Threat Detection

Run Velociraptor VQL hunts across fleets of endpoints for forensic collection

Write strategic, operational and tactical threat intel reports for each audience

Run hypothesis-driven APT hunts across endpoint, network and memory telemetry

Hunt bootkits in the EFI partition by hashing boot loaders and scanning with YARA

Hunt credential stuffing via login velocity, ASN spread and failed-login geography

Hunt obfuscated PowerShell, AMSI bypass and encoded payloads in 4104 and 4103 logs

Find periodic C2 callbacks with frequency analysis and coefficient of variation scoring

Spot Cobalt Strike beacons from default TLS certs, JA3 fingerprints and jitter

Spot C2 beaconing with frequency analysis, jitter detection and domain reputation

Hunt data theft in Zeek and Suricata traffic for DNS tunneling and cloud uploads

Spot archive creation and file consolidation that stage data before exfiltration

Hunt DCOM lateral movement via MMC20, ShellWindows and ShellBrowserWindow COM abuse

Flag non-DC accounts that request replication rights using Event 4662 access masks

Hunt DNS hijacks, dangling CNAMEs and rogue zone changes in passive DNS and cloud logs

Flag DNS tunneling in Zeek dns.log by entropy, query volume and unusual record types

Spot domain fronting by comparing SNI with HTTP Host headers in proxy and TLS logs

Spot WMI lateral movement from WmiPrvSE child processes and event 5857 to 5861

Hunt abused cloud and SaaS services used for C2, staging and data theft

Hunt signed system binaries abused to run payloads, download files or proxy execution

Hunt abused Windows binaries in endpoint process logs mapped to MITRE T1218

Spot NTLM relay via Event 4624 type 3 logons, Responder poisoning and SMB signing gaps

Hunt WMI event filters, consumers and bindings that trigger code on system events

Spot CreateRemoteThread and ProcessAccess injection with Sysmon events 8 and 10

Audit Run keys, Winlogon, IFEO and COM hijacks as registry persistence in Windows

Detect Run key autostart persistence from Sysmon event 13 registry logs

Hunt Windows scheduled task persistence through Event 4698 and unusual task actions

Hunt ransomware shadow copy deletion with vssadmin, wmic and PowerShell telemetry

Hunt spearphishing indicators across email logs, endpoints and network data

Catch startup folder persistence with a watchdog monitor and Autoruns cross-checks

Hunt trojanized updates, compromised dependencies and tampered build artifacts

Hunt suspicious scheduled tasks from Event 4698 and schtasks or at.exe activity

Hunt shadow admins, SID history injection and group changes in Windows security logs

Hunt C2 traffic via rare destinations, odd ports and unusual connection frequency

Flag suspicious Windows service installs from Event 7045 and binary path anomalies

Hunt web shells through new web directory files and odd child processes of web servers

Hunt stolen SSO sessions and token replay in Entra ID and Okta logs

Cut SOC alert fatigue by tuning rules, merging duplicates and scoring risk

Build an anti-phishing awareness program with simulations, training modules and metrics

Block ransomware with Group Policy using AppLocker, controlled folders and ASR rules

Restrict unauthorized software on Windows endpoints with AppLocker allow-list rules

Map attack paths from exposures to critical assets with XM Cyber choke point analysis

Plant DNS, HTTP and AWS key canary tokens that alert on network intrusion

Query CloudTrail with Athena and Logs Insights to spot unauthorized AWS API activity

Detect cryptominers, reverse shells and rogue binaries on EC2 and GCE workloads

Validate detections continuously with breach and attack simulation platforms

Create Canary Tokens through the REST API and report deception coverage from alerts

Deploy Dragos sensors for OT network monitoring with ICS threat group detections

Track process runs, file access and network calls with eBPF in Cilium Tetragon

Detonate suspicious email attachments and URLs in Proofpoint TAP sandboxes