Video & Animation

>-

>-

Auditing Kubernetes cluster RBAC configurations to identify overly permissive

Audit MCP servers for tool poisoning, tool shadowing, rug pulls, SSRF, and unauthenticated exposure using Invariant Labs

Auditing Terraform infrastructure-as-code for security misconfigurations

Auditing Google Cloud Platform IAM permissions to identify overly permissive

Monitors Certificate Transparency (CT) logs to detect unauthorized certificate

Generate domain permutations with dnstwist and check DNS resolution

Systematically map threat actor behavior and observed IOCs to the MITRE ATT&CK framework, build technique coverage heatmaps with the ATT&CK Navigator, identify detection gaps, and produce actionable threat intelligence reports across the Enterprise, Mobile, and ICS matrices. Use when analyzing threat actor TTPs, correlating IOCs to specific ATT&CK techniques, or assessing defensive detection coverage against adversary behavior.

Query a MISP (Malware Information Sharing Platform) instance via PyMISP

Extract and analyze Windows Registry hives with tools like RegRipper

Map advanced persistent threat (APT) group TTPs to the MITRE ATT&CK framework using the attackcti Python library to query STIX/TAXII data for group-technique associations, then generate ATT&CK Navigator layer files to visualize and compare defensive coverage against adversary profiles. Use when profiling an APT group

Investigate supply chain attack artifacts including trojanized software

Analyzes UEFI bootkit persistence (SPI flash implants, ESP modifications,

Parse Windows Prefetch (.pf) files with the windowsprefetch Python

Queries Certificate Transparency logs via crt.sh and pycrtsh to detect

Analyzes structured and unstructured threat intelligence feeds to extract

Parses the Windows Amcache.hve registry hive with Eric Zimmerman

Parse Apache and Nginx access logs to detect SQL injection attempts,

Leverages Splunk Enterprise Security and SPL (Search Processing Language)

Analyzes Windows Security, System, and Sysmon event logs in Splunk to

Parse Windows LNK shortcut files to extract target paths, MAC timestamps,

Correlate Windows registry keys (USBSTOR, MountedDevices), Event Logs,

Examine NTFS slack space, MFT entries, the USN Change Journal, and Alternate Data Streams (ADS) to recover hidden or residual data, reconstruct deleted-file metadata, and reconstruct available file-system change activity from USN records. Use during deep forensic analysis of an NTFS image when standard file recovery is insufficient, such as hunting for data hidden in ADS.