。

• Investigating unauthorized changes to PLC registers
• Setting up Modbus intrusion detection rules
• Checking communication patterns after a suspected compromise

Investigate stolen OAuth tokens and their reuse in Microsoft Entra ID through sign-in log analysis. Follow response procedures for revoking sessions and reviewing app permissions, and configure device-bound token protection and session monitoring for Azure and M365 environments.

中文简介正在准备中。当前显示英语简介。

• Investigating anomalous token usage alerts
• Responding to suspected session hijacking
• Finding token reuse in sign-in logs

Investigate Pass-the-Hash attacks, where stolen password hashes are reused for authentication. Examine unusual NTLM logins alongside credential theft indicators, validate suspicious findings across security logs, and document evidence, affected hosts, confidence, and recommended responses.

中文简介正在准备中。当前显示英语简介。

• Hunting for movement using stolen password hashes
• Triaging suspicious NTLM login alerts
• Assessing the scope of a compromise

Investigate suspected data theft from AWS S3 by comparing access logs, GuardDuty findings, and Macie classifications. Identify unusual bulk downloads and transfers across accounts, assess sensitive data exposure, and build automated detection rules.

中文简介正在准备中。当前显示英语简介。

• Investigating unusual bulk downloads from S3
• Checking transfers to external AWS accounts
• Assessing exposure of sensitive data

Detect attacks that misuse legitimate Windows tools by examining command arguments, parent and child processes, and network connections. Create Sysmon logging configurations and Sigma detection rules, analyze endpoint logs, and review application controls while accounting for legitimate usage.

中文简介正在准备中。当前显示英语简介。

• Creating detection rules for misuse of Windows tools
• Investigating unusual process chains in alerts
• Hunting for fileless attacks in endpoint logs

Detect attacks that misuse legitimate Windows utilities such as certutil and mshta. Analyze process logs, command arguments, and parent-child relationships with Sigma detection rules, then report suspicious events with severity scores and supporting event details.

中文简介正在准备中。当前显示英语简介。

• Investigating suspicious use of built-in Windows utilities
• Creating Sigma rules for unusual command arguments
• Finding Office apps that launch unexpected system utilities

Build detection rules for suspicious Windows scheduled tasks by correlating Sysmon and Windows Security logs. Examine parent processes, file paths, encoded commands, and remote task creation to uncover persistent access and movement between systems.

中文简介正在准备中。当前显示英语简介。

• Investigating suspicious scheduled task creation
• Hunting for tasks that run encoded commands
• Detecting remote task creation across systems

Assess serverless functions, primarily AWS Lambda, for unsafe execution of external input and unauthorized changes to code or added libraries. Combine source inspection, activity logs, and permission reviews to identify injection risks and recommend detection and prevention measures.

中文简介正在准备中。当前显示英语简介。

• Reviewing Lambda event handlers for injection vulnerabilities
• Investigating unauthorized function or layer changes
• Checking privilege escalation through Lambda execution roles

Investigate suspected rootkits, malware that hides its presence, by comparing process lists, inspecting memory, and checking system integrity. Use Volatility and Windows or Linux scanners to identify hidden processes, suspicious drivers, altered system calls, and concealed connections.

中文简介正在准备中。当前显示英语简介。

• Investigating compromise when standard tools show no anomalies
• Comparing process lists to find hidden activity
• Examining suspicious drivers and concealed connections

Audit GitHub Actions workflows and CI/CD configurations for supply chain risks. Use Python and YAML parsing to identify unpinned actions, unsafe event expressions, excessive permissions, dependency confusion, and potential exposure of secrets in build pipelines.

中文简介正在准备中。当前显示英语简介。

• Reviewing GitHub Actions workflow security
• Checking action version pinning
• Finding unsafe event expressions in scripts

Analyze Sysmon logs to investigate process injection, where malicious code hides inside legitimate processes. Correlate remote thread creation, cross-process access, and unusual DLL loading, then organize findings by injection type, risk level, and ATT&CK technique.

中文简介正在准备中。当前显示英语简介。

• Investigating EDR alerts about suspicious cross-process access
• Hunting for malicious code hidden inside legitimate processes
• Checking Sysmon coverage for process injection detection

Find npm and PyPI packages that imitate trusted package names to exploit typing mistakes. Compare spelling similarity, publication dates, downloads, and maintainer details, then rank suspicious candidates and produce reports or blocklists for further review.

中文简介正在准备中。当前显示英语简介。

• Auditing project dependencies for misleading package names
• Monitoring names similar to important packages
• Investigating a suspected misspelled package installation

Investigate signs of Mimikatz credential theft using command lines, access to Windows authentication memory, file indicators, and known modules in memory. Correlate endpoint and security logs to assess suspicious alerts, document evidence, and recommend response actions.

中文简介正在准备中。当前显示英语简介。

• Investigating alerts about Windows authentication memory access
• Hunting for signs of credential theft
• Assessing compromise scope during incident response

Guide malware cleanup on infected Windows and Linux systems after containment and investigation. Covers removing malicious files and mechanisms that preserve attacker access, rotating credentials, patching entry points, and documenting validation results before recovery.

中文简介正在准备中。当前显示英语简介。

• Cleaning infected systems after containment
• Removing mechanisms that preserve attacker access
• Rotating compromised credentials and fixing entry points

Analyze ModSecurity, AWS WAF, and Cloudflare logs for SQL injection, attempts to manipulate database queries through web requests. Groups related requests, tracks source IPs, classifies attack methods, and produces incident reports.

中文简介正在准备中。当前显示英语简介。

• Investigating suspected SQL injection attempts
• Tracking repeated attacks from the same source
• Connecting requests across an attack campaign

Investigate process hollowing, where malicious code replaces a legitimate process in memory. Compare memory with disk files, examine process relationships, and correlate network activity to document suspicious processes and guide containment.

中文简介正在准备中。当前显示英语简介。

• Investigating process injection alerts from EDR
• Examining suspicious behavior in legitimate Windows processes
• Finding threats that run in memory

Evaluate threat intelligence platforms, which collect and organize cyber threat information. Define requirements, compare integrations and operating costs, plan practical trials, and use weighted scoring to select a platform and outline its rollout.

中文简介正在准备中。当前显示英语简介。

• Preparing requirements for TIP procurement
• Comparing platforms before a TIP migration
• Checking whether an existing TIP meets team needs

Create rules for Suricata and Snort, systems that detect suspicious network traffic, to flag port scans and reconnaissance. Combine packet patterns with connection counts, tune alert volume, and summarize scanning sources, targets, and activity.

中文简介正在准备中。当前显示英语简介。

• Create rules to detect Nmap and Masscan activity
• Monitor scanning within an internal network
• Tune alerts for authorized vulnerability scanners

Analyze Windows authentication logs for repeated password guesses against Remote Desktop services. Group failures by source IP and account, check for later successful logins, and produce a JSON report highlighting attack patterns and possible compromise.

中文简介正在准备中。当前显示英语简介。

• Investigate repeated login failures on exposed RDP services
• Identify accounts targeted by password guessing
• Check for successful logins after repeated failures