mukul975

Examine Linux system artifacts (auth logs, cron/systemd persistence,

'Analyzes malicious VBA macros embedded in Microsoft Office documents

'Analyzes malicious PDF files using PDFiD, pdf-parser, and peepdf to

'Analyzes encryption algorithms, key management, and file encryption

Generate domain permutations with dnstwist and check DNS resolution

'Analyzes UEFI bootkit persistence (SPI flash implants, ESP modifications,

Correlate Windows registry keys (USBSTOR, MountedDevices), Event Logs,

Parse Windows LNK shortcut files to extract target paths, MAC timestamps,

Test RAG vector stores (Pinecone, Qdrant, Weaviate, Chroma, pgvector,

'Auditing Google Cloud Platform IAM permissions to identify overly permissive

'Auditing Kubernetes cluster RBAC configurations to identify overly permissive

'Builds an automated malware submission and analysis pipeline that collects

Configure a GitLab CI/CD pipeline that embeds SAST (Semgrep, SpotBugs, Gosec, Bandit, NodeJsScan), DAST, container scanning, dependency scanning, and secret detection via GitLab's managed security templates

Build an automated pipeline that ingests raw IOCs (URLs, IPs, domains,

Implement a vulnerability aging dashboard and SLA tracking system that measures time-to-remediation against severity-based deadlines (e.g. 14 days critical, 30 days high, 60 days medium, 90 days low), with automated escalations and compliance metrics reporting

'Builds a structured vulnerability scanning workflow using tools like

'This skill outlines methodologies for performing authorized penetration

Conduct external recon using OSINT techniques to map an organization's external attack surface without touching target systems, gathering DNS records, certificate transparency logs, search results, social media, code repositories, and breach databases into a target profile.

Respond to malware infections across enterprise endpoints by identifying the malware family, determining infection vectors, assessing spread, and executing containment, analysis, eradication, and recovery procedures aligned to MITRE ATT&CK

Configure AWS Verified Access to provide VPN-less zero trust network

'Configures Google Cloud Identity-Aware Proxy (IAP) via gcloud to enforce

'Designs and implements VLAN-based (802.1Q) network segmentation on

'Configures pfSense firewall rules, NAT policies, IPsec/OpenVPN tunnels,

'Installs, configures, and tunes Snort 3 to monitor network traffic

'Deploys and configures Suricata IDS/IPS with Emerging Threats rulesets,

'Configures Microsoft Defender for Endpoint (MDE) advanced protection

'Analyzes DNS query logs to detect data exfiltration via DNS tunneling,

'Analyzes indicators of compromise (IOCs) including IP addresses, domains,

'Uses the Linux Audit framework (auditd) with ausearch and aureport utilities

Analyze Windows LNK shortcut files and Jump List artifacts with LECmd,

'Detonate malware samples in Cuckoo Sandbox to observe runtime behavior

'Analyzes RAM memory dumps from compromised systems using the Volatility framework to identify malicious processes,

Analyze the NTFS Master File Table ($MFT) with MFTECmd, analyzeMFT,

'Analyzes network traffic captures and flow data to identify adversary activity during security incidents, including

'Analyzes network traffic generated by malware during sandbox execution

'Captures and analyzes network packet data using Wireshark and tshark

'Parses Software Bill of Materials (SBOM) in CycloneDX and SPDX JSON

'Leverages Splunk Enterprise Security and SPL (Search Processing Language)

'Parses the Windows Amcache.hve registry hive with Eric Zimmerman''s

'Analyzes Windows Security, System, and Sysmon event logs in Splunk to

Extract and analyze Windows Registry hives with tools like RegRipper

Analyze Windows Shellbag (BagMRU) registry artifacts with SBECmd and

Enumerate Microsoft Entra ID (Azure AD) tenants with ROADrecon and

'Systematically audit AWS S3 bucket permissions to identify publicly

'Auditing Microsoft Entra ID (Azure Active Directory) configuration to

'Auditing Terraform infrastructure-as-code for security misconfigurations

Build effective detection rules using Splunk Search Processing Language

'Builds vendor-agnostic detection rules using the Sigma rule format for

'Builds real-time incident response dashboards in Splunk, Elastic, or

Designs and documents structured incident response playbooks with step-by-step

Build collaborative forensic incident timelines using Timesketch to ingest,

Build structured communication templates for malware incidents (ransomware,

Establish a repeatable operational process for triaging, testing, and

Builds a structured ransomware incident response playbook aligned with

Deploy and configure the Havoc C2 framework (teamserver, HTTPS/HTTP/SMB

Apply bottom-up and top-down role mining techniques, including clustering

'Builds SOC performance metrics and KPI tracking dashboards measuring

'Builds a structured SOC incident response playbook for ransomware attacks

Generate forensic super-timelines with Plaso's log2timeline.py, pinfo.py,