Incident Response

Rebuild sessions and extract files from PCAPs with Wireshark and tshark

Analyze PCAP files with Wireshark, tshark and tcpdump to find exfiltration and C2

Work through ransomware containment, forensics, backup checks and recovery steps

Plan ransomware tabletop drills with realistic injects and score team responses

Run discussion-based SOC tabletop exercises to test incident response playbooks

Recover deleted SQLite records from freelist pages and WAL files for forensic cases

Detect hidden data in images and audio with StegDetect, zsteg and binwalk

Build forensic super-timelines from file, log and registry artifacts with Plaso

Parse Windows registry, prefetch and event logs with the Eric Zimmerman EZ Tools

Carve deleted files from disk images with PhotoRec when file systems are damaged

Restore systems after ransomware with isolation, clean rebuilds and verified backups

Test backup restores and RTO and RPO targets to prove ransomware recovery works

Classify and prioritize incidents with NIST 800-61 and PICERL, then route them

Classify incidents with IR playbooks and route them through Splunk or TheHive

Collect Windows forensic artifacts with KAPE targets and parse them with EZ Tools

Validate backup integrity with hash checks and automated restore tests

Classify security incidents, triage alerts and collect forensic evidence

Manage Google SecOps SOAR cases, comments and alert grouping

Investigate Google SecOps incidents, entities and lateral movement with UDM

Triage Google SecOps alerts and separate false positives from true threats

Scope an alert or indicator across logs and verify whether an attack succeeded

Validate Sigma and YARA rules against memory dumps and event logs with Volatility

Apply evidence-led methods for digital forensics work and evidence review

Analyze Android APK malware with jadx, Frida and MobSF

Analyze .NET malware with dnSpy, ILSpy and config decryption

Detect and analyze in-memory malware like reflective DLLs and WMI persistence

Triage malware statically and dynamically with a verdict in fifteen minutes

Analyze ransomware families, key recovery and shadow copy inhibition

Detect and analyze rootkits including UEFI, kernel and bootkit variants

Run a four-agent pipeline that scans nginx, auth and syslog files for threats

Analyze disk, memory, network and log evidence in CTF forensics challenges

Analyze obfuscated scripts, C2 traffic and malware samples in CTF challenges

Analyze memory dumps with Volatility 2 and 3 for malware, credentials and timelines

Analyze PCAP captures with Wireshark and tshark for protocols and covert channels

Run a security incident from triage and containment through the review

Inspect PCAP captures and pull protocol details quickly with tshark

Triage malware with sandbox, static and behavioral analysis and extract IOCs

Extract C2 addresses, profiles and watermarks from captured Cobalt Strike beacons

Map disk forensics artifacts and anti-forensics methods from both sides

Investigate a suspected compromised Linux or Windows host for backdoors and rootkits

Analyze suspicious PE, ELF and Mach-O binaries statically and dynamically

Analyze memory dumps with Volatility3 and review memory evasion techniques

Investigate GitHub repos for deleted commits, force pushes and supply chain tampering

Run security incident playbooks from detection through containment and recovery

Report security incidents from agent tooling to a shared community effort