mukul975

'Builds automated threat intelligence feed integration pipelines connecting

Discovering and accessing unprotected pages, APIs, and administrative

'Systematically collects, categorizes, and distributes indicators of

Execute an internal network penetration test simulating an insider threat

'Simulates man-in-the-middle attacks using Ettercap, mitmproxy, and Bettercap

'Performs memory forensics analysis using Volatility 3 to extract evidence

Facilitate structured post-incident reviews to identify root causes,

'Configures host-based intrusion detection systems (HIDS) to monitor

'Configures Windows Event Logging with advanced audit policies to generate

'Configures Zscaler Private Access (ZPA) to replace traditional VPN

'Correlates security events in IBM QRadar SIEM using AQL (Ariel Query

'Deploys deception-based honeytokens in Active Directory including fake

'Deploys canary files (honeytokens) across file systems to detect ransomware

'Deploys and configures CrowdStrike Falcon EDR agents across enterprise

'Deploys and configures osquery for real-time endpoint monitoring using

Production-grade MCP server giving Claude 27 security intelligence tools across 21 APIs — CVE lookup, EPSS scoring, CISA KEV, MITRE ATT&CK, Shodan, VirusTotal, and more.

Deploys a Software-Defined Perimeter per the CSA v2.0 specification, configuring Single Packet Authorization, mutual TLS, and SDP controller/gateway components to enforce zero trust network access

Reverse engineer Go-compiled malware in Ghidra by parsing Go buildinfo

Query the Malpedia API to look up malware family aliases and naming

Build a structured SOC escalation matrix defining severity tiers, response

'Conducts penetration testing of iOS and Android mobile applications

'Conducts comprehensive network penetration tests against authorized

'Executes containment strategies to stop active adversary operations

Prepare a defense-contractor environment for CMMC Level 2 certification: scope CUI and FCI, implement the 110 NIST SP 800-171 Rev 2 security requirements across 14 families, compute the SPRS score with the DoD Assessment Methodology, manage a compliant POA&M, and ready the organization for a C3PAO a…

'Analyzes intrusion activity against the Lockheed Martin Cyber Kill Chain

Detect and analyze covert communication channels used by malware, including

Investigate supply chain attack artifacts including trojanized software

'Analyzes structured and unstructured threat intelligence feeds to extract

Deploy and harden a Sliver C2 team server (BishopFox's Go-based adversary emulation framework) with multi-protocol listeners (mTLS, HTTP/S, DNS, WireGuard), redirectors, domain fronting, and multi-operator support for authorized red-team operations

Build an automated IOC enrichment pipeline on OpenCTI (STIX 2.1 native

Build a systematic threat-hunt workflow that turns threat intelligence and ATT&CK gap analysis into testable hypotheses, then executes and validates them via EDR/SIEM queries (CrowdStrike, Defender, Splunk, Elastic, Sysmon, Velociraptor, Sigma) and documents findings in a standardized hunt report

'Conducts security testing of REST, GraphQL, and gRPC APIs to identify

Conduct a defensible cybersecurity risk assessment using the NIST SP 800-30 Rev 1 methodology: prepare scope and a risk model, identify threat sources and threat events, identify vulnerabilities and predisposing conditions, determine likelihood and impact, compute risk, and communicate results as a…

Perform DCSync attacks by abusing MS-DRSR replication rights (DS-Replication-Get-Changes/-All) to impersonate a Domain Controller and extract KRBTGT, Domain Admin, and service account hashes for Golden Ticket forging, typically with Mimikatz.

Conduct internal Active Directory reconnaissance using BloodHound Community Edition's graph database with the SharpHound (AD) and AzureHound (Entra ID) collectors, mapping ACLs, sessions, and group memberships into attack paths from a low-privileged foothold to Domain Admin.

Plan and execute authorized vishing (voice phishing) pretext calls to

Run a targeted spearphishing simulation for initial access by developing OSINT-derived pretexts, building payloads (HTML smuggling, macro docs, ISO/LNK, OneNote, QR codes), standing up look-alike-domain email infrastructure with SPF/DKIM/DMARC via GoPhish, and tracking results.

'Conducts authorized wireless network penetration tests to assess the

Configures microsegmentation policies to enforce least-privilege workload-to-workload

'Correlates disparate security incidents, IOCs, and adversary behaviors

Deploys and monitors ransomware canary files using Python's watchdog library, placing decoy files mimicking high-value targets (financial records, credentials, database exports) where ransomware enumerates first, and alerting via email, Slack, or syslog on any read/modify/rename/delete.

'Performs Linux memory acquisition using LiME (Linux Memory Extractor)

'Map advanced persistent threat (APT) group TTPs to the MITRE ATT&CK framework using the attackcti Python library to query STIX/TAXII data for group-technique associations, then generate ATT&CK Navigator layer files to visualize and compare defensive coverage against adversary profiles

Run OAuth 2.0 device-code and illicit-consent phishing attacks against

Detect kernel-level rootkits in Linux memory dumps using Volatility3

URLScan.io is a free service for scanning and analyzing suspicious URLs.

Use Sysinternals Autoruns to systematically enumerate and analyze malware

Parse Windows PowerShell Script Block Logs (Event ID 4104) from EVTX

'Queries Certificate Transparency logs via crt.sh and pycrtsh to detect

Parse Apache and Nginx access logs to detect SQL injection attempts,

Parse Windows Prefetch (.pf) files with the windowsprefetch Python

Perform Pass-the-Ticket (PtT) lateral movement by extracting Kerberos TGT/TGS tickets from LSASS memory on a compromised host and injecting them into another session to impersonate the ticket owner without knowing their password.

Build a two-tier PKI Certificate Authority hierarchy (offline Root CA

Configures Hardware Security Modules for cryptographic key storage

Deploys Cisco Duo multi-factor authentication across enterprise applications,