Detection and response for the LiteLLM AI gateway under two linked threats: CVE-2026-42271, an authenticated command injection in the MCP stdio preview endpoints…
Detection, hunting, and hardening for malicious file upload, where an attacker abuses an upload feature to plant a web shell or polyglot file under a web-accessible path and then…
Detection and response for unauthenticated SQL injection in self-hosted Metabase (CVE-2026-72898, CWE-89, CVSS 10.0) via the /api/session/reset_password endpoint, which returns…
Detects whether a user task contains multiple independent subtasks and splits it into a JSON array. Internal helper for orchestrate Phase 0.5; uses session credentials (no API…
Endpoint detection and hunting for post-exploitation of the August 2026 N-able N-central authentication bypasses (CVE-2026-18556, CVE-2026-18577, both in CISA KEV), for SMBs whose…
Detection and response methodology for OAuth consent phishing / illicit consent grants in Microsoft 365 and Entra ID (MITRE ATT&CK T1528).
Detection, hunting, and hardening methodology for phishing as initial and credential access: credential-harvest and attacker-in-the-middle (AiTM) link lures, malicious…
Purple-team detection coverage for a full red team or adversary-simulation engagement lifecycle, from resource development and C2 infrastructure through evasion, collection, and…
Detection and response for HTTP request smuggling (HTTP desync) against front-end/back-end chains: CL.TE, TE.CL, TE.TE and HTTP/2 downgrade variants H2.CL / H2.TE, where a proxy…
Detection and response methodology for rogue and evil-twin wireless access points, where an attacker stands up an unauthorized AP impersonating a trusted SSID (or plants one on…
Detection and hunting methodology for shellcode injection and in-memory execution: CreateRemoteThread injection, PE and DLL injection, process hollowing, thread execution…
Detection and response methodology for Server-Side Request Forgery (SSRF), where a public-facing application is coerced into making attacker-controlled requests, most dangerously…
Detection and response for supply-chain compromise: a poisoned software package or tampered build artifact that executes on install (MITRE ATT&CK T1195.002, T1546 for .pth /…
Detection and hardening methodology for TOCTOU (time-of-check to time-of-use) file race conditions used for local privilege escalation, where an attacker swaps a symlink,…
Detection and hunting methodology for web application race conditions: limit-overrun, multi-endpoint, single-endpoint, and time-sensitive flaws abused with last-byte-sync…
Overview detection methodology for the 802.11 attack family: evil-twin and rogue APs, deauth floods, handshake and PMKID capture for offline PSK cracking, rogue-RADIUS against…
Detection and hardening methodology for Windows local privilege escalation via access-token manipulation, weak or hijackable services, and UAC bypass (MITRE ATT&CK T1134,…
Detection, hunting, and hardening methodology for Cross-Site Scripting (XSS), where attacker-controlled script executes in a victim's browser session on a trusted origin (CWE-79;…
Detects prompt injection attacks targeting LLM-based applications using a multi-layered defense combining regex
Detect and prevent API enumeration attacks including BOLA and IDOR exploitation by monitoring sequential identifier
Detects arbitrary read vulnerabilities by identifying unchecked array indexing and out-of-bounds memory access.
Detects arbitrary write vulnerabilities by identifying unchecked array indexing and out-of-bounds memory writes.
Detect and prevent ARP spoofing attacks using ARPWatch, Dynamic ARP Inspection, Wireshark analysis, and custom
Detect cyber attacks targeting OT historian servers (OSIsoft PI, Ignition, Wonderware) that sit at the IT/OT
Detects and analyzes Bluetooth Low Energy (BLE) security attacks including sniffing, replay attacks, GATT enumeration
Detect and test for OWASP API3:2023 Broken Object Property Level Authorization vulnerabilities including excessive
Detects stack and heap buffer overflow vulnerabilities in binary code by identifying unsafe memory operations.
Business Email Compromise (BEC) is a sophisticated fraud scheme where attackers impersonate executives, vendors,
Deploy AI and NLP-powered detection systems to identify business email compromise attacks by analyzing writing
Detects OS command injection vulnerabilities by identifying unsafe system/popen/exec calls with user-controlled input.
Detecting compromised cloud credentials across AWS, Azure, and GCP by analyzing anomalous API activity, impossible
Container escape is a critical attack technique where an adversary breaks out of container isolation to access
Detect container escape attempts in real-time using Falco runtime security rules that monitor syscalls, file
Write and deploy Falco rules with the modern eBPF driver to detect container escape, namespace abuse, privileged mounts, and anomalous syscalls at runtime in Kubernetes and Docker.
Detect DCSync attacks where adversaries abuse Active Directory replication privileges to extract password hashes
Detects AI-generated deepfake audio used in voice phishing (vishing) attacks by extracting spectral features
Detect and prevent dependency confusion (public-over-private package name resolution) in npm, PyPI, and Maven by enumerating claimable internal package names with tools like…
Detect DLL side-loading attacks where adversaries place malicious DLLs alongside legitimate applications to hijack
Detects double free vulnerabilities by identifying attempts to free the same memory block twice. Use when analyzing memory management, cleanup paths, or investigating heap…
Detect malicious email forwarding rules created by adversaries to maintain persistent access to email communications
Detects fileless malware and in-memory attacks that execute entirely in RAM without writing persistent files
Detects and analyzes fileless malware that operates entirely in memory using PowerShell, WMI, .NET reflection,
Detects format string vulnerabilities by identifying unsafe printf family function calls with user-controlled format strings.
Detect Golden Ticket attacks in Active Directory by analyzing Kerberos TGT anomalies including mismatched encryption
Detect Kerberos Golden Ticket forgery by analyzing Windows Event ID 4769 for RC4 encryption downgrades (0x17),
Detects information disclosure vulnerabilities including sensitive data in logs, error message exposure, and memory leaks.
Detects various injection vulnerabilities including SQL injection, LDAP injection, XPath injection, and code injection.
Detect insider threat behavioral indicators including unusual data access, off-hours activity, mass file downloads,
Implement User and Entity Behavior Analytics using Elasticsearch/OpenSearch to build behavioral baselines, calculate
Detects integer overflow and underflow vulnerabilities in arithmetic operations used for buffer sizing or allocation.
Detect Kerberoasting attacks by monitoring for anomalous Kerberos TGS requests targeting service accounts with
Detect adversary lateral movement across networks using Splunk SPL queries against Windows authentication logs,
Detect abuse of legitimate Windows binaries (LOLBins) used for living off the land attacks. Monitors process
Detects logic bypass vulnerabilities including authentication bypass, authorization bypass, and business logic flaws.
Detects various memory corruption vulnerabilities beyond simple buffer overflows including heap overflow, stack smashing, and double free.
Detects and analyzes malicious behavior in mobile applications through behavioral analysis, permission abuse
Detect command injection attacks against Modbus TCP/RTU protocol in ICS environments by monitoring for unauthorized
Detect model stealing, model inversion, and membership inference performed through inference-API abuse by monitoring query patterns, applying output perturbation, and red-teaming…
Deploys and configures Zeek (formerly Bro) network security monitor to passively analyze network traffic, generate
Detect network reconnaissance and port scanning using Suricata and Snort IDS signatures, threshold-based detection