1,116 skills found ¡ Page 9 of 38
mukul975 / conducting-domain-persistence-with-dcsyncPerform DCSync attacks by abusing MS-DRSR replication rights (DS-Replication-Get-Changes/-All) to impersonate a Domain Controller and extract KRBTGT, Domain Admin, and service account hashes for Golden Ticket forging, typically with Mimikatz.
mukul975 / conducting-internal-reconnaissance-with-bloodhound-ceConduct internal Active Directory reconnaissance using BloodHound Community Edition's graph database with the SharpHound (AD) and AzureHound (Entra ID) collectors, mapping ACLs, sessions, and group memberships into attack paths from a low-privileged foothold to Domain Admin.
mukul975 / Phone Number Spoofing: Official Phone Number SpoofingPlan and execute authorized vishing (voice phishing) pretext calls to
mukul975 / Account Takeover: Exposed Login CredentialRun a targeted spearphishing simulation for initial access by developing OSINT-derived pretexts, building payloads (HTML smuggling, macro docs, ISO/LNK, OneNote, QR codes), standing up look-alike-domain email infrastructure with SPF/DKIM/DMARC via GoPhish, and tracking results.
mukul975 / conducting-wireless-network-penetration-test'Conducts authorized wireless network penetration tests to assess the
mukul975 / configuring-microsegmentation-for-zero-trustConfigures microsegmentation policies to enforce least-privilege workload-to-workload
mukul975 / correlating-threat-campaigns'Correlates disparate security incidents, IOCs, and adversary behaviors
mukul975 / Electronic Funds Transfer: Wire TransferDeploys and monitors ransomware canary files using Python's watchdog library, placing decoy files mimicking high-value targets (financial records, credentials, database exports) where ransomware enumerates first, and alerting via email, Slack, or syslog on any read/modify/rename/delete.
mukul975 / analyzing-memory-forensics-with-lime-and-volatility'Performs Linux memory acquisition using LiME (Linux Memory Extractor)
mukul975 / analyzing-threat-actor-ttps-with-mitre-navigator'Map advanced persistent threat (APT) group TTPs to the MITRE ATT&CK framework using the attackcti Python library to query STIX/TAXII data for group-technique associations, then generate ATT&CK Navigator layer files to visualize and compare defensive coverage against adversary profiles
mukul975 / attacking-oauth-with-device-code-phishingRun OAuth 2.0 device-code and illicit-consent phishing attacks against
mukul975 / analyzing-linux-kernel-rootkitsDetect kernel-level rootkits in Linux memory dumps using Volatility3
mukul975 / analyzing-malicious-url-with-urlscanURLScan.io is a free service for scanning and analyzing suspicious URLs.
mukul975 / analyzing-malware-persistence-with-autorunsUse Sysinternals Autoruns to systematically enumerate and analyze malware
mukul975 / analyzing-powershell-script-block-loggingParse Windows PowerShell Script Block Logs (Event ID 4104) from EVTX
mukul975 / Phishing'Queries Certificate Transparency logs via crt.sh and pycrtsh to detect
mukul975 / analyzing-web-server-logs-for-intrusionParse Apache and Nginx access logs to detect SQL injection attempts,
mukul975 / analyzing-windows-prefetch-with-pythonParse Windows Prefetch (.pf) files with the windowsprefetch Python
mukul975 / conducting-pass-the-ticket-attackPerform Pass-the-Ticket (PtT) lateral movement by extracting Kerberos TGT/TGS tickets from LSASS memory on a compromised host and injecting them into another session to impersonate the ticket owner without knowing their password.
mukul975 / configuring-certificate-authority-with-opensslBuild a two-tier PKI Certificate Authority hierarchy (offline Root CA
mukul975 / configuring-hsm-for-key-storageConfigures Hardware Security Modules for cryptographic key storage
mukul975 / configuring-multi-factor-authentication-with-duoDeploys Cisco Duo multi-factor authentication across enterprise applications,
mukul975 / Steal Web Session CookieConfigures secure OAuth 2.0 authorization flows, including Authorization
mukul975 / analyzing-active-directory-acl-abuseDetect dangerous ACL misconfigurations in Active Directory using ldap3
mukul975 / analyzing-cobaltstrike-malleable-c2-profilesParse and analyze Cobalt Strike Malleable C2 profiles with dissect.cobaltstrike (profiles and beacon-payload configs) and pyMalleableC2 (AST parsing) to extract HTTP/DNS transforms, URIs, headers, sleep/jitter, and injection behavior, then generate network detection signatures
mukul975 / analyzing-malicious-pdf-with-peepdfPerform static analysis of malicious PDF documents using peepdf, pdfid,
mukul975 / analyzing-network-packets-with-scapyUse Scapy to craft, send, sniff, and dissect TCP/UDP/ICMP/DNS packets, analyze pcap files, implement SYN scans, and detect anomalous traffic such as fragmented or malformed packets
mukul975 / analyzing-persistence-mechanisms-in-linuxScan Linux systems for persistence mechanisms including crontab/systemd entries, LD_PRELOAD injection, shell profile modifications (.bashrc, .profile), and SSH authorized_keys backdoors, then correlate findings with auditd logs into an installation timeline.
mukul975 / analyzing-powershell-empire-artifactsDetect PowerShell Empire post-exploitation framework artifacts in Windows Script Block Logging (Event ID 4104) and Module Logging (Event ID 4103), including the default launcher string, Base64-encoded WebClient/FromBase64String payloads, known module invocations (Invoke-Mimikatz, Invoke-Kerberoast),âĻ
mukul975 / Transfer of fundsIdentify ransomware-related network indicators, including C2 beaconing patterns, TOR exit node connections, data exfiltration flows, and encryption key exchange, by analyzing Zeek conn.log and NetFlow data
