#devsecops
39 resources
Results
- abusing-dpapi-for-credential-access
After compromising a Windows host where the user has saved RDP, browser, or vault credentials worth harvesting for lateral movement.
- abusing-shadow-credentials-for-privesc
Take over Active Directory accounts by writing attacker-controlled public keys to msDS-KeyCredentialLink (Shadow Credentials) with pyWhisker, Whisker, or…
- achieving-cmmc-level-2-compliance
Prepare a defense-contractor environment for CMMC Level 2 certification: scope CUI and FCI, implement the 110 NIST SP 800-171 Rev 2 security requirements…
- acquiring-disk-image-with-dd-and-dcfldd
Create forensically sound bit-for-bit disk images with dd or dcfldd on a Linux forensic workstation, preserving evidence integrity through hash…
- analyzing-apt-group-with-mitre-navigator
When investigating security incidents that require analyzing apt group with mitre navigator - When building detection rules or threat…
- analyzing-bootkit-and-rootkit-samples
Analyzes bootkit and advanced rootkit malware infecting the Master Boot Record (MBR), Volume Boot Record (VBR), or UEFI firmware for below-OS persistence,…
- analyzing-browser-forensics-with-hindsight
When investigating security incidents that require analyzing browser forensics with hindsight - When building detection rules or threat…
- analyzing-campaign-attribution-evidence
Systematically evaluate cyber-campaign evidence to attribute an operation to a threat actor, using the Diamond Model and Analysis of Competing Hypotheses…
- analyzing-certificate-transparency-for-phishing
When investigating security incidents that require analyzing certificate transparency for phishing - When building detection rules or…
- analyzing-cobalt-strike-beacon-configuration
When investigating security incidents that require analyzing cobalt strike beacon configuration - When building detection rules or threat…
- analyzing-command-and-control-communication
Reverse engineering a malware sample has revealed network communication that needs protocol analysis - Building network-level detection…
- analyzing-cyber-kill-chain
Analyzes intrusion activity against the Lockheed Martin Cyber Kill Chain framework to identify which phases an adversary has completed, where defenses…
- analyzing-disk-image-with-autopsy
Perform comprehensive forensic analysis of raw (dd), E01, or AFF disk images with Autopsy and The Sleuth Kit, recovering deleted files, examining metadata…
- analyzing-dns-logs-for-exfiltration
Analyzes DNS query logs to detect data exfiltration via DNS tunneling, DGA domain communication, and covert C2 channels using entropy analysis, query…
- analyzing-email-headers-for-phishing-investigation
Parse and analyze email headers (Received chain, Return-Path, Message-ID) to trace the true origin of a phishing email and validate SPF, DKIM, and DMARC…
- analyzing-golang-malware-with-ghidra
Reverse engineer Go-compiled malware in Ghidra by parsing Go buildinfo and pclntab structures, recovering stripped/obfuscated function names (e.g.
- analyzing-indicators-of-compromise
Analyzes indicators of compromise (IOCs) including IP addresses, domains, file hashes, URLs, and email artifacts to determine maliciousness confidence,…
- analyzing-ios-app-security-with-objection
Runtime iOS app security testing with Objection (Frida): inspect keychain and filesystem data, explore app internals at runtime, and validate/bypass…
- analyzing-linux-elf-malware
Analyze malicious Linux ELF binaries — botnets, cryptominers, ransomware, and rootkits targeting Linux servers, containers, and cloud infrastructure —…
- analyzing-linux-kernel-rootkits
When investigating security incidents that require analyzing linux kernel rootkits - When building detection rules or threat hunting…
- analyzing-lnk-file-and-jump-list-artifacts
Analyze Windows LNK shortcut files and Jump List artifacts with LECmd, JLECmd, and manual Shell Link Binary Format parsing to establish evidence of file…
- analyzing-malicious-pdf-with-peepdf
Perform static analysis of malicious PDF documents using peepdf, pdfid, and pdf-parser to extract embedded JavaScript, shellcode, and suspicious objects.
- analyzing-malicious-url-with-urlscan
When investigating security incidents that require analyzing malicious url with urlscan - When building detection rules or threat hunting…
- analyzing-malware-behavior-with-cuckoo-sandbox
Detonate malware samples in Cuckoo Sandbox to observe runtime behavior — process creation, file system and registry changes, network communications, and…
- analyzing-malware-family-relationships-with-malpedia
Query the Malpedia API to look up malware family aliases and naming (platform.family_name), pull community/vendor YARA rules, link families to threat…
- web-app-security
End-to-end security program for a web app — scope/authorization gate, frontend exposure reduction, API security (IDOR/BOLA, brute force,…
- ~aod-build
Generate standardized checkpoint reports for multi-phase implementation projects.
- ~aod-deliver
Structured delivery retrospective for the AOD Lifecycle's Deliver stage.
- ~aod-run
Full lifecycle orchestrator that chains all 6 AOD stages (Discover, Define, Plan, Build, Deliver, Document) with disk-persisted state for session…
- code-execution-helper
Guide for using code execution capabilities to perform parallel batch processing, conditional filtering, and data aggregation.
- tachi-control-analysis
Domain knowledge for compensating controls analysis — control category definitions with detection patterns, evidence criteria with…
- tachi-infographics
Domain knowledge for threat infographic generation — infographic specification formats, template-specific section layouts (Baseball Card,…
- tachi-orchestration
Domain knowledge for the tachi orchestrator agent: input format detection, DFD classification, trust boundary notation, STRIDE-per-Element…
- tachi-risk-scoring
Domain knowledge for quantitative risk scoring — four-dimensional scoring model (CVSS 3.1, exploitability, scalability, reachability), CVSS…
- tachi-shared
Shared reference files consumed by multiple tachi agents.
- tachi-threat-reporting
Domain knowledge for narrative threat report generation — executive summary structure, architecture overview patterns, per-category…
- guard
Open-source antivirus for AI agents: block risky tools, secret access, prompt injection, malicious packages, MCP servers, plugins, and…
- tachi-report-assembly
Domain knowledge for PDF security report assembly — artifact detection patterns with tier selection rules, Typst data variable contract…
- supabase-security
A pure-Node.js audit + remediation toolkit for Supabase projects.
