Video & Animation

>-

Auditing Google Cloud Platform IAM permissions to identify overly permissive

>-

Auditing Microsoft Entra ID (Azure Active Directory) configuration to

Systematically audit AWS S3 bucket permissions to identify publicly

Run OAuth 2.0 device-code and illicit-consent phishing attacks against

Audit AWS, Azure, and GCP environments against the CIS Foundations Benchmarks by running automated scans with tools like Prowler and ScoutSuite, interpreting failed controls, and tracking remediation for continuous compliance. Use when conducting a cloud security audit, validating CIS benchmark compliance (CIS v5 AWS, v4 Azure, v4 GCP), or setting up continuous cloud compliance monitoring.

Test RAG vector stores (Pinecone, Qdrant, Weaviate, Chroma, pgvector,

Enumerate Microsoft Entra ID (Azure AD) tenants with ROADrecon and

Drive the AADInternals PowerShell toolkit to perform Microsoft Entra ID tenant reconnaissance, access-token acquisition across Microsoft APIs, and federation/AD FS backdoor testing (Golden SAML, T1606.002) for defensive validation. Use during an authorized Entra ID/Microsoft 365 red-team assessment to map external attack surface or verify AD FS signing certs resist Golden SAML.

Audit MCP servers for tool poisoning, tool shadowing, rug pulls, SSRF, and unauthenticated exposure using Invariant Labs

Queries Certificate Transparency logs via crt.sh and pycrtsh to detect

Generate domain permutations with dnstwist and check DNS resolution

Parse Windows LNK shortcut files to extract target paths, MAC timestamps,

Analyzes Windows Security, System, and Sysmon event logs in Splunk to

Parses the Windows Amcache.hve registry hive with Eric Zimmerman

Parse Windows Prefetch (.pf) files with the windowsprefetch Python

Analyzes UEFI bootkit persistence (SPI flash implants, ESP modifications,

Systematically map threat actor behavior and observed IOCs to the MITRE ATT&CK framework, build technique coverage heatmaps with the ATT&CK Navigator, identify detection gaps, and produce actionable threat intelligence reports across the Enterprise, Mobile, and ICS matrices. Use when analyzing threat actor TTPs, correlating IOCs to specific ATT&CK techniques, or assessing defensive detection coverage against adversary behavior.

Extract and analyze Windows Registry hives with tools like RegRipper

Parse Apache and Nginx access logs to detect SQL injection attempts,

Correlate Windows registry keys (USBSTOR, MountedDevices), Event Logs,

Map advanced persistent threat (APT) group TTPs to the MITRE ATT&CK framework using the attackcti Python library to query STIX/TAXII data for group-technique associations, then generate ATT&CK Navigator layer files to visualize and compare defensive coverage against adversary profiles. Use when profiling an APT group

Analyzes structured and unstructured threat intelligence feeds to extract