Tagged detection

Analyze suspicious samples statically and dynamically and write IOC and YARA rules

Detect exec-into-pod, secret access and RBAC changes in Kubernetes audit logs

Build live incident response dashboards in Splunk, Elastic or Grafana for SOC leads

Write a SOC ransomware playbook with SIEM queries, isolation steps and decision trees

Turn EVTX files into prioritized timelines with Hayabusa, Sigma rules and MITRE tags

Hunt EVTX files with Chainsaw using Sigma rules, keyword search and shimcache analysis

Forward and enrich logs with Fluent Bit and Fluentd into Elasticsearch, S3 and Splunk

Automate alert triage and containment with Splunk SOAR playbooks

Create Splunk SOAR containers and phishing playbooks through the REST API

Link SIEM alerts to ServiceNow, Jira or TheHive tickets with SLA and escalation rules

Write YARA rules to classify malware samples by strings, bytes and file structure

Classify incidents with IR playbooks and route them through Splunk or TheHive

Validate Sigma and YARA rules against memory dumps and event logs with Volatility

Guide authorized defense evasion tests for WAF bypass, EDR and traffic obfuscation

Study AMSI, ETW and EDR evasion techniques used in authorized Windows red teams

Find which YARA or Sigma rules flag a C2 implant and adjust its source

Analyze obfuscated scripts, PE samples, C2 traffic and YARA rules in CTF challenges