mukul975/anthropic-cybersecurity-skills

834 skills102.4K total installs Github

Github

Github

Skill

Installs

analyzing-api-gateway-access-logs

testing-api-security-with-owasp-top-10

acquiring-disk-image-with-dd-and-dcfldd

analyzing-android-malware-with-apktool

conducting-api-security-testing

performing-web-application-penetration-test

testing-for-xss-vulnerabilities

analyzing-cyber-kill-chain

analyzing-email-headers-for-phishing-investigation

analyzing-browser-forensics-with-hindsight

analyzing-docker-container-forensics

analyzing-cloud-storage-access-patterns

analyzing-active-directory-acl-abuse

analyzing-certificate-transparency-for-phishing

analyzing-dns-logs-for-exfiltration

analyzing-apt-group-with-mitre-navigator

testing-jwt-token-security

analyzing-command-and-control-communication

testing-api-for-broken-object-level-authorization

analyzing-linux-audit-logs-for-intrusion

analyzing-network-traffic-with-wireshark

testing-for-broken-access-control

exploiting-sql-injection-vulnerabilities

analyzing-bootkit-and-rootkit-samples

testing-api-authentication-weaknesses

analyzing-azure-activity-logs-for-threats

analyzing-indicators-of-compromise

analyzing-campaign-attribution-evidence

analyzing-linux-system-artifacts

reverse-engineering-android-malware-with-jadx

analyzing-disk-image-with-autopsy

analyzing-linux-elf-malware

testing-cors-misconfiguration

analyzing-kubernetes-audit-logs

analyzing-network-packets-with-scapy

abusing-dpapi-for-credential-access

analyzing-linux-kernel-rootkits

analyzing-ios-app-security-with-objection

analyzing-golang-malware-with-ghidra

analyzing-network-traffic-for-incidents

analyzing-sbom-for-supply-chain-vulnerabilities

analyzing-cobaltstrike-malleable-c2-profiles

testing-for-json-web-token-vulnerabilities

analyzing-malicious-url-with-urlscan

analyzing-network-traffic-of-malware

performing-web-application-vulnerability-triage

analyzing-cobalt-strike-beacon-configuration

analyzing-web-server-logs-for-intrusion

implementing-secret-scanning-with-gitleaks

analyzing-ethereum-smart-contract-vulnerabilities

analyzing-malicious-pdf-with-peepdf

testing-api-for-mass-assignment-vulnerability

analyzing-network-covert-channels-in-malware

analyzing-network-flow-data-with-netflow

analyzing-heap-spray-exploitation

analyzing-malware-sandbox-evasion-techniques

analyzing-memory-dumps-with-volatility

analyzing-malware-behavior-with-cuckoo-sandbox

analyzing-malware-persistence-with-autoruns

analyzing-malware-family-relationships-with-malpedia

exploiting-idor-vulnerabilities

analyzing-lnk-file-and-jump-list-artifacts

testing-for-sensitive-data-exposure

testing-oauth2-implementation-flaws

implementing-api-rate-limiting-and-throttling

analyzing-macro-malware-in-office-documents

analyzing-mft-for-deleted-file-recovery

performing-security-headers-audit

testing-for-business-logic-vulnerabilities

analyzing-memory-forensics-with-lime-and-volatility

testing-websocket-api-security

conducting-external-reconnaissance-with-osint

exploiting-sql-injection-with-sqlmap

analyzing-threat-intelligence-feeds

analyzing-persistence-mechanisms-in-linux

analyzing-threat-actor-ttps-with-mitre-attack

bypassing-authentication-with-forced-browsing

analyzing-pdf-malware-with-pdfid

analyzing-ransomware-network-indicators

testing-for-open-redirect-vulnerabilities

analyzing-powershell-script-block-logging

analyzing-outlook-pst-for-email-forensics

testing-for-xxe-injection-vulnerabilities

exploiting-api-injection-vulnerabilities

hardening-docker-containers-for-production

analyzing-ransomware-encryption-mechanisms

abusing-shadow-credentials-for-privesc

testing-for-xss-vulnerabilities-with-burpsuite

analyzing-ransomware-leak-site-intelligence

testing-for-host-header-injection

analyzing-packed-malware-with-upx-unpacker

analyzing-office365-audit-logs-for-compromise

auditing-aws-s3-bucket-permissions

analyzing-powershell-empire-artifacts

conducting-network-penetration-test

conducting-mobile-app-penetration-test

performing-web-application-firewall-bypass

building-incident-response-playbook

analyzing-supply-chain-malware-artifacts

performing-web-application-scanning-with-nikto

achieving-cmmc-level-2-compliance

exploiting-server-side-request-forgery

analyzing-security-logs-with-splunk

analyzing-threat-actor-ttps-with-mitre-navigator

analyzing-prefetch-files-for-execution-history

analyzing-tls-certificate-transparency-logs

exploiting-websocket-vulnerabilities

exploiting-jwt-algorithm-confusion-attack

auditing-terraform-infrastructure-for-security

auditing-cloud-with-cis-benchmarks

analyzing-typosquatting-domains-with-dnstwist

auditing-kubernetes-cluster-rbac

exploiting-broken-function-level-authorization

performing-csrf-attack-simulation

analyzing-ransomware-payment-wallets

building-vulnerability-scanning-workflow

analyzing-threat-landscape-with-misp

testing-mobile-api-authentication

detecting-ai-model-prompt-injection-attacks

performing-threat-modeling-with-owasp-threat-dragon

conducting-cloud-penetration-testing

collecting-open-source-intelligence

analyzing-windows-event-logs-in-splunk

implementing-api-schema-validation-security

testing-for-email-header-injection

testing-for-xml-injection-vulnerabilities

exploiting-nosql-injection-vulnerabilities

analyzing-windows-registry-for-artifacts

performing-ssrf-vulnerability-exploitation

exploiting-template-injection-vulnerabilities

exploiting-http-request-smuggling

configuring-oauth2-authorization-flow

exploiting-oauth-misconfiguration

auditing-gcp-iam-permissions

analyzing-usb-device-connection-history

auditing-azure-active-directory-configuration

exploiting-mass-assignment-in-rest-apis

analyzing-slack-space-and-file-system-artifacts

performing-api-rate-limiting-bypass

conducting-full-scope-red-team-engagement

building-devsecops-pipeline-with-gitlab-ci

exploiting-race-condition-vulnerabilities

implementing-api-key-security-controls

exploiting-insecure-deserialization

scanning-network-with-nmap-advanced

analyzing-windows-prefetch-with-python

performing-web-cache-poisoning-attack

performing-api-security-testing-with-postman

detecting-api-enumeration-attacks

performing-web-cache-deception-attack

implementing-jwt-signing-and-verification

auditing-tls-certificate-transparency-logs

analyzing-windows-lnk-files-for-artifacts

exploiting-excessive-data-exposure-in-api

analyzing-windows-amcache-artifacts

auditing-mcp-servers-for-tool-poisoning

building-attack-pattern-library-from-cti-reports

automating-ioc-enrichment

analyzing-windows-shellbag-artifacts

conducting-internal-network-penetration-test

exploiting-prototype-pollution-in-javascript

implementing-api-gateway-security-controls

analyzing-uefi-bootkit-persistence

building-c2-infrastructure-with-sliver-framework

building-threat-actor-profile-from-osint

building-vulnerability-dashboard-with-defectdojo

performing-sca-dependency-scanning-with-snyk

building-adversary-infrastructure-tracking-system

scanning-docker-images-with-trivy

performing-api-inventory-and-discovery

building-detection-rules-with-sigma

building-incident-response-dashboard

securing-github-actions-workflows

reverse-engineering-malware-with-ghidra

building-soc-escalation-matrix

building-vulnerability-exception-tracking-system

detecting-broken-object-property-level-authorization

building-threat-intelligence-platform

deobfuscating-javascript-malware

implementing-secrets-scanning-in-ci-cd

building-automated-malware-submission-pipeline

building-red-team-c2-infrastructure-with-havoc

building-soc-playbook-for-ransomware

building-cloud-siem-with-sentinel

building-soc-metrics-and-kpi-tracking

building-vulnerability-aging-and-sla-tracking

detecting-sql-injection-via-waf-logs

performing-api-fuzzing-with-restler

conducting-wireless-network-penetration-test

building-detection-rule-with-splunk-spl

implementing-devsecops-security-scanning

building-threat-hunt-hypothesis-framework

conducting-phishing-incident-response

triaging-security-incident

implementing-api-abuse-detection-with-rate-limiting

building-identity-governance-lifecycle-process

building-incident-timeline-with-timesketch

building-threat-intelligence-feed-integration

conducting-cloud-incident-response

collecting-indicators-of-compromise

exploiting-insecure-data-storage-in-mobile

configuring-tls-1-3-for-secure-communications

building-ransomware-playbook-with-cisa-framework

building-malware-incident-communication-template

collecting-threat-intelligence-with-misp

exploiting-type-juggling-vulnerabilities

detecting-shadow-api-endpoints

conducting-man-in-the-middle-attack-simulation

implementing-semgrep-for-custom-sast-rules

conducting-internal-reconnaissance-with-bloodhound-ce

building-phishing-reporting-button-workflow

reverse-engineering-ios-app-with-frida

building-identity-federation-with-saml-azure-ad

building-role-mining-for-rbac-optimization

performing-second-order-sql-injection

conducting-social-engineering-penetration-test

attacking-oauth-with-device-code-phishing

building-ioc-enrichment-pipeline-with-opencti

performing-ssl-tls-security-assessment

building-threat-intelligence-enrichment-in-splunk

exploiting-vulnerabilities-with-metasploit-framework

performing-jwt-none-algorithm-attack

performing-blind-ssrf-exploitation

exploiting-broken-link-hijacking

implementing-api-security-posture-management

building-ioc-defanging-and-sharing-pipeline

performing-subdomain-enumeration-with-subfinder

performing-wifi-password-cracking-with-aircrack

testing-android-intents-for-vulnerabilities

performing-directory-traversal-testing

performing-graphql-security-assessment

building-threat-feed-aggregation-with-misp

exploiting-deeplink-vulnerabilities

detecting-malicious-npm-packages

integrating-dast-with-owasp-zap-in-pipeline

conducting-malware-incident-response

hardening-docker-daemon-configuration

collecting-volatile-evidence-from-compromised-host

auditing-kubernetes-rbac-privilege-escalation

hardening-linux-endpoint-with-cis-benchmark

detecting-dependency-confusion

executing-red-team-exercise

building-patch-tuesday-response-process

integrating-sast-into-github-actions-pipeline

configuring-pfsense-firewall-rules

detecting-oauth-token-theft

executing-red-team-engagement-planning

performing-clickjacking-attack-test

triaging-vulnerabilities-with-ssvc-framework

implementing-network-access-control

assessing-vector-and-embedding-weaknesses

conducting-domain-persistence-with-dcsync

implementing-api-security-testing-with-42crunch

conducting-pass-the-ticket-attack

validating-backup-integrity-for-recovery

detecting-aws-credential-exposure-with-trufflehog

conducting-memory-forensics-with-volatility

performing-vulnerability-scanning-with-nessus

implementing-web-application-logging-with-modsecurity

detecting-supply-chain-attacks-in-ci-cd

performing-android-app-static-analysis-with-mobsf

performing-content-security-policy-bypass

deobfuscating-powershell-obfuscated-malware

testing-prompt-injection-in-rag-pipelines

securing-api-gateway-with-aws-waf

detecting-anomalous-authentication-patterns

configuring-network-segmentation-with-vlans

benchmarking-kubernetes-with-kube-bench

conducting-post-incident-lessons-learned

exploiting-smb-vulnerabilities-with-metasploit

scanning-containers-with-trivy-in-cicd

reverse-engineering-dotnet-malware-with-dnspy

performing-graphql-introspection-attack

performing-cryptographic-audit-of-application

hunting-for-webshell-activity

performing-http-parameter-pollution-attack

configuring-certificate-authority-with-openssl

prioritizing-vulnerabilities-with-cvss-scoring

detecting-indirect-prompt-injection

detecting-typosquatting-packages-in-npm-pypi

triaging-security-incident-with-ir-playbook

monitoring-darkweb-sources

performing-network-traffic-analysis-with-tshark

attacking-entra-id-with-roadtools

auditing-entra-id-with-aadinternals

performing-container-security-scanning-with-trivy

performing-oauth-scope-minimization-review

performing-osint-with-spiderfoot

testing-ransomware-recovery-procedures

conducting-spearphishing-simulation-campaign

performing-network-forensics-with-wireshark

exploiting-zerologon-vulnerability-cve-2020-1472

configuring-host-based-intrusion-detection

performing-authenticated-vulnerability-scan

exploiting-active-directory-with-bloodhound

extracting-credentials-from-memory-dump

performing-soap-web-service-security-testing

conducting-cyber-risk-assessment-with-nist-800-30

exploiting-ipv6-vulnerabilities

performing-soc2-type2-audit-preparation

auditing-foundry-smart-contract-security

implementing-api-threat-protection-with-apigee

configuring-windows-defender-advanced-settings

testing-for-system-prompt-leakage

securing-serverless-functions

scanning-container-images-with-grype

performing-open-source-intelligence-gathering

performing-mobile-app-certificate-pinning-bypass

implementing-gdpr-data-protection-controls

conducting-social-engineering-pretext-call

tracking-threat-actor-infrastructure

performing-graphql-depth-limit-attack

securing-aws-iam-permissions

deploying-cloudflare-access-for-zero-trust

configuring-suricata-for-network-monitoring

detecting-attacks-on-scada-systems

implementing-llm-guardrails-for-security

performing-dark-web-monitoring-for-threats

configuring-windows-event-logging-for-detection

building-c2-redirector-infrastructure

performing-network-packet-capture-analysis

extracting-browser-history-artifacts

intercepting-mobile-traffic-with-burpsuite

performing-wireless-network-penetration-test

performing-sqlite-database-forensics

securing-container-registry-images

exploiting-active-directory-certificate-services-esc1

configuring-ldap-security-hardening

performing-docker-bench-security-assessment

performing-container-image-hardening

exploiting-kerberoasting-with-impacket

hardening-windows-endpoint-with-cis-benchmark

reverse-engineering-rust-malware

performing-privilege-escalation-on-linux

performing-ai-driven-osint-correlation

detecting-business-email-compromise

exploiting-nopac-cve-2021-42278-42287

auditing-uefi-firmware-with-chipsec

exploiting-bgp-hijacking-vulnerabilities

implementing-github-advanced-security-for-code-scanning

hunting-credential-stuffing-attacks

scanning-kubernetes-manifests-with-kubesec

performing-active-directory-penetration-test

performing-kubernetes-penetration-testing

performing-dns-enumeration-and-zone-transfer

detecting-email-account-compromise

performing-ssl-certificate-lifecycle-management

detecting-compromised-cloud-credentials

detecting-container-escape-attempts

continuous-llm-red-teaming-with-promptfoo

performing-hash-cracking-with-hashcat

triaging-security-alerts-in-splunk

performing-wireless-security-assessment-with-kismet

exploiting-ms17-010-eternalblue-vulnerability

detecting-credential-dumping-techniques

performing-cve-prioritization-with-kev-catalog

configuring-microsegmentation-for-zero-trust

performing-ssl-tls-inspection-configuration

configuring-multi-factor-authentication-with-duo

detecting-aws-iam-privilege-escalation

configuring-hsm-for-key-storage

detecting-aws-cloudtrail-anomalies

generating-threat-intelligence-reports

securing-kubernetes-on-cloud

performing-external-network-penetration-test

configuring-aws-verified-access-for-ztna

detecting-network-scanning-with-ids-signatures

performing-privilege-escalation-assessment

implementing-aes-encryption-for-data-at-rest

performing-memory-forensics-with-volatility3

configuring-active-directory-tiered-model

exploiting-constrained-delegation-abuse

deploying-tailscale-for-zero-trust-vpn

containing-active-breach

implementing-cloud-waf-rules

implementing-secrets-management-with-vault

securing-aws-lambda-execution-roles

remediating-s3-bucket-misconfiguration

detecting-s3-data-exfiltration-attempts

detecting-privilege-escalation-attempts

reverse-engineering-ransomware-encryption-routine

scanning-infrastructure-with-nessus

securing-agentic-ai-tool-invocation

configuring-snort-ids-for-intrusion-detection

performing-cloud-penetration-testing-with-pacu

performing-ios-app-security-assessment

implementing-threat-modeling-with-mitre-attack

securing-container-registry-with-harbor

performing-active-directory-vulnerability-assessment

detecting-arp-poisoning-in-network-traffic

extracting-windows-event-logs-artifacts

mapping-mitre-attack-techniques

performing-privileged-account-access-review

detecting-container-drift-at-runtime

performing-red-team-phishing-with-gophish

detecting-suspicious-oauth-application-consent

building-super-timelines-with-plaso

performing-privileged-account-discovery

detecting-port-scanning-with-fail2ban

coercing-authentication-with-coercer-petitpotam

performing-privacy-impact-assessment

performing-serverless-function-security-review

detecting-privilege-escalation-in-kubernetes-pods

performing-agentless-vulnerability-scanning

performing-ssl-stripping-attack

hunting-advanced-persistent-threats

implementing-dmarc-dkim-spf-email-security

hunting-for-unusual-network-connections

implementing-kubernetes-pod-security-standards

configuring-identity-aware-proxy-with-google-iap

securing-helm-chart-deployments

detecting-lateral-movement-in-network

detecting-email-forwarding-rules-attack

performing-dynamic-analysis-of-android-app

implementing-endpoint-detection-with-wazuh

detecting-pass-the-hash-attacks

detecting-container-escape-with-falco-rules

generating-and-analyzing-sboms

performing-threat-hunting-with-yara-rules

performing-binary-exploitation-analysis

implementing-network-segmentation-with-firewall-zones

securing-remote-access-to-ot-environment

executing-phishing-simulation-campaign

performing-authenticated-scan-with-openvas

performing-endpoint-forensics-investigation

correlating-threat-campaigns

performing-threat-emulation-with-atomic-red-team

performing-nist-csf-maturity-assessment

detecting-process-injection-techniques

extracting-iocs-from-malware-samples

verifying-build-provenance-with-slsa-sigstore

detecting-serverless-function-injection

performing-thick-client-application-penetration-test

performing-linux-log-forensics-investigation

performing-endpoint-vulnerability-remediation

performing-red-team-with-covenant

implementing-network-policies-for-kubernetes

detecting-dns-exfiltration-with-dns-query-analysis

performing-threat-hunting-with-elastic-siem

implementing-attack-surface-management

investigating-phishing-email-incident

detecting-aws-guardduty-findings-automation

implementing-infrastructure-as-code-security-scanning

performing-ransomware-response

performing-mobile-device-forensics-with-cellebrite

detecting-qr-code-phishing-with-email-security

performing-network-traffic-analysis-with-zeek

performing-supply-chain-attack-simulation

defending-llms-with-guardrails

performing-malware-triage-with-yara

implementing-container-image-minimal-base-with-distroless

hunting-for-data-exfiltration-indicators

detecting-anomalies-in-industrial-control-systems

deploying-ransomware-canary-files

executing-active-directory-attack-simulation

detecting-cryptomining-in-cloud

performing-active-directory-bloodhound-analysis

detecting-cloud-threats-with-guardduty

implementing-attack-path-analysis-with-xm-cyber

detecting-rootkit-activity

detecting-command-and-control-over-dns

performing-firmware-extraction-with-binwalk

detecting-business-email-compromise-with-ai

implementing-pci-dss-compliance-controls

implementing-gdpr-data-subject-access-request

performing-aws-privilege-escalation-assessment

performing-steganography-detection

performing-arp-spoofing-attack-simulation

detecting-mobile-malware-behavior

detecting-pass-the-ticket-attacks

implementing-zero-trust-for-saas-applications

hunting-for-supply-chain-compromise

performing-container-escape-detection

red-teaming-llms-with-garak

implementing-cloud-vulnerability-posture-management

detecting-azure-storage-account-misconfigurations

performing-aws-account-enumeration-with-scout-suite

scanning-iac-and-images-with-trivy

detecting-network-anomalies-with-zeek

performing-service-account-credential-rotation

performing-purple-team-atomic-testing

detecting-insider-threat-behaviors

performing-cloud-asset-inventory-with-cartography

performing-ot-vulnerability-assessment-with-claroty

implementing-aws-iam-permission-boundaries

performing-log-analysis-for-forensic-investigation

detecting-fileless-malware-techniques

performing-cloud-forensics-investigation

implementing-ddos-mitigation-with-cloudflare

detecting-attacks-on-historian-servers

hunting-for-dns-based-persistence

performing-purple-team-exercise

performing-dns-tunneling-detection

performing-cloud-native-threat-hunting-with-aws-detective

implementing-zero-trust-network-access

performing-kubernetes-cis-benchmark-with-kube-bench

detecting-shadow-it-cloud-usage

implementing-network-intrusion-prevention-with-suricata

implementing-kubernetes-network-policy-with-calico

performing-yara-rule-development-for-detection

implementing-supply-chain-security-with-in-toto

performing-packet-injection-attack

performing-phishing-simulation-with-gophish

detecting-azure-service-principal-abuse

performing-windows-artifact-analysis-with-eric-zimmerman-tools

detecting-fileless-attacks-on-endpoints

detecting-suspicious-powershell-execution

detecting-dcsync-attack-in-active-directory

performing-service-account-audit

hunting-for-unusual-service-installations

detecting-rdp-brute-force-attacks

detecting-deepfake-audio-in-vishing-attacks

detecting-kerberoasting-attacks

performing-ot-vulnerability-scanning-safely

performing-asset-criticality-scoring-for-vulns

implementing-hashicorp-vault-dynamic-secrets

performing-malware-hash-enrichment-with-virustotal

deploying-osquery-for-endpoint-monitoring

detecting-azure-lateral-movement

securing-azure-with-microsoft-defender

detecting-golden-ticket-attacks-in-kerberos-logs

detecting-ransomware-encryption-behavior

hunting-for-anomalous-powershell-execution

performing-cloud-log-forensics-with-athena

detecting-dll-sideloading-attacks

implementing-rbac-hardening-for-kubernetes

hunting-for-process-injection-techniques

implementing-cloud-security-posture-management

implementing-aws-config-rules-for-compliance

performing-disk-forensics-investigation

hunting-for-dns-tunneling-with-zeek

detecting-ransomware-precursors-in-network

performing-kubernetes-etcd-security-assessment

implementing-aqua-security-for-container-scanning

performing-vlan-hopping-attack

implementing-zero-trust-in-cloud

performing-firmware-malware-analysis

correlating-security-events-in-qradar

performing-cloud-forensics-with-aws-cloudtrail

securing-historian-server-in-ot-environment

performing-user-behavior-analytics

performing-ransomware-tabletop-exercise

extracting-memory-artifacts-with-rekall

hunting-for-persistence-mechanisms-in-windows

hunting-for-command-and-control-beaconing

deploying-active-directory-honeytokens

performing-gcp-penetration-testing-with-gcpbucketbrute

configuring-zscaler-private-access-for-ztna

performing-cloud-native-forensics-with-falco

investigating-ransomware-attack-artifacts

implementing-iso-27001-information-security-management

performing-plc-firmware-security-analysis

hunting-for-living-off-the-cloud-techniques

performing-threat-landscape-assessment-for-sector

performing-static-malware-analysis-with-pe-studio

performing-ot-network-security-assessment

performing-ip-reputation-analysis-with-shodan

implementing-aws-security-hub

detecting-service-account-abuse

performing-threat-intelligence-sharing-with-misp

performing-timeline-reconstruction-with-plaso

detecting-modbus-command-injection-attacks

implementing-code-signing-for-artifacts

implementing-vulnerability-remediation-sla

recovering-from-ransomware-attack

implementing-ransomware-backup-strategy

performing-active-directory-compromise-investigation

performing-cloud-incident-containment-procedures

detecting-process-hollowing-technique

performing-power-grid-cybersecurity-assessment

profiling-threat-actor-groups

deploying-edr-agent-with-crowdstrike

performing-malware-ioc-extraction

implementing-mitre-attack-coverage-mapping

performing-adversary-in-the-middle-phishing-detection

implementing-pam-for-database-access

performing-post-quantum-cryptography-migration

implementing-passwordless-authentication-with-fido2

performing-fuzzing-with-aflplusplus

implementing-vulnerability-management-with-greenbone

hunting-for-domain-fronting-c2-traffic

deploying-palo-alto-prisma-access-zero-trust

implementing-aws-security-hub-compliance

performing-lateral-movement-with-wmiexec

hunting-for-data-staging-before-exfiltration

implementing-end-to-end-encryption-for-messaging

detecting-bluetooth-low-energy-attacks

performing-credential-access-with-lazagne

detecting-spearphishing-with-email-gateway

deploying-software-defined-perimeter

hunting-for-cobalt-strike-beacons

implementing-google-workspace-phishing-protection

hunting-for-lolbins-execution-in-endpoint-logs

implementing-zero-knowledge-proof-for-authentication

implementing-image-provenance-verification-with-cosign

performing-cloud-storage-forensic-acquisition

deploying-decoy-files-for-ransomware-detection

extracting-config-from-agent-tesla-rat

hunting-for-spearphishing-indicators

detecting-golden-ticket-forgery

hunting-for-suspicious-scheduled-tasks

implementing-digital-signatures-with-ed25519

hunting-for-shadow-copy-deletion

implementing-network-traffic-analysis-with-arkime

escaping-containers-to-host

detecting-evasion-techniques-in-endpoint-logs

detecting-living-off-the-land-attacks

hunting-for-scheduled-task-persistence

implementing-pod-security-admission-controller

implementing-passwordless-auth-with-microsoft-entra

performing-malware-persistence-investigation

implementing-hardware-security-key-authentication

implementing-container-network-policies-with-calico

performing-memory-forensics-with-volatility3-plugins

implementing-anti-phishing-training-program

performing-active-directory-forest-trust-attack

hunting-for-lateral-movement-via-wmi

detecting-exfiltration-over-dns-with-zeek

implementing-google-workspace-admin-security

hunting-for-ntlm-relay-attacks

implementing-privileged-session-monitoring

detecting-lateral-movement-with-splunk

detecting-insider-data-exfiltration-via-dlp

performing-soc-tabletop-exercise

detecting-ntlm-relay-with-event-correlation

detecting-insider-threat-with-ueba

hunting-for-dcsync-attacks

implementing-network-traffic-baselining

performing-physical-intrusion-assessment

eradicating-malware-from-infected-systems

implementing-opa-gatekeeper-for-policy-enforcement

performing-iot-security-assessment

hunting-for-registry-run-key-persistence

hunting-for-registry-persistence-mechanisms

detecting-living-off-the-land-with-lolbas

implementing-google-workspace-sso-configuration

performing-kerberoasting-attack

performing-false-positive-reduction-in-siem

performing-bluetooth-security-assessment

implementing-gcp-vpc-firewall-rules

performing-paste-site-monitoring-for-credentials

hunting-for-living-off-the-land-binaries

implementing-network-access-control-with-cisco-ise

implementing-mobile-application-management

performing-oil-gas-cybersecurity-assessment

implementing-epss-score-for-vulnerability-prioritization

implementing-policy-as-code-with-open-policy-agent

detecting-t1003-credential-dumping-with-edr

implementing-siem-use-cases-for-detection

implementing-patch-management-workflow

hunting-for-dcom-lateral-movement

evaluating-threat-intelligence-platforms

implementing-fuzz-testing-in-cicd-with-aflplusplus

detecting-t1055-process-injection-with-sysmon

hunting-for-persistence-via-wmi-subscriptions

detecting-beaconing-patterns-with-zeek

detecting-malicious-scheduled-tasks-with-sysmon

managing-cloud-identity-with-okta

performing-brand-monitoring-for-impersonation

implementing-envelope-encryption-with-aws-kms

detecting-stuxnet-style-attacks

hunting-for-beaconing-with-frequency-analysis

implementing-anti-ransomware-group-policy

implementing-network-segmentation-for-ot

implementing-sigstore-for-software-signing

detecting-modbus-protocol-anomalies

implementing-vulnerability-sla-breach-alerting

detecting-wmi-persistence

implementing-threat-intelligence-lifecycle-management

implementing-cloud-dlp-for-data-protection

emulating-cloud-attacks-with-stratus-red-team

performing-automated-malware-analysis-with-cape

implementing-azure-ad-privileged-identity-management

performing-scada-hmi-security-assessment

hunting-for-defense-evasion-via-timestomping

mapping-attack-paths-with-bloodhound-ce

hunting-for-startup-folder-persistence

implementing-cloud-trail-log-analysis

performing-gcp-security-assessment-with-forseti

detecting-container-runtime-threats-with-falco

detecting-mimikatz-execution-patterns

detecting-typosquatting-packages

detecting-misconfigured-azure-storage

implementing-file-integrity-monitoring-with-aide

implementing-immutable-backup-with-restic

implementing-azure-defender-for-cloud

implementing-aws-macie-for-data-classification

detecting-dnp3-protocol-anomalies

implementing-rapid7-insightvm-for-scanning

implementing-aws-nitro-enclave-security

detecting-t1548-abuse-elevation-control-mechanism

performing-dmarc-policy-enforcement-rollout

performing-dynamic-analysis-with-any-run

exploiting-aws-with-pacu

implementing-privileged-access-management-with-cyberark

performing-access-review-and-certification

performing-bandwidth-throttling-attack-simulation

implementing-siem-use-case-tuning

implementing-privileged-access-workstation

implementing-cloud-workload-protection

implementing-alert-fatigue-reduction

implementing-ot-incident-response-playbook

performing-alert-triage-with-elastic-siem

recovering-deleted-files-with-photorec

implementing-gcp-binary-authorization

investigating-insider-threat-indicators

implementing-next-generation-firewall-with-palo-alto

implementing-application-whitelisting-with-applocker

implementing-rsa-key-pair-management

exploiting-adcs-with-certipy

implementing-siem-correlation-rules-for-apt

implementing-ot-network-traffic-analysis-with-nozomi

implementing-identity-verification-for-zero-trust

performing-lateral-movement-detection

performing-log-source-onboarding-in-siem

implementing-soar-playbook-for-phishing

implementing-endpoint-dlp-controls

implementing-mtls-for-zero-trust-services

implementing-network-deception-with-honeypots

implementing-zero-standing-privilege-with-cyberark

implementing-saml-sso-with-okta

implementing-security-chaos-engineering

detecting-lateral-movement-with-zeek

implementing-cisa-zero-trust-maturity-model

performing-entitlement-review-with-sailpoint-iiq

implementing-runtime-application-self-protection

implementing-zero-trust-dns-with-nextdns

processing-stix-taxii-feeds

managing-intelligence-lifecycle

hunting-for-t1098-account-manipulation

implementing-delinea-secret-server-for-pam

performing-hardware-security-module-integration

implementing-honeypot-for-ransomware-detection

implementing-continuous-security-validation-with-bas

implementing-patch-management-for-ot-systems

implementing-zero-trust-with-hashicorp-boundary

implementing-syslog-centralization-with-rsyslog

performing-deception-technology-deployment

triaging-windows-with-kape

implementing-runtime-security-with-tetragon

implementing-device-posture-assessment-in-zero-trust

implementing-gcp-organization-policy-constraints

performing-access-recertification-with-saviynt

implementing-browser-isolation-for-zero-trust

performing-s7comm-protocol-security-analysis

implementing-email-sandboxing-with-proofpoint

performing-initial-access-with-evilginx3

detecting-data-and-model-poisoning

implementing-zero-trust-network-access-with-zscaler

implementing-ics-firewall-with-tofino

implementing-security-monitoring-with-datadog

implementing-disk-encryption-with-bitlocker

implementing-conditional-access-policies-azure-ad

performing-ioc-enrichment-automation

deploying-cloud-deception-with-decoy-resources

performing-file-carving-with-foremost

implementing-beyondcorp-zero-trust-access-model

implementing-ticketing-system-for-incidents

implementing-conduit-security-for-ot-remote-access

orchestrating-llm-attacks-with-pyrit

implementing-just-in-time-access-provisioning

performing-insider-threat-investigation

monitoring-scada-modbus-traffic-anomalies

implementing-canary-tokens-for-network-intrusion

implementing-purdue-model-network-segmentation

hunting-saas-sso-token-abuse

implementing-iec-62443-security-zones

implementing-soar-playbook-with-palo-alto-xsoar

implementing-identity-governance-with-sailpoint

implementing-stix-taxii-feed-integration

validating-tpm-measured-boot-attestation

implementing-nerc-cip-compliance-controls

implementing-usb-device-control-policy

migrating-to-post-quantum-cryptography

post-exploiting-microsoft-graph-with-graphrunner

detecting-secure-boot-bypass

implementing-data-loss-prevention-with-microsoft-purview

implementing-honeytokens-for-breach-detection

implementing-diamond-model-analysis

implementing-soar-automation-with-phantom

implementing-velociraptor-for-ir-collection

implementing-taxii-server-with-opentaxii

hunting-evtx-with-chainsaw

enumerating-cloud-with-cloudfox

generating-forensic-timelines-with-hayabusa

moving-laterally-with-netexec

implementing-scim-provisioning-with-okta

executing-nist-rmf-authorization-to-operate

implementing-zero-trust-with-beyondcorp

conducting-gdpr-compliance-assessment

performing-indicator-lifecycle-management

implementing-deception-based-detection-with-canarytoken

implementing-proofpoint-email-security-gateway

implementing-dragos-platform-for-ot-monitoring

implementing-hipaa-security-rule-safeguards

implementing-bgp-security-with-rpki

implementing-mimecast-targeted-attack-protection

detecting-model-extraction-attacks

implementing-ransomware-kill-switch-detection

implementing-security-information-sharing-with-stix2

implementing-ebpf-security-monitoring

detecting-entra-offensive-tools-in-graph-logs

implementing-memory-protection-with-dep-aslr

managing-third-party-vendor-risk

performing-ics-asset-discovery-with-claroty

implementing-log-integrity-with-blockchain

implementing-log-forwarding-with-fluentd

operating-sliver-c2

implementing-microsegmentation-with-guardicore

designing-adversary-engagement-with-mitre-engage

relaying-ntlm-for-adcs-esc8

parsing-artifacts-with-eric-zimmerman-tools

modeling-threats-with-opencti

deploying-honeytokens-and-canarytokens

hunting-bootkits-in-efi-system-partition

operating-havoc-c2

analyzing-cobalt-strike-malleable-profiles

fleet-hunting-with-velociraptor

building-cloud-security-posture-management

analyzing-phishing-email-headers

operationalizing-misp-threat-feeds

conducting-mobile-application-penetration-test

conducting-cloud-infrastructure-penetration-test

auditing-kubernetes-rbac-permissions

performing-cloud-penetration-testing

containing-active-security-breach

detecting-cloud-cryptomining-activity

hunting-living-off-the-land-binaries

performing-ransomware-incident-response

implementing-threat-intelligence-platform

implementing-rbac-for-kubernetes-cluster

hunting-for-webshells-in-web-servers

detecting-golden-ticket-attacks

executing-diamond-model-analysis