mukul975
@mukul975
Public Skills
analyzing-cyber-kill-chain
by mukul975
'Analyzes intrusion activity against the Lockheed Martin Cyber Kill Chain framework to identify which phases
analyzing-malicious-pdf-with-peepdf
by mukul975
Perform static analysis of malicious PDF documents using peepdf, pdfid, and pdf-parser to extract embedded JavaScript,
analyzing-heap-spray-exploitation
by mukul975
Detect and analyze heap spray attacks in memory dumps using Volatility3 plugins to identify NOP sled patterns,
analyzing-disk-image-with-autopsy
by mukul975
Perform comprehensive forensic analysis of disk images using Autopsy to recover files, examine artifacts, and
analyzing-network-traffic-with-wireshark
by mukul975
'Captures and analyzes network packet data using Wireshark and tshark to identify malicious traffic patterns,
analyzing-network-packets-with-scapy
by mukul975
Craft, send, sniff, and dissect network packets using Scapy for protocol analysis, network reconnaissance, and
analyzing-active-directory-acl-abuse
by mukul975
Detect dangerous ACL misconfigurations in Active Directory using ldap3 to identify GenericAll, WriteDACL, and
analyzing-email-headers-for-phishing-investigation
by mukul975
Parse and analyze email headers to trace the origin of phishing emails, verify sender authenticity, and identify
analyzing-cobalt-strike-beacon-configuration
by mukul975
Extract and analyze Cobalt Strike beacon configuration from PE files and memory dumps to identify C2 infrastructure,
analyzing-cobaltstrike-malleable-c2-profiles
by mukul975
Parse and analyze Cobalt Strike Malleable C2 profiles using dissect.cobaltstrike and pyMalleableC2 to extract
acquiring-disk-image-with-dd-and-dcfldd
by mukul975
Create forensically sound bit-for-bit disk images using dd and dcfldd while preserving evidence integrity through
analyzing-memory-dumps-with-volatility
by mukul975
'Analyzes RAM memory dumps from compromised systems using the Volatility framework to identify malicious processes,
analyzing-network-traffic-of-malware
by mukul975
'Analyzes network traffic generated by malware during sandbox execution or live incident response to identify
analyzing-kubernetes-audit-logs
by mukul975
'Parses Kubernetes API server audit logs (JSON lines) to detect exec-into-pod, secret access, RBAC modifications,
analyzing-network-covert-channels-in-malware
by mukul975
Detect and analyze covert communication channels used by malware including DNS tunneling, ICMP exfiltration,
analyzing-windows-registry-for-artifacts
by mukul975
Extract and analyze Windows Registry hives to uncover user activity, installed software, autostart entries, and evidence of system compromise.
analyzing-slack-space-and-file-system-artifacts
by mukul975
Examine file system slack space, MFT entries, USN journal, and alternate data streams to recover hidden data and reconstruct file activity on NTFS volumes.
analyzing-windows-lnk-files-for-artifacts
by mukul975
Parse Windows LNK shortcut files to extract target paths, timestamps, volume information, and machine identifiers for forensic timeline reconstruction.
auditing-aws-s3-bucket-permissions
by mukul975
Systematically audit AWS S3 bucket permissions to identify publicly accessible buckets, overly permissive ACLs, misconfigured bucket policies, and missing encryption settings using AWS CLI, S3audit, and Prowler to enforce least-privilege data access controls.
analyzing-golang-malware-with-ghidra
by mukul975
Reverse engineer Go-compiled malware using Ghidra with specialized scripts for function recovery, string extraction, and type reconstruction in stripped Go binaries.
analyzing-command-and-control-communication
by mukul975
Analyzes malware command-and-control (C2) communication protocols to understand beacon patterns, command structures, data encoding, and infrastructure. Covers HTTP, HTTPS, DNS, and custom protocol C2 analysis for detection development and threat intelligence. Activates for requests involving C2 analysis, beacon detection, C2 protocol reverse engineering, or command-and-control infrastructure mapping.
analyzing-linux-elf-malware
by mukul975
Analyzes malicious Linux ELF (Executable and Linkable Format) binaries including botnets, cryptominers, ransomware, and rootkits targeting Linux servers, containers, and cloud infrastructure. Covers static analysis, dynamic tracing, and reverse engineering of x86_64 and ARM ELF samples. Activates for requests involving Linux malware analysis, ELF binary investigation, Linux server compromise assessment, or container malware analysis.
analyzing-threat-intelligence-feeds
by mukul975
Analyzes structured and unstructured threat intelligence feeds to extract actionable indicators, adversary tactics, and campaign context. Use when ingesting commercial or open-source CTI feeds, evaluating feed quality, normalizing data into STIX 2.1 format, or enriching existing IOCs with campaign attribution. Activates for requests involving ThreatConnect, Recorded Future, Mandiant Advantage, MISP, AlienVault OTX, or automated feed aggregation pipelines.
auditing-azure-active-directory-configuration
by mukul975
Auditing Microsoft Entra ID (Azure Active Directory) configuration to identify risky authentication policies, overly permissive role assignments, stale accounts, conditional access gaps, and guest user risks using AzureAD PowerShell, Microsoft Graph API, and ScoutSuite.