Video & Animation

Audit AWS, Azure, and GCP environments against the CIS Foundations Benchmarks by running automated scans with tools like Prowler and ScoutSuite, interpreting failed controls, and tracking remediation for continuous compliance. Use when conducting a cloud security audit, validating CIS benchmark compliance (CIS v5 AWS, v4 Azure, v4 GCP), or setting up continuous cloud compliance monitoring.

Auditing Microsoft Entra ID (Azure Active Directory) configuration to

Parse Windows Prefetch (.pf) files with the windowsprefetch Python

Parse Windows LNK shortcut files to extract target paths, MAC timestamps,

Extract and analyze Windows Registry hives with tools like RegRipper

Analyzes UEFI bootkit persistence (SPI flash implants, ESP modifications,

Generate domain permutations with dnstwist and check DNS resolution

Correlate Windows registry keys (USBSTOR, MountedDevices), Event Logs,

Parses the Windows Amcache.hve registry hive with Eric Zimmerman

Parse Apache and Nginx access logs to detect SQL injection attempts,

Query a MISP (Malware Information Sharing Platform) instance via PyMISP

Queries Certificate Transparency logs via crt.sh and pycrtsh to detect

Systematically map threat actor behavior and observed IOCs to the MITRE ATT&CK framework, build technique coverage heatmaps with the ATT&CK Navigator, identify detection gaps, and produce actionable threat intelligence reports across the Enterprise, Mobile, and ICS matrices. Use when analyzing threat actor TTPs, correlating IOCs to specific ATT&CK techniques, or assessing defensive detection coverage against adversary behavior.

Map advanced persistent threat (APT) group TTPs to the MITRE ATT&CK framework using the attackcti Python library to query STIX/TAXII data for group-technique associations, then generate ATT&CK Navigator layer files to visualize and compare defensive coverage against adversary profiles. Use when profiling an APT group

Analyzes Windows Security, System, and Sysmon event logs in Splunk to

Analyzes structured and unstructured threat intelligence feeds to extract

Leverages Splunk Enterprise Security and SPL (Search Processing Language)

Examine NTFS slack space, MFT entries, the USN Change Journal, and Alternate Data Streams (ADS) to recover hidden or residual data, reconstruct deleted-file metadata, and reconstruct available file-system change activity from USN records. Use during deep forensic analysis of an NTFS image when standard file recovery is insufficient, such as hunting for data hidden in ADS.

Investigate supply chain attack artifacts including trojanized software

Parse Microsoft Outlook PST and OST files using libpff and pst-utils to extract message content, headers, attachments, deleted items, and MAPI metadata, including recovery of items from the Recoverable Items folder. Use when conducting email forensic investigations, legal e-discovery, or incident response that requires reconstructing communication patterns or tracing message routing from Outlook archives.

Analyze the NTFS Master File Table ($MFT) with MFTECmd, analyzeMFT,

Performs Linux memory acquisition using LiME (Linux Memory Extractor)

Detect and analyze covert communication channels used by malware, including

Detect sandbox and VM evasion techniques in malware samples by analyzing