Improper Validation of Certificate with Host Mismatch vulnerability in Apache Thrift. This issue affects Apache Thrift: before 0.23.0. Users are recommended to upgrade to version 0.23.0, which fixes the issue.
Casky was already ahead
This CVE exploits attack patterns that Casky's 519matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.
CVE-2026-41603 represents a critical flaw in Apache Thrift's SSL/TLS certificate validation logic, where the platform fails to properly verify that a certificate's hostname matches the target host. This vulnerability (CWE-297: Improper Validation of Certificate with Host Mismatch) enables attackers to conduct man-in-the-middle (MITM) attacks against Thrift-based services, potentially intercepting, modifying, or eavesdropping on sensitive communications. Any organization deploying Apache Thrift versions prior to 0.23.0 for inter-service communication, microservices architectures, or RPC frameworks is at risk. The lack of proper certificate validation means attackers positioned on the network path can present fraudulent certificates that would normally be rejected, undermining the entire trust model of encrypted communications.
Casky's skill-mapping to MITRE ATT&CK techniques T1040 (Traffic Capture/Sniffing) and T1078 (Valid Accounts) reveals how practitioners would detect exploitation patterns. When analyzing network traffic and authentication flows through Casky's 754 mapped skills, extended reasoning would identify anomalies such as unexpected certificate chains, mismatched CN/SAN fields in captured TLS handshakes, or successful authentication following suspicious network routing. Security teams would observe in their findings that connections to legitimate Thrift services are being intercepted at the network layer without triggering certificate validation errors—a hallmark sign of this vulnerability being exploited. Immediate action includes upgrading to 0.23.0 and reviewing TLS logs for evidence of invalid certificates that were accepted during the vulnerable window.
Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →
These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-41603.
Casky has 519 skills that investigate the attack patterns behind CVE-2026-41603. Run one and get CVSS-scored findings in 3 minutes.
Run the skill that detects this →analyzing-bootkit-and-rootkit-samples
malware analysis · medium
analyzing-browser-forensics-with-hindsight
digital forensics · low
analyzing-campaign-attribution-evidence
threat intelligence · low
analyzing-certificate-transparency-for-phishing
threat intelligence · low
analyzing-cloud-storage-access-patterns
cloud security · low
analyzing-cobalt-strike-beacon-configuration
malware analysis · medium
analyzing-cobaltstrike-malleable-c2-profiles
malware analysis · medium
analyzing-command-and-control-communication
malware analysis · medium
analyzing-cyber-kill-chain
threat intelligence · low
analyzing-disk-image-with-autopsy
digital forensics · low
analyzing-dns-logs-for-exfiltration
soc operations · low
analyzing-docker-container-forensics
digital forensics · low
analyzing-email-headers-for-phishing-investigation
digital forensics · low
analyzing-golang-malware-with-ghidra
malware analysis · medium
analyzing-heap-spray-exploitation
malware analysis · medium
analyzing-indicators-of-compromise
threat intelligence · low
analyzing-kubernetes-audit-logs
container security · low
analyzing-linux-elf-malware
malware analysis · medium
analyzing-linux-kernel-rootkits
digital forensics · low
analyzing-linux-system-artifacts
digital forensics · low
analyzing-lnk-file-and-jump-list-artifacts
digital forensics · low
analyzing-macro-malware-in-office-documents
malware analysis · medium
analyzing-malicious-pdf-with-peepdf
malware analysis · medium
analyzing-malicious-url-with-urlscan
phishing defense · medium
analyzing-malware-behavior-with-cuckoo-sandbox
malware analysis · medium
analyzing-malware-family-relationships-with-malpedia
threat intelligence · low
analyzing-malware-persistence-with-autoruns
malware analysis · medium
analyzing-malware-sandbox-evasion-techniques
malware analysis · medium
analyzing-memory-dumps-with-volatility
malware analysis · medium
analyzing-mft-for-deleted-file-recovery
digital forensics · low
analyzing-network-covert-channels-in-malware
malware analysis · medium
analyzing-network-flow-data-with-netflow
network security · medium
analyzing-network-packets-with-scapy
network security · medium
analyzing-network-traffic-of-malware
malware analysis · medium
analyzing-network-traffic-with-wireshark
network security · medium
analyzing-office365-audit-logs-for-compromise
cloud security · low
analyzing-outlook-pst-for-email-forensics
digital forensics · low
analyzing-packed-malware-with-upx-unpacker
malware analysis · medium
analyzing-pdf-malware-with-pdfid
malware analysis · medium
analyzing-persistence-mechanisms-in-linux
threat hunting · low
analyzing-powershell-empire-artifacts
threat hunting · low
analyzing-prefetch-files-for-execution-history
digital forensics · low
analyzing-ransomware-encryption-mechanisms
malware analysis · medium
analyzing-ransomware-leak-site-intelligence
threat intelligence · low
analyzing-ransomware-network-indicators
threat hunting · low
analyzing-slack-space-and-file-system-artifacts
digital forensics · low
analyzing-supply-chain-malware-artifacts
malware analysis · medium
analyzing-threat-actor-ttps-with-mitre-attack
threat intelligence · low
analyzing-threat-actor-ttps-with-mitre-navigator
threat intelligence · low
analyzing-threat-intelligence-feeds
threat intelligence · low
analyzing-threat-landscape-with-misp
threat intelligence · low
analyzing-typosquatting-domains-with-dnstwist
threat intelligence · low
analyzing-usb-device-connection-history
digital forensics · low
analyzing-windows-amcache-artifacts
digital forensics · low
analyzing-windows-event-logs-in-splunk
soc operations · low
analyzing-windows-lnk-files-for-artifacts
digital forensics · low
analyzing-windows-prefetch-with-python
digital forensics · low
analyzing-windows-registry-for-artifacts
digital forensics · low
analyzing-windows-shellbag-artifacts
digital forensics · low
auditing-aws-s3-bucket-permissions
cloud security · low
auditing-azure-active-directory-configuration
cloud security · low
auditing-cloud-with-cis-benchmarks
cloud security · low
auditing-gcp-iam-permissions
cloud security · low
auditing-kubernetes-cluster-rbac
cloud security · low
auditing-terraform-infrastructure-for-security
cloud security · low
auditing-tls-certificate-transparency-logs
threat intelligence · low
automating-ioc-enrichment
threat intelligence · low
building-adversary-infrastructure-tracking-system
threat intelligence · low
building-attack-pattern-library-from-cti-reports
threat intelligence · low
building-automated-malware-submission-pipeline
soc operations · low
building-c2-infrastructure-with-sliver-framework
red teaming · high
building-cloud-siem-with-sentinel
cloud security · low
building-detection-rule-with-splunk-spl
soc operations · low
building-detection-rules-with-sigma
soc operations · low
building-identity-federation-with-saml-azure-ad
identity access management · low
building-identity-governance-lifecycle-process
identity access management · low
building-incident-response-dashboard
soc operations · low
building-ioc-defanging-and-sharing-pipeline
threat intelligence · low
building-ioc-enrichment-pipeline-with-opencti
threat intelligence · low
building-phishing-reporting-button-workflow
phishing defense · medium
building-red-team-c2-infrastructure-with-havoc
red teaming · high
building-role-mining-for-rbac-optimization
identity access management · low
building-soc-escalation-matrix
soc operations · low
building-soc-metrics-and-kpi-tracking
soc operations · low
building-soc-playbook-for-ransomware
soc operations · low
building-threat-actor-profile-from-osint
threat intelligence · low
building-threat-feed-aggregation-with-misp
threat intelligence · low
building-threat-hunt-hypothesis-framework
threat hunting · low
building-threat-intelligence-enrichment-in-splunk
soc operations · low
building-threat-intelligence-feed-integration
soc operations · low
building-threat-intelligence-platform
threat intelligence · low
building-vulnerability-scanning-workflow
soc operations · low
collecting-open-source-intelligence
threat intelligence · low
collecting-threat-intelligence-with-misp
threat intelligence · low
conducting-api-security-testing
penetration testing · medium
conducting-cloud-penetration-testing
cloud security · low
conducting-domain-persistence-with-dcsync
red teaming · high
conducting-external-reconnaissance-with-osint
penetration testing · medium
conducting-full-scope-red-team-engagement
red teaming · high
conducting-internal-network-penetration-test
penetration testing · medium
conducting-internal-reconnaissance-with-bloodhound-ce
red teaming · high
conducting-man-in-the-middle-attack-simulation
network security · medium
conducting-mobile-app-penetration-test
penetration testing · medium
conducting-network-penetration-test
penetration testing · medium
conducting-pass-the-ticket-attack
red teaming · high
conducting-social-engineering-penetration-test
penetration testing · medium
conducting-social-engineering-pretext-call
red teaming · high
conducting-spearphishing-simulation-campaign
red teaming · high
conducting-wireless-network-penetration-test
penetration testing · medium
configuring-active-directory-tiered-model
identity access management · low
configuring-aws-verified-access-for-ztna
zero trust architecture · low
configuring-certificate-authority-with-openssl
cryptography · low
configuring-host-based-intrusion-detection
endpoint security · low
configuring-hsm-for-key-storage
cryptography · low
configuring-identity-aware-proxy-with-google-iap
zero trust architecture · low
configuring-ldap-security-hardening
identity access management · low
configuring-microsegmentation-for-zero-trust
zero trust architecture · low
configuring-multi-factor-authentication-with-duo
identity access management · low
configuring-network-segmentation-with-vlans
network security · medium
configuring-oauth2-authorization-flow
identity access management · low
configuring-pfsense-firewall-rules
network security · medium
configuring-snort-ids-for-intrusion-detection
network security · medium
configuring-suricata-for-network-monitoring
network security · medium
configuring-tls-1-3-for-secure-communications
cryptography · low
configuring-windows-defender-advanced-settings
endpoint security · low
configuring-windows-event-logging-for-detection
endpoint security · low
configuring-zscaler-private-access-for-ztna
zero trust architecture · low
correlating-security-events-in-qradar
soc operations · low
correlating-threat-campaigns
threat intelligence · low
deobfuscating-javascript-malware
malware analysis · medium
deobfuscating-powershell-obfuscated-malware
malware analysis · medium
deploying-cloudflare-access-for-zero-trust
zero trust architecture · low
deploying-edr-agent-with-crowdstrike
endpoint security · low
deploying-osquery-for-endpoint-monitoring
endpoint security · low
deploying-palo-alto-prisma-access-zero-trust
zero trust architecture · low
deploying-software-defined-perimeter
zero trust architecture · low
deploying-tailscale-for-zero-trust-vpn
zero trust architecture · low
detecting-anomalous-authentication-patterns
identity access management · low
detecting-api-enumeration-attacks
api security · medium
detecting-arp-poisoning-in-network-traffic
network security · medium
detecting-aws-cloudtrail-anomalies
cloud security · low
detecting-aws-credential-exposure-with-trufflehog
cloud security · low
detecting-aws-guardduty-findings-automation
cloud security · low
detecting-aws-iam-privilege-escalation
cloud security · low
detecting-azure-lateral-movement
cloud security · low
detecting-azure-service-principal-abuse
cloud security · low
detecting-azure-storage-account-misconfigurations
cloud security · low
detecting-broken-object-property-level-authorization
api security · medium
detecting-business-email-compromise
phishing defense · medium
detecting-business-email-compromise-with-ai
phishing defense · medium
detecting-cloud-threats-with-guardduty
cloud security · low
detecting-command-and-control-over-dns
network security · medium
detecting-compromised-cloud-credentials
cloud security · low
detecting-container-drift-at-runtime
container security · low
detecting-container-escape-attempts
container security · low
detecting-container-escape-with-falco-rules
container security · low
detecting-cryptomining-in-cloud
cloud security · low
detecting-dcsync-attack-in-active-directory
threat hunting · low
detecting-dll-sideloading-attacks
threat hunting · low
detecting-dns-exfiltration-with-dns-query-analysis
network security · medium
detecting-email-forwarding-rules-attack
threat hunting · low
detecting-evasion-techniques-in-endpoint-logs
endpoint security · low
detecting-exfiltration-over-dns-with-zeek
network security · medium
detecting-fileless-attacks-on-endpoints
endpoint security · low
detecting-fileless-malware-techniques
malware analysis · medium
detecting-golden-ticket-attacks-in-kerberos-logs
threat hunting · low
detecting-insider-threat-behaviors
threat hunting · low
detecting-kerberoasting-attacks
threat hunting · low
detecting-lateral-movement-in-network
network security · medium
detecting-lateral-movement-with-splunk
threat hunting · low
detecting-lateral-movement-with-zeek
network security · medium
detecting-malicious-scheduled-tasks-with-sysmon
threat hunting · low
detecting-mimikatz-execution-patterns
threat hunting · low
detecting-misconfigured-azure-storage
cloud security · low
detecting-network-anomalies-with-zeek
network security · medium
detecting-network-scanning-with-ids-signatures
network security · medium
detecting-ntlm-relay-with-event-correlation
threat hunting · low
detecting-oauth-token-theft
cloud security · low
detecting-pass-the-hash-attacks
threat hunting · low
detecting-port-scanning-with-fail2ban
network security · medium
detecting-privilege-escalation-attempts
threat hunting · low
detecting-privilege-escalation-in-kubernetes-pods
container security · low
detecting-process-hollowing-technique
threat hunting · low
detecting-process-injection-techniques
malware analysis · medium
detecting-qr-code-phishing-with-email-security
phishing defense · medium
detecting-rootkit-activity
malware analysis · medium
detecting-s3-data-exfiltration-attempts
cloud security · low
detecting-serverless-function-injection
cloud security · low
detecting-service-account-abuse
threat hunting · low
detecting-shadow-api-endpoints
api security · medium
detecting-shadow-it-cloud-usage
cloud security · low
detecting-spearphishing-with-email-gateway
phishing defense · medium
detecting-suspicious-oauth-application-consent
cloud security · low
detecting-suspicious-powershell-execution
threat hunting · low
detecting-t1003-credential-dumping-with-edr
threat hunting · low
detecting-t1055-process-injection-with-sysmon
threat hunting · low
detecting-t1548-abuse-elevation-control-mechanism
threat hunting · low
detecting-wmi-persistence
threat hunting · low
evaluating-threat-intelligence-platforms
threat intelligence · low
executing-active-directory-attack-simulation
penetration testing · medium
executing-phishing-simulation-campaign
penetration testing · medium
executing-red-team-engagement-planning
red teaming · high
executing-red-team-exercise
penetration testing · medium
exploiting-active-directory-certificate-services-esc1
red teaming · high
exploiting-active-directory-with-bloodhound
red teaming · high
exploiting-api-injection-vulnerabilities
api security · medium
exploiting-bgp-hijacking-vulnerabilities
network security · medium
exploiting-broken-function-level-authorization
api security · medium
exploiting-constrained-delegation-abuse
red teaming · high
exploiting-excessive-data-exposure-in-api
api security · medium
exploiting-ipv6-vulnerabilities
network security · medium
exploiting-jwt-algorithm-confusion-attack
api security · medium
exploiting-kerberoasting-with-impacket
red teaming · high
exploiting-ms17-010-eternalblue-vulnerability
red teaming · high
exploiting-nopac-cve-2021-42278-42287
red teaming · high
exploiting-smb-vulnerabilities-with-metasploit
network security · medium
exploiting-sql-injection-vulnerabilities
penetration testing · medium
exploiting-zerologon-vulnerability-cve-2020-1472
red teaming · high
extracting-browser-history-artifacts
digital forensics · low
extracting-config-from-agent-tesla-rat
malware analysis · medium
extracting-credentials-from-memory-dump
digital forensics · low
extracting-iocs-from-malware-samples
malware analysis · medium
extracting-windows-event-logs-artifacts
digital forensics · low
generating-threat-intelligence-reports
threat intelligence · low
hardening-docker-containers-for-production
container security · low
hardening-docker-daemon-configuration
container security · low
hardening-linux-endpoint-with-cis-benchmark
endpoint security · low
hardening-windows-endpoint-with-cis-benchmark
endpoint security · low
hunting-advanced-persistent-threats
threat intelligence · low
hunting-for-anomalous-powershell-execution
threat hunting · low
hunting-for-beaconing-with-frequency-analysis
threat hunting · low
hunting-for-cobalt-strike-beacons
threat hunting · low
hunting-for-command-and-control-beaconing
threat hunting · low
hunting-for-data-exfiltration-indicators
threat hunting · low
hunting-for-data-staging-before-exfiltration
threat hunting · low
hunting-for-dcom-lateral-movement
threat hunting · low
hunting-for-dcsync-attacks
threat hunting · low
hunting-for-defense-evasion-via-timestomping
threat hunting · low
hunting-for-dns-based-persistence
threat hunting · low
hunting-for-dns-tunneling-with-zeek
threat hunting · low
hunting-for-domain-fronting-c2-traffic
threat hunting · low
hunting-for-lateral-movement-via-wmi
threat hunting · low
hunting-for-living-off-the-cloud-techniques
threat hunting · low
hunting-for-living-off-the-land-binaries
threat hunting · low
hunting-for-lolbins-execution-in-endpoint-logs
threat hunting · low
hunting-for-ntlm-relay-attacks
threat hunting · low
hunting-for-persistence-mechanisms-in-windows
threat hunting · low
hunting-for-persistence-via-wmi-subscriptions
threat hunting · low
hunting-for-process-injection-techniques
threat hunting · low
hunting-for-registry-persistence-mechanisms
threat hunting · low
hunting-for-registry-run-key-persistence
threat hunting · low
hunting-for-scheduled-task-persistence
threat hunting · low
hunting-for-shadow-copy-deletion
threat hunting · low
hunting-for-spearphishing-indicators
threat hunting · low
hunting-for-startup-folder-persistence
threat hunting · low
hunting-for-supply-chain-compromise
threat hunting · low
hunting-for-suspicious-scheduled-tasks
threat hunting · low
hunting-for-t1098-account-manipulation
threat hunting · low
hunting-for-unusual-network-connections
threat hunting · low
hunting-for-unusual-service-installations
threat hunting · low
hunting-for-webshell-activity
threat hunting · low
implementing-aes-encryption-for-data-at-rest
cryptography · low
implementing-alert-fatigue-reduction
soc operations · low
implementing-anti-phishing-training-program
phishing defense · medium
implementing-api-abuse-detection-with-rate-limiting
api security · medium
implementing-api-gateway-security-controls
api security · medium
implementing-api-key-security-controls
api security · medium
implementing-api-rate-limiting-and-throttling
api security · medium
implementing-api-schema-validation-security
api security · medium
implementing-api-security-posture-management
api security · medium
implementing-api-security-testing-with-42crunch
api security · medium
implementing-api-threat-protection-with-apigee
api security · medium
implementing-application-whitelisting-with-applocker
endpoint security · low
implementing-aws-config-rules-for-compliance
cloud security · low
implementing-aws-iam-permission-boundaries
identity access management · low
implementing-aws-macie-for-data-classification
cloud security · low
implementing-aws-nitro-enclave-security
cloud security · low
implementing-aws-security-hub
cloud security · low
implementing-aws-security-hub-compliance
cloud security · low
implementing-azure-ad-privileged-identity-management
identity access management · low
implementing-azure-defender-for-cloud
cloud security · low
implementing-beyondcorp-zero-trust-access-model
zero trust architecture · low
implementing-bgp-security-with-rpki
network security · medium
implementing-browser-isolation-for-zero-trust
network security · medium
implementing-cisa-zero-trust-maturity-model
zero trust architecture · low
implementing-cloud-dlp-for-data-protection
cloud security · low
implementing-cloud-security-posture-management
cloud security · low
implementing-cloud-trail-log-analysis
cloud security · low
implementing-cloud-waf-rules
cloud security · low
implementing-cloud-workload-protection
cloud security · low
implementing-conditional-access-policies-azure-ad
identity access management · low
implementing-container-image-minimal-base-with-distroless
container security · low
implementing-container-network-policies-with-calico
container security · low
implementing-ddos-mitigation-with-cloudflare
network security · medium
implementing-delinea-secret-server-for-pam
identity access management · low
implementing-device-posture-assessment-in-zero-trust
zero trust architecture · low
implementing-diamond-model-analysis
threat intelligence · low
implementing-digital-signatures-with-ed25519
cryptography · low
implementing-disk-encryption-with-bitlocker
endpoint security · low
implementing-dmarc-dkim-spf-email-security
phishing defense · medium
implementing-email-sandboxing-with-proofpoint
phishing defense · medium
implementing-end-to-end-encryption-for-messaging
cryptography · low
implementing-endpoint-dlp-controls
endpoint security · low
implementing-envelope-encryption-with-aws-kms
cryptography · low
implementing-file-integrity-monitoring-with-aide
endpoint security · low
implementing-gcp-binary-authorization
cloud security · low
implementing-gcp-organization-policy-constraints
cloud security · low
implementing-gcp-vpc-firewall-rules
cloud security · low
implementing-google-workspace-admin-security
identity access management · low
implementing-google-workspace-phishing-protection
phishing defense · medium
implementing-google-workspace-sso-configuration
identity access management · low
implementing-hashicorp-vault-dynamic-secrets
identity access management · low
implementing-identity-governance-with-sailpoint
identity access management · low
implementing-identity-verification-for-zero-trust
zero trust architecture · low
implementing-image-provenance-verification-with-cosign
container security · low
implementing-just-in-time-access-provisioning
identity access management · low
implementing-jwt-signing-and-verification
cryptography · low
implementing-kubernetes-network-policy-with-calico
container security · low
implementing-kubernetes-pod-security-standards
container security · low
implementing-memory-protection-with-dep-aslr
endpoint security · low
implementing-microsegmentation-with-guardicore
zero trust architecture · low
implementing-mimecast-targeted-attack-protection
phishing defense · medium
implementing-mitre-attack-coverage-mapping
soc operations · low
implementing-network-access-control
network security · medium
implementing-network-access-control-with-cisco-ise
network security · medium
implementing-network-intrusion-prevention-with-suricata
network security · medium
implementing-network-policies-for-kubernetes
container security · low
implementing-network-segmentation-with-firewall-zones
network security · medium
implementing-network-traffic-analysis-with-arkime
network security · medium
implementing-network-traffic-baselining
network security · medium
implementing-next-generation-firewall-with-palo-alto
network security · medium
implementing-opa-gatekeeper-for-policy-enforcement
container security · low
implementing-pam-for-database-access
identity access management · low
implementing-passwordless-auth-with-microsoft-entra
identity access management · low
implementing-passwordless-authentication-with-fido2
identity access management · low
implementing-pod-security-admission-controller
container security · low
implementing-privileged-access-management-with-cyberark
identity access management · low
implementing-privileged-session-monitoring
identity access management · low
implementing-proofpoint-email-security-gateway
phishing defense · medium
implementing-rbac-hardening-for-kubernetes
container security · low
implementing-rsa-key-pair-management
cryptography · low
implementing-runtime-security-with-tetragon
container security · low
implementing-saml-sso-with-okta
identity access management · low
implementing-scim-provisioning-with-okta
identity access management · low
implementing-secrets-management-with-vault
cloud security · low
implementing-security-information-sharing-with-stix2
threat intelligence · low
implementing-siem-use-cases-for-detection
soc operations · low
implementing-soar-automation-with-phantom
soc operations · low
implementing-soar-playbook-with-palo-alto-xsoar
soc operations · low
implementing-stix-taxii-feed-integration
threat intelligence · low
implementing-supply-chain-security-with-in-toto
container security · low
implementing-taxii-server-with-opentaxii
threat intelligence · low
implementing-threat-intelligence-lifecycle-management
threat intelligence · low
implementing-threat-modeling-with-mitre-attack
soc operations · low
implementing-ticketing-system-for-incidents
soc operations · low
implementing-usb-device-control-policy
endpoint security · low
implementing-zero-knowledge-proof-for-authentication
cryptography · low
implementing-zero-standing-privilege-with-cyberark
identity access management · low
implementing-zero-trust-dns-with-nextdns
zero trust architecture · low
implementing-zero-trust-for-saas-applications
zero trust architecture · low
implementing-zero-trust-in-cloud
cloud security · low
implementing-zero-trust-network-access
cloud security · low
implementing-zero-trust-network-access-with-zscaler
zero trust architecture · low
implementing-zero-trust-with-hashicorp-boundary
zero trust architecture · low
investigating-insider-threat-indicators
soc operations · low
investigating-phishing-email-incident
soc operations · low
investigating-ransomware-attack-artifacts
digital forensics · low
managing-cloud-identity-with-okta
cloud security · low
managing-intelligence-lifecycle
threat intelligence · low
mapping-mitre-attack-techniques
threat intelligence · low
monitoring-darkweb-sources
threat intelligence · low
performing-access-recertification-with-saviynt
identity access management · low
performing-access-review-and-certification
identity access management · low
performing-active-directory-bloodhound-analysis
red teaming · high
performing-active-directory-penetration-test
penetration testing · medium
performing-adversary-in-the-middle-phishing-detection
phishing defense · medium
performing-ai-driven-osint-correlation
threat intelligence · low
performing-alert-triage-with-elastic-siem
soc operations · low
performing-api-fuzzing-with-restler
api security · medium
performing-api-inventory-and-discovery
api security · medium
performing-api-rate-limiting-bypass
api security · medium
performing-api-security-testing-with-postman
api security · medium
performing-arp-spoofing-attack-simulation
network security · medium
performing-automated-malware-analysis-with-cape
malware analysis · medium
performing-aws-account-enumeration-with-scout-suite
cloud security · low
performing-aws-privilege-escalation-assessment
cloud security · low
performing-bandwidth-throttling-attack-simulation
network security · medium
performing-brand-monitoring-for-impersonation
threat intelligence · low
performing-cloud-asset-inventory-with-cartography
cloud security · low
performing-cloud-forensics-investigation
digital forensics · low
performing-cloud-forensics-with-aws-cloudtrail
cloud security · low
performing-cloud-log-forensics-with-athena
cloud security · low
performing-cloud-native-forensics-with-falco
cloud security · low
performing-cloud-native-threat-hunting-with-aws-detective
cloud security · low
performing-cloud-penetration-testing-with-pacu
cloud security · low
performing-cloud-storage-forensic-acquisition
digital forensics · low
performing-container-escape-detection
container security · low
performing-container-security-scanning-with-trivy
container security · low
performing-credential-access-with-lazagne
red teaming · high
performing-cryptographic-audit-of-application
cryptography · low
performing-dark-web-monitoring-for-threats
threat intelligence · low
performing-deception-technology-deployment
soc operations · low
performing-dmarc-policy-enforcement-rollout
phishing defense · medium
performing-dns-enumeration-and-zone-transfer
network security · medium
performing-docker-bench-security-assessment
container security · low
performing-dynamic-analysis-with-any-run
malware analysis · medium
performing-endpoint-forensics-investigation
endpoint security · low
performing-endpoint-vulnerability-remediation
endpoint security · low
performing-entitlement-review-with-sailpoint-iiq
identity access management · low
performing-external-network-penetration-test
penetration testing · medium
performing-false-positive-reduction-in-siem
soc operations · low
performing-file-carving-with-foremost
digital forensics · low
performing-firmware-malware-analysis
malware analysis · medium
performing-gcp-penetration-testing-with-gcpbucketbrute
cloud security · low
performing-gcp-security-assessment-with-forseti
cloud security · low
performing-graphql-depth-limit-attack
api security · medium
performing-graphql-introspection-attack
api security · medium
performing-hardware-security-module-integration
cryptography · low
performing-hash-cracking-with-hashcat
cryptography · low
performing-indicator-lifecycle-management
threat intelligence · low
performing-initial-access-with-evilginx3
red teaming · high
performing-ioc-enrichment-automation
soc operations · low
performing-iot-security-assessment
penetration testing · medium
performing-ip-reputation-analysis-with-shodan
threat intelligence · low
performing-jwt-none-algorithm-attack
api security · medium
performing-kerberoasting-attack
red teaming · high
performing-kubernetes-cis-benchmark-with-kube-bench
container security · low
performing-kubernetes-etcd-security-assessment
container security · low
performing-kubernetes-penetration-testing
container security · low
performing-lateral-movement-detection
soc operations · low
performing-lateral-movement-with-wmiexec
red teaming · high
performing-linux-log-forensics-investigation
digital forensics · low
performing-log-analysis-for-forensic-investigation
digital forensics · low
performing-log-source-onboarding-in-siem
soc operations · low
performing-malware-hash-enrichment-with-virustotal
threat intelligence · low
performing-malware-ioc-extraction
threat intelligence · low
performing-malware-persistence-investigation
digital forensics · low
performing-malware-triage-with-yara
malware analysis · medium
performing-memory-forensics-with-volatility3
digital forensics · low
performing-memory-forensics-with-volatility3-plugins
malware analysis · medium
performing-mobile-device-forensics-with-cellebrite
digital forensics · low
performing-network-forensics-with-wireshark
digital forensics · low
performing-network-packet-capture-analysis
digital forensics · low
performing-network-traffic-analysis-with-tshark
network security · medium
performing-network-traffic-analysis-with-zeek
network security · medium
performing-oauth-scope-minimization-review
identity access management · low
performing-open-source-intelligence-gathering
red teaming · high
performing-osint-with-spiderfoot
threat intelligence · low
performing-packet-injection-attack
network security · medium
performing-paste-site-monitoring-for-credentials
threat intelligence · low
performing-phishing-simulation-with-gophish
phishing defense · medium
performing-physical-intrusion-assessment
red teaming · high
performing-post-quantum-cryptography-migration
cryptography · low
performing-privilege-escalation-assessment
penetration testing · medium
performing-privilege-escalation-on-linux
red teaming · high
performing-privileged-account-access-review
identity access management · low
performing-privileged-account-discovery
identity access management · low
performing-purple-team-exercise
soc operations · low
performing-serverless-function-security-review
cloud security · low
performing-service-account-audit
identity access management · low
performing-service-account-credential-rotation
identity access management · low
performing-soap-web-service-security-testing
api security · medium
performing-soc-tabletop-exercise
soc operations · low
performing-sqlite-database-forensics
digital forensics · low
performing-ssl-certificate-lifecycle-management
cryptography · low
performing-ssl-stripping-attack
network security · medium
performing-ssl-tls-inspection-configuration
network security · medium
performing-ssl-tls-security-assessment
network security · medium
performing-static-malware-analysis-with-pe-studio
malware analysis · medium
performing-steganography-detection
digital forensics · low
performing-thick-client-application-penetration-test
penetration testing · medium
performing-threat-emulation-with-atomic-red-team
threat intelligence · low
performing-threat-hunting-with-elastic-siem
soc operations · low
performing-threat-hunting-with-yara-rules
threat hunting · low
performing-threat-intelligence-sharing-with-misp
threat intelligence · low
performing-threat-landscape-assessment-for-sector
threat intelligence · low
performing-timeline-reconstruction-with-plaso
digital forensics · low
performing-user-behavior-analytics
soc operations · low
performing-vlan-hopping-attack
network security · medium
performing-vulnerability-scanning-with-nessus
penetration testing · medium
performing-web-application-penetration-test
penetration testing · medium
performing-wifi-password-cracking-with-aircrack
network security · medium
performing-windows-artifact-analysis-with-eric-zimmerman-tools
digital forensics · low
performing-wireless-network-penetration-test
penetration testing · medium
performing-wireless-security-assessment-with-kismet
network security · medium
performing-yara-rule-development-for-detection
malware analysis · medium
processing-stix-taxii-feeds
threat intelligence · low
profiling-threat-actor-groups
threat intelligence · low
recovering-deleted-files-with-photorec
digital forensics · low
remediating-s3-bucket-misconfiguration
cloud security · low
reverse-engineering-android-malware-with-jadx
malware analysis · medium
reverse-engineering-dotnet-malware-with-dnspy
malware analysis · medium
reverse-engineering-malware-with-ghidra
malware analysis · medium
reverse-engineering-ransomware-encryption-routine
malware analysis · medium
reverse-engineering-rust-malware
malware analysis · medium
scanning-container-images-with-grype
container security · low
scanning-docker-images-with-trivy
container security · low
scanning-kubernetes-manifests-with-kubesec
container security · low
scanning-network-with-nmap-advanced
network security · medium
securing-api-gateway-with-aws-waf
cloud security · low
securing-aws-iam-permissions
cloud security · low
securing-aws-lambda-execution-roles
cloud security · low
securing-azure-with-microsoft-defender
cloud security · low
securing-container-registry-images
cloud security · low
securing-container-registry-with-harbor
container security · low
securing-helm-chart-deployments
container security · low
securing-kubernetes-on-cloud
cloud security · low
securing-serverless-functions
cloud security · low
testing-api-authentication-weaknesses
api security · medium
testing-api-for-broken-object-level-authorization
api security · medium
testing-api-for-mass-assignment-vulnerability
api security · medium
testing-for-xss-vulnerabilities
penetration testing · medium
testing-oauth2-implementation-flaws
api security · medium
testing-websocket-api-security
api security · medium
tracking-threat-actor-infrastructure
threat intelligence · low
triaging-security-alerts-in-splunk
soc operations · low
© 2026 Casky.AI, Inc. · AI Security Investigation