12,203 skills found · Page 53 of 407
mukul975 / building-soc-escalation-matrixBuild a structured SOC escalation matrix defining severity tiers, response
mukul975 / collecting-open-source-intelligence'Collects and synthesizes open-source intelligence (OSINT) about threat
mukul975 / conducting-mobile-app-penetration-test'Conducts penetration testing of iOS and Android mobile applications
mukul975 / conducting-network-penetration-test'Conducts comprehensive network penetration tests against authorized
mukul975 / containing-active-breach'Executes containment strategies to stop active adversary operations
mukul975 / achieving-cmmc-level-2-compliancePrepare a defense-contractor environment for CMMC Level 2 certification: scope CUI and FCI, implement the 110 NIST SP 800-171 Rev 2 security requirements across 14 families, compute the SPRS score with the DoD Assessment Methodology, manage a compliant POA&M, and ready the organization for a C3PAO a…
mukul975 / analyzing-cyber-kill-chain'Analyzes intrusion activity against the Lockheed Martin Cyber Kill Chain
mukul975 / analyzing-kubernetes-audit-logsParses Kubernetes API server audit logs (JSON lines) to detect exec-into-pod, secret access, RBAC modifications, privileged pod creation, and anonymous API access, and builds SIEM detection rules from the event patterns
mukul975 / analyzing-network-covert-channels-in-malwareDetect and analyze covert communication channels used by malware, including
mukul975 / analyzing-supply-chain-malware-artifactsInvestigate supply chain attack artifacts including trojanized software
mukul975 / analyzing-threat-intelligence-feeds'Analyzes structured and unstructured threat intelligence feeds to extract
mukul975 / building-c2-infrastructure-with-sliver-frameworkDeploy and harden a Sliver C2 team server (BishopFox's Go-based adversary emulation framework) with multi-protocol listeners (mTLS, HTTP/S, DNS, WireGuard), redirectors, domain fronting, and multi-operator support for authorized red-team operations
mukul975 / building-ioc-enrichment-pipeline-with-openctiBuild an automated IOC enrichment pipeline on OpenCTI (STIX 2.1 native
mukul975 / building-threat-hunt-hypothesis-frameworkBuild a systematic threat-hunt workflow that turns threat intelligence and ATT&CK gap analysis into testable hypotheses, then executes and validates them via EDR/SIEM queries (CrowdStrike, Defender, Splunk, Elastic, Sysmon, Velociraptor, Sigma) and documents findings in a standardized hunt report
mukul975 / conducting-api-security-testing'Conducts security testing of REST, GraphQL, and gRPC APIs to identify
mukul975 / conducting-cyber-risk-assessment-with-nist-800-30Conduct a defensible cybersecurity risk assessment using the NIST SP 800-30 Rev 1 methodology: prepare scope and a risk model, identify threat sources and threat events, identify vulnerabilities and predisposing conditions, determine likelihood and impact, compute risk, and communicate results as a…
mukul975 / conducting-domain-persistence-with-dcsyncPerform DCSync attacks by abusing MS-DRSR replication rights (DS-Replication-Get-Changes/-All) to impersonate a Domain Controller and extract KRBTGT, Domain Admin, and service account hashes for Golden Ticket forging, typically with Mimikatz.
mukul975 / conducting-internal-reconnaissance-with-bloodhound-ceConduct internal Active Directory reconnaissance using BloodHound Community Edition's graph database with the SharpHound (AD) and AzureHound (Entra ID) collectors, mapping ACLs, sessions, and group memberships into attack paths from a low-privileged foothold to Domain Admin.
mukul975 / Phone Number Spoofing: Official Phone Number SpoofingPlan and execute authorized vishing (voice phishing) pretext calls to
mukul975 / Account Takeover: Exposed Login CredentialRun a targeted spearphishing simulation for initial access by developing OSINT-derived pretexts, building payloads (HTML smuggling, macro docs, ISO/LNK, OneNote, QR codes), standing up look-alike-domain email infrastructure with SPF/DKIM/DMARC via GoPhish, and tracking results.
mukul975 / conducting-wireless-network-penetration-test'Conducts authorized wireless network penetration tests to assess the
mukul975 / configuring-microsegmentation-for-zero-trustConfigures microsegmentation policies to enforce least-privilege workload-to-workload
mukul975 / correlating-threat-campaigns'Correlates disparate security incidents, IOCs, and adversary behaviors
mukul975 / Electronic Funds Transfer: Wire TransferDeploys and monitors ransomware canary files using Python's watchdog library, placing decoy files mimicking high-value targets (financial records, credentials, database exports) where ransomware enumerates first, and alerting via email, Slack, or syslog on any read/modify/rename/delete.
mukul975 / designing-adversary-engagement-with-mitre-engagePlan, run, and measure an adversary engagement operation using the MITRE Engage framework so that deployed deception is driven by strategy instead of deployed ad hoc.
mukul975 / analyzing-memory-forensics-with-lime-and-volatility'Performs Linux memory acquisition using LiME (Linux Memory Extractor)
mukul975 / analyzing-threat-actor-ttps-with-mitre-navigator'Map advanced persistent threat (APT) group TTPs to the MITRE ATT&CK framework using the attackcti Python library to query STIX/TAXII data for group-technique associations, then generate ATT&CK Navigator layer files to visualize and compare defensive coverage against adversary profiles
mukul975 / attacking-oauth-with-device-code-phishingRun OAuth 2.0 device-code and illicit-consent phishing attacks against
mukul975 / analyzing-linux-kernel-rootkitsDetect kernel-level rootkits in Linux memory dumps using Volatility3
mukul975 / analyzing-malicious-url-with-urlscanURLScan.io is a free service for scanning and analyzing suspicious URLs.
