Database

Forensic log retention assessment, evidence preservation, and attack traceability

IR handoff quality assessment, playbook review, and communication evaluation

SIEM coverage assessment, log source gaps, and detection blind spot analysis

Proactive threat hunting methodology with hypothesis-driven search techniques

Container image hygiene, Kubernetes RBAC, and pod security assessment

EDR and antivirus coverage gap analysis and blind spot detection

Local privilege escalation testing including SUID, sudo abuse, and service misconfiguration

OS hardening assessment for Linux and Windows systems against CIS benchmarks

Cron job and scheduled task abuse risk assessment and service hijacking

Software inventory anomaly detection, shadow IT discovery, and EOL software identification

Exploitability confirmation and false positive reduction methodology

Impact verification, blast radius estimation, and business consequence assessment

Controlled proof-of-concept execution and safe vulnerability validation

Post-exploitation risk mapping including pivot paths and persistence mechanisms

CVE matching, version risk analysis, and misconfiguration detection methodology

Active Directory trust review, Kerberos assessment, and delegation risk analysis for authorized assessments

IAM policy analysis and least privilege assessment for authorized security assessments

MFA coverage assessment and bypass risk detection for authorized security assessments

Privilege escalation path detection in cloud and enterprise environments for authorized assessments

Role trust boundaries, cross-account access, and federation security review for authorized assessments

Secret sprawl detection, key rotation assessment, and vault configuration review for authorized assessments

Alias clustering, language patterns, infrastructure reuse, and confidence-rated attribution

P2P abuse monitoring, wallet-linked fraud, smart contract risk, and cross-platform correlation

Correlate domains, certificates, IPs, and ASNs across adversary campaigns

Transform raw security alerts into actor hypotheses, motives, next steps, and containment guidance

Merge public web, breach data, passive DNS, social graph, and code repository intelligence

Endpoint visibility gap analysis, rogue device detection, and EDR coverage assessment for internal networks

Lateral movement path analysis, credential relay, and pivot detection for authorized internal network assessments

Legacy protocol risk assessment for SMBv1, LLMNR, NetBIOS, Telnet, and other deprecated services

Network segmentation validation, VLAN hopping, firewall rule review, and micro-segmentation testing

Domain trust enumeration, shared service abuse, and cross-boundary attack path analysis for authorized assessments

App transport security assessment, certificate pinning validation, HSTS enforcement, and TLS configuration review

Mobile local storage security review, keychain/keystore assessment, and sensitive data exposure detection

Mobile API interception, proxy configuration, request manipulation, and backend API security testing

APK and IPA decompilation, binary analysis, obfuscation review, and tampering detection assessment

Mobile token persistence analysis, session management review, and authentication state security

Host availability detection and network segmentation mapping for authorized security assessments

Exposure validation and firewall rule assessment for authorized security assessments

Port discovery and service detection with nmap for authorized security assessments

Protocol fingerprinting and unusual service detection for authorized security assessments

Packet capture interpretation, cleartext detection, and traffic analysis with tcpdump and Wireshark

Secure tunneling validation, proxy path review, and VPN configuration checks for authorized assessments

Credential attack techniques for authorized assessments including password spraying, Kerberoasting, NTLM relay, and credential dumping

Testing detection coverage through AMSI bypass, process injection, and living-off-the-land techniques for detection validation

Initial access techniques for authorized penetration tests including phishing, exposed services, and credential attacks

Lateral movement techniques for authorized assessments including pass-the-hash, WMI, PSExec, and RDP pivoting

Custom payload development for authorized assessments including AV/EDR testing and C2 framework usage

Persistence mechanism testing for authorized assessments covering scheduled tasks, registry keys, services, and DLL side-loading

Windows and Linux privilege escalation techniques for authorized penetration testing including kernel exploits, misconfigurations, and token abuse

Active Directory attack path analysis using BloodHound, Certify, and Rubeus for authorized security assessments

Attack infrastructure setup including redirectors, domain fronting assessment, and phishing infrastructure for authorized engagements

Command and control framework setup and operation for authorized penetration tests with OPSEC considerations

Cloud exploitation techniques for authorized assessments covering metadata abuse, SSRF to cloud, and IAM role assumption

Client debrief methodology, remediation validation, retest procedures, and knowledge transfer for penetration testing engagements

Professional penetration test report writing covering executive summary, technical findings, risk ratings, and remediation guidance

Rules of engagement definition, scope documentation, authorization validation, and legal compliance for penetration testing

External network penetration testing methodology aligned with PTES for authorized security assessments

Internal network penetration testing and assumed breach methodology for authorized security assessments

Physical penetration testing methodology including access control bypass, tailgating assessment, and social engineering for authorized engagements

Purple team exercise methodology for cooperative adversary simulation and detection validation in authorized engagements