Threat Detection

Block sensitive data leaks by email, USB, cloud storage and printing from endpoints

Set up AIDE file integrity baselines with cron checks and change alerts on Linux

Turn on Gmail phishing, spoofing and malware protections in the Google Workspace console

Deploy honeypot shares and canary files that catch ransomware during encryption

Plant fake AWS keys, DNS canaries and document beacons to flag attacker access

Chain log entries with SHA-256 hashes so any tampering breaks verification

Set up Mimecast URL, attachment and impersonation protection for email

Map detection rules to ATT&CK techniques to find SOC coverage gaps

Deploy OpenCanary, T-Pot or Cowrie honeypots to catch scans and lateral movement

Run Suricata inline as an IPS with NFQueue, custom rules and tuned signatures

Search Arkime full packet captures for C2 beacons, DNS tunnels and bad TLS certificates

Build NetFlow traffic baselines with pandas and flag outliers by z-score and IQR

Deploy Nozomi Guardian sensors for passive OT asset visibility and anomaly detection

Block phishing, malware and BEC with Proofpoint Email Protection before inbox delivery

Disable WAF rules or EDR in controlled experiments to test detection and response

Build STIX 2.1 threat intel objects with the stix2 library and share them over TAXII

Run Datadog Cloud SIEM and Workload Protection to detect threats and misconfigurations

Write APT lateral movement correlation rules in Splunk SPL and Sigma

Cut false positives in Splunk and Elastic rules with exclusions and tuned thresholds

Design SIEM use cases with correlation, threshold and behavioral rules mapped to ATT&CK

Build a STIX 2.1 and TAXII 2.1 feed consumer and producer with Python and Medallion

Run a Medallion TAXII 2.1 server in Docker to publish and consume STIX collections

Run a CTI program through requirements, collection, analysis and feedback phases

Map adversary TTPs to your assets to find detection gaps and prioritize defenses

Block unauthorized USB storage on endpoints with Group Policy, Intune or EDR controls

Tune ModSecurity with OWASP CRS for audit logs, paranoia levels and custom rules

Set up NextDNS over DoH or DoT to block malicious, phishing and cryptojacking domains

Investigate insider threat referrals using DLP alerts, SIEM analytics and HR data

Run the CTI cycle from planning and collection to analysis and feedback

Map alerts and detection rules to ATT&CK techniques for a coverage heatmap

Model actors, campaigns and indicators as a STIX 2.1 graph in OpenCTI with pycti

Watch dark web forums, paste sites and leak sites for leaked credentials and threats

Baseline Modbus TCP traffic and flag odd function codes and unauthorized register writes

Cache curated feeds in MISP and export IOCs as Suricata, Sigma and Wazuh rules

Detect AiTM phishing kits like EvilProxy and Evilginx by correlating Entra sign-in logs

Correlate Sherlock, theHarvester and SpiderFoot findings into confidence-scored profiles

Triage Elastic Security alerts in Kibana with ES|QL and ECS-normalized data

Watch domains, social media and app stores for brand impersonation and fake sites

Write Falco rules that catch shell spawns and file tampering in containers

Profile IAM users, roles and IPs with Amazon Detective graphs to trace lateral movement

Scan Tor forums, markets and paste sites for leaked credentials and threats

Deploy honeypots, honeytokens and decoy systems to catch attackers past the perimeter

Flag DNS tunnels using query entropy, length distributions and TXT payload checks

Cut SIEM false positives with allowlists, threshold tuning and threat intel enrichment

Inventory PLCs, RTUs and HMIs across Purdue levels with Claroty passive monitoring

Track IOC hit rates, false positives and confidence decay until indicators expire

Enrich IPs, domains and hashes across VirusTotal, AbuseIPDB and Shodan with scoring

Check IP reputation with Shodan for open ports, services and known vulnerabilities

Detect pass-the-hash, PsExec, WMI and RDP pivots by correlating event logs and NetFlow