Threat Detection

Enrich malware hashes with VirusTotal detection rates, sandbox behavior and YARA matches

Extract hashes, C2 domains, mutexes and registry keys from malware and defang them

Script tshark and pyshark to flag scans, beacons and DNS tunnels in PCAP files

Deploy Zeek as a passive monitor that logs protocol metadata and feeds your SIEM

Monitor Pastebin and GitHub Gists for leaked credentials and API keys

Run Atomic Red Team tests and map detection gaps on an ATT&CK Navigator heatmap

Run purple team exercises that test SOC detections against ATT&CK-mapped attacks

Set up TLS break-and-inspect on firewalls and proxies with certificate exemptions

Run Atomic Red Team tests with atomic-operator to validate SIEM and EDR coverage

Hunt for ATT&CK techniques in Elastic SIEM with KQL and EQL queries

Hunt for malware and IOCs across files and memory dumps with YARA rules

Create MISP events with IOCs and ATT&CK tags and export STIX 2.1 with PyMISP

Build a sector threat landscape report from threat actors, TTPs and exploited CVEs

Spot impossible travel, privilege abuse and insider threats with UEBA baselines

Find rogue access points and weak Wi-Fi encryption with passive Kismet monitoring

Write YARA and YARA-X rules for malware families with few false positives

Ingest STIX 2.1 bundles from TAXII servers and route intel to your tools

Build threat actor profiles from TTPs and campaigns for executive briefings

Map adversary C2 servers and phishing domains by pivoting through DNS and cert logs

Triage Splunk Enterprise Security notables with SPL queries and escalation calls

Capture and filter packets with Wireshark to troubleshoot traffic and spot anomalies

Hunt threats in logs and telemetry with IOC sweeps and anomaly detection

Evaluate detection coverage and deploy rules that close gaps in Google SecOps

Write and test YARA-L detection rules for Google SecOps coverage gaps

Hunt threats in Google SecOps with IoC prevalence and MITRE ATT&CK searches

Check reported email headers, links and attachments and post a risk verdict

Log every agent operation into a replayable evidence chain for security audits

Collect full-chain operation logs into traceable evidence chains for agent audits

Author and review YARA-X rules for malware detection with fewer false positives

Hunt web and application logs for threats with a hypothesis-driven loop

Apply evidence-led methods for cloud threat hunting and evidence review

Write and hunt YARA rules with conditions, modules and wildcard hex patterns

Profile threat actors with sophistication tiers and ATT&CK mapping

Query ANY.RUN threat intelligence for hashes, domains and IP indicators

Extract IOCs from reports and logs with defanging, dedupe and STIX output

Write and tune YARA and YARA-X rules from samples and run retrohunts

Look up CVE records, KEV entries and EPSS scores from a cached daily dataset

List the CISA known exploited vulnerabilities catalog to prioritize urgent patches

Analyze packet captures in Wireshark, follow streams and spot network anomalies

Deploy DOCA Argus to watch BlueField hosts and forward alerts to a SIEM

Enable a multi-region CloudTrail trail with S3 storage and CloudWatch Logs

Re-scan external assets on a schedule and alert when exposures change

Score external exposure findings into a 0-100 risk rating with dollar estimates

Build logging and detections that catch attacker behavior and cut alert noise

Analyze PCAP network captures with Python and compute traffic statistics

Run Suricata offline against PCAP files and validate alerts in eve.json

Write Suricata signatures with multi-condition deep packet inspection logic

Apply detection thresholds for port scans, DoS floods and beaconing traffic

Detect AI-generated audio, images, video and text and trace their sources