Threat Detection

Build an OpenCTI pipeline that enriches IOCs with VirusTotal, Shodan and GreyNoise data

Design a SOC escalation matrix with severity tiers, response SLAs and notification paths

Track SOC KPIs like MTTD, MTTR and alert quality from SIEM data in dashboards

Profile threat actors from OSINT with Maltego and SpiderFoot into structured dossiers

Deploy MISP with abuse.ch and OTX feeds to aggregate and share threat intelligence

Turn threat intel and ATT&CK gaps into testable threat hunt hypotheses and reports

Feed threat intel into Splunk ES lookups to enrich correlation searches

Connect STIX/TAXII and open-source threat feeds to SIEM tools for live IOC matching

Stand up a threat intelligence platform with MISP, OpenCTI, TheHive and Cortex

Gather OSINT on threat actors and malicious infrastructure with passive recon tools

Pull threat feeds into MISP with PyMISP to fetch, add and search IOCs

Deploy Wazuh, OSSEC or AIDE for file integrity monitoring and host intrusion detection

Deploy Snort 3 with custom rules, preprocessors and tuning to catch network attacks

Deploy Suricata IDS and IPS with Emerging Threats rules and EVE JSON logging

Harden Windows endpoints with Defender attack surface rules and exploit protection

Enable Windows audit policies for logon, process and object events to feed SIEM rules

Write IBM QRadar AQL queries and correlation rules to catch multi-stage attacks

Link incidents and IOCs across time and organizations into unified threat campaigns

Deploy honeytokens in Active Directory like fake admins and honeyroasting SPNs

Deploy canary IAM keys, decoy buckets and honey resources across AWS, Azure and GCP

Deploy decoy files that alert when ransomware encrypts or modifies them

Deploy CrowdStrike Falcon EDR agents and detection policies across enterprise endpoints

Plant Canarytokens for honey credentials, DNS and AWS keys that alert when touched

Monitor endpoints with osquery SQL for processes, ports, software and configuration

Watch decoy files with Python watchdog and alert on any read, change or delete

Plan adversary engagement operations with MITRE Engage to guide deliberate deception

Detect anomalies in OT and ICS networks from Modbus, DNP3 and OPC UA traffic

Detect impossible travel, password spraying and credential stuffing with UEBA baselines

Catch BOLA and IDOR enumeration with SIEM rules on API gateway and WAF logs

Spot ARP poisoning with ARPWatch, DAI and scripts that flag IP-to-MAC changes

Detect tampering and unauthorized queries against OT historian servers like PI

Spot PLC command injection, HMI compromise and DoS attacks against SCADA systems

Flag unusual AWS API calls in CloudTrail with boto3 baselines and behavior analysis

Hunt lateral movement in Entra ID with Graph audit logs, KQL and sign-in correlation

Catch Azure service principal abuse via new credentials, role grants and consent bypass

Detect C2 beaconing in Zeek conn logs using interval jitter and standard deviation

Catch BEC fraud with email gateway rules, behavior analytics and payment checks

Flag business email compromise with NLP on writing style and context anomalies

Set up Amazon GuardDuty protection plans and triage findings with EventBridge automation

Detect DNS tunneling C2 with entropy checks, DGA classifiers and Zeek signatures

Spot compromised cloud credentials from impossible travel and anomalous API activity

Catch containers drifting from their image with Falco and Defender runtime rules

Write Falco rules with conditions, macros and lists to catch container escapes

Deploy Falco with the eBPF driver in Kubernetes and Docker to catch runtime threats

Catch LSASS dumps, SAM extraction and NTDS.dit theft with Sysmon event 10 and SIEM rules

Detect DCSync by auditing Event ID 4662 for replication rights abused by non-DCs

Detect deepfake audio in vishing calls using spectral features and ML classifiers

Spot DLL side-loading by checking Sysmon DLL loads, signatures and path anomalies

Detect unauthorized control commands and firmware writes in DNP3 SCADA traffic