Video & Animation

>-

Auditing Google Cloud Platform IAM permissions to identify overly permissive

Auditing Kubernetes cluster RBAC configurations to identify overly permissive

Monitors Certificate Transparency (CT) logs to detect unauthorized certificate

Drive the AADInternals PowerShell toolkit to perform Microsoft Entra ID tenant reconnaissance, access-token acquisition across Microsoft APIs, and federation/AD FS backdoor testing (Golden SAML, T1606.002) for defensive validation. Use during an authorized Entra ID/Microsoft 365 red-team assessment to map external attack surface or verify AD FS signing certs resist Golden SAML.

Audit AWS, Azure, and GCP environments against the CIS Foundations Benchmarks by running automated scans with tools like Prowler and ScoutSuite, interpreting failed controls, and tracking remediation for continuous compliance. Use when conducting a cloud security audit, validating CIS benchmark compliance (CIS v5 AWS, v4 Azure, v4 GCP), or setting up continuous cloud compliance monitoring.

Analyze Windows Shellbag (BagMRU) registry artifacts with SBECmd and

Test RAG vector stores (Pinecone, Qdrant, Weaviate, Chroma, pgvector,

Enumerate Microsoft Entra ID (Azure AD) tenants with ROADrecon and

Run OAuth 2.0 device-code and illicit-consent phishing attacks against

Auditing Microsoft Entra ID (Azure Active Directory) configuration to

Systematically audit AWS S3 bucket permissions to identify publicly

Extract and analyze Windows Registry hives with tools like RegRipper

Parse Windows LNK shortcut files to extract target paths, MAC timestamps,

Parse Windows Prefetch (.pf) files with the windowsprefetch Python

Parse Apache and Nginx access logs to detect SQL injection attempts,

Analyzes Windows Security, System, and Sysmon event logs in Splunk to

Parses the Windows Amcache.hve registry hive with Eric Zimmerman

Query a MISP (Malware Information Sharing Platform) instance via PyMISP

Map advanced persistent threat (APT) group TTPs to the MITRE ATT&CK framework using the attackcti Python library to query STIX/TAXII data for group-technique associations, then generate ATT&CK Navigator layer files to visualize and compare defensive coverage against adversary profiles. Use when profiling an APT group

Queries Certificate Transparency logs via crt.sh and pycrtsh to detect

Generate domain permutations with dnstwist and check DNS resolution

Systematically map threat actor behavior and observed IOCs to the MITRE ATT&CK framework, build technique coverage heatmaps with the ATT&CK Navigator, identify detection gaps, and produce actionable threat intelligence reports across the Enterprise, Mobile, and ICS matrices. Use when analyzing threat actor TTPs, correlating IOCs to specific ATT&CK techniques, or assessing defensive detection coverage against adversary behavior.

Leverages Splunk Enterprise Security and SPL (Search Processing Language)