mukul975

Configures secure OAuth 2.0 authorization flows, including Authorization

Detect dangerous ACL misconfigurations in Active Directory using ldap3

Parse and analyze Cobalt Strike Malleable C2 profiles with dissect.cobaltstrike (profiles and beacon-payload configs) and pyMalleableC2 (AST parsing) to extract HTTP/DNS transforms, URIs, headers, sleep/jitter, and injection behavior, then generate network detection signatures

Perform static analysis of malicious PDF documents using peepdf, pdfid,

Use Scapy to craft, send, sniff, and dissect TCP/UDP/ICMP/DNS packets, analyze pcap files, implement SYN scans, and detect anomalous traffic such as fragmented or malformed packets

Scan Linux systems for persistence mechanisms including crontab/systemd entries, LD_PRELOAD injection, shell profile modifications (.bashrc, .profile), and SSH authorized_keys backdoors, then correlate findings with auditd logs into an installation timeline.

Detect PowerShell Empire post-exploitation framework artifacts in Windows Script Block Logging (Event ID 4104) and Module Logging (Event ID 4103), including the default launcher string, Base64-encoded WebClient/FromBase64String payloads, known module invocations (Invoke-Mimikatz, Invoke-Kerberoast),…

Identify ransomware-related network indicators, including C2 beaconing patterns, TOR exit node connections, data exfiltration flows, and encryption key exchange, by analyzing Zeek conn.log and NetFlow data

Detect abnormal access in AWS S3, GCS, and Azure Blob Storage by analyzing CloudTrail Data Events, GCS audit logs, and Azure Storage Analytics for after-hours bulk downloads, new-IP access, and API-call spikes (e.g. GetObject) via statistical baselines and time-series anomaly detection

Perform static and symbolic analysis of Solidity smart contracts using

Implement a phishing report button (Microsoft 365 built-in Report button

Configures TLS 1.3 (RFC 8446) on servers, covering cipher suite and

Detect sandbox and VM evasion techniques in malware samples by analyzing

Implement Microsoft's Enhanced Security Admin Environment (ESAE) tiered

Hardens LDAP directory services against credential harvesting, LDAP

'Parses API Gateway access logs (AWS API Gateway, Kong, Nginx) to detect

'Queries Azure Monitor activity logs and sign-in logs via azure-monitor-query

Parse NetFlow v9 and IPFIX records to detect volumetric anomalies, port

Query a MISP (Malware Information Sharing Platform) instance via PyMISP

Perform static analysis of Android APK malware using apktool for resource decompilation, jadx for Java source recovery, and androguard for manifest inspection, dangerous permission-combination detection, and identification of obfuscated code, dynamic code loading, and reflection-based API calls.