Threat Detection skills

Deploying Honeytokens and Canarytokens

mukul975

Enhance intrusion detection with decoy artifacts.

Emulating Cloud Attacks

mukul975

Validate cloud security detections with real attack simulations.

Detecting Command and Control Over DNS

mukul975

Identify C2 traffic tunneled via DNS for enhanced security.

Detecting Modbus Command Injection

mukul975

Monitor and detect Modbus command injection attacks.

Detecting Lateral Movement in Network

mukul975

Identify lateral movement techniques in enterprise networks.

Detecting DNS Exfiltration

mukul975

Identify covert data exfiltration via DNS queries.

Detecting Compromised Cloud Credentials

mukul975

Identify and respond to cloud credential threats effectively.

Implementing Dragos Platform for OT Monitoring

mukul975

Deploy and configure Dragos for OT network security.

Building Cloud SIEM with Sentinel

mukul975

Centralize threat detection across multi-cloud environments.

Detecting S3 Data Exfiltration Attempts

mukul975

Identify unauthorized S3 data access and exfiltration.

Detecting Cloud Threats with GuardDuty

mukul975

Automate AWS threat detection and response with GuardDuty.

Analyzing DNS Logs for Exfiltration

mukul975

Detect DNS-based threats to enhance cybersecurity.

Threat Detection

alirezarezvani

Proactively hunt for hidden threats in your environment.

Detecting RDP Brute Force Attacks

mukul975

Identify and analyze RDP brute force attack patterns.

Scout Explorer

ruvnet

Intelligence gathering for code and dependencies.

Detecting AWS CloudTrail Anomalies

mukul975

Identify security threats in AWS CloudTrail logs.

Implementing AWS CloudTrail log analysis for security monitoring, threat detection, and forensic investigation using Athena, CloudWatch Logs Insights, and SIEM integration to identify unauthorized access, privilege escalation, and suspicious API activity.

Triage npm packages and lockfiles for install-script malware, credential exfiltration, and worming behavior using GuardDog, manual tarball inspection, and dynamic detonation with network/filesystem monitoring. Use when vetting a new dependency, reviewing a package.json/package-lock.json during code review, checking lockfiles against a supply-chain advisory's known-bad versions, or investigating a host suspected of installing a trojanized package.

Write and deploy Falco rules with the modern eBPF driver to detect container escape, namespace abuse, privileged mounts, and anomalous syscalls at runtime in Kubernetes and Docker.

Build automated AWS GuardDuty finding response pipelines using EventBridge and Lambda to trigger real-time incident response, automatically quarantine compromised resources, and route security notifications. Use when designing automated remediation playbooks for GuardDuty findings across VPC Flow Logs, CloudTrail, DNS, EKS, or S3 data events, or when reducing mean time to respond to cloud threats.

Deploys and configures CrowdStrike Falcon EDR agents across enterprise endpoints to enable real-time threat detection, behavioral analysis, and automated response. Use when onboarding endpoints to EDR coverage, configuring detection policies, or integrating Falcon telemetry with SIEM platforms. Activates for requests involving CrowdStrike deployment, Falcon sensor installation, EDR policy configuration, or endpoint detection and response.

Build effective detection rules using Splunk Search Processing Language (SPL) correlation searches to identify security threats in SOC environments.

Parses Kubernetes API server audit logs (JSON lines) to detect exec-into-pod, secret access, RBAC modifications, privileged pod creation, and anonymous API access. Builds threat detection rules from audit event patterns. Use when investigating Kubernetes cluster compromise or building k8s-specific SIEM detection rules.