https://mkaimouz.com/https://mkaimouz.com/cases/https://mkaimouz.com/gallery/https://mkaimouz.com/work/https://mkaimouz.com/skills/https://mkaimouz.com/career/https://mkaimouz.com/about/https://mkaimouz.com/cv/https://mkaimouz.com/domains/soc/https://mkaimouz.com/domains/detection/https://mkaimouz.com/domains/automation/https://mkaimouz.com/domains/soc-engineering/https://mkaimouz.com/domains/offensive/https://mkaimouz.com/domains/security-engineering/https://mkaimouz.com/domains/leadership/https://mkaimouz.com/domains/software/https://mkaimouz.com/domains/recognition/https://mkaimouz.com/skills/incident-response/https://mkaimouz.com/skills/threat-hunting/https://mkaimouz.com/skills/incident-timeline-reconstruction/https://mkaimouz.com/skills/digital-forensics/https://mkaimouz.com/skills/windows-forensics/https://mkaimouz.com/skills/persistence-analysis/https://mkaimouz.com/skills/incident-response-collection/https://mkaimouz.com/skills/runbook-development/https://mkaimouz.com/skills/microsoft-sentinel/https://mkaimouz.com/skills/microsoft-defender-for-endpoint/https://mkaimouz.com/skills/edr/https://mkaimouz.com/skills/siem/https://mkaimouz.com/skills/microsoft-entra-id/https://mkaimouz.com/skills/microsoft-365/https://mkaimouz.com/skills/velociraptor/https://mkaimouz.com/skills/crowdstrike/https://mkaimouz.com/skills/kql/https://mkaimouz.com/skills/mitre-att-ck/https://mkaimouz.com/skills/threat-modelling/https://mkaimouz.com/skills/attack-path-analysis/https://mkaimouz.com/skills/detection-use-case-development/https://mkaimouz.com/skills/detection-lifecycle-design/https://mkaimouz.com/skills/detection-as-code-design/https://mkaimouz.com/skills/telemetry-requirements/https://mkaimouz.com/skills/control-assurance/https://mkaimouz.com/skills/active-directory/https://mkaimouz.com/skills/authentication-analysis/https://mkaimouz.com/skills/kerberos/https://mkaimouz.com/skills/ntlm/https://mkaimouz.com/skills/mfa-investigation/https://mkaimouz.com/skills/mailbox-audit/https://mkaimouz.com/skills/email-security/https://mkaimouz.com/skills/email-authentication/https://mkaimouz.com/skills/adversary-in-the-middle/https://mkaimouz.com/skills/soar/https://mkaimouz.com/skills/servicenow-secops/https://mkaimouz.com/skills/xsoar/https://mkaimouz.com/skills/defender-live-response/https://mkaimouz.com/skills/defender-attack-disruption/https://mkaimouz.com/skills/power-automate/https://mkaimouz.com/skills/copilot-studio/https://mkaimouz.com/skills/ai-assisted-investigation/https://mkaimouz.com/skills/workflow-automation/https://mkaimouz.com/skills/reporting-automation/https://mkaimouz.com/skills/integration-testing/https://mkaimouz.com/skills/acceptance-testing/https://mkaimouz.com/skills/synthetic-test-data/https://mkaimouz.com/skills/entity-mapping/https://mkaimouz.com/skills/incident-lifecycle/https://mkaimouz.com/skills/escalation-design/https://mkaimouz.com/skills/web-application-testing/https://mkaimouz.com/skills/source-code-review/https://mkaimouz.com/skills/cloud-configuration-review/https://mkaimouz.com/skills/assumed-breach-assessment/https://mkaimouz.com/skills/attack-surface-assessment/https://mkaimouz.com/skills/owasp/https://mkaimouz.com/skills/payload-development/https://mkaimouz.com/skills/lolbins/https://mkaimouz.com/skills/dll-hijacking/https://mkaimouz.com/skills/phishing-simulation/https://mkaimouz.com/skills/physical-security-assessment/https://mkaimouz.com/skills/social-engineering-exercises/https://mkaimouz.com/skills/osint/https://mkaimouz.com/skills/reconnaissance-automation/https://mkaimouz.com/skills/network-analysis/https://mkaimouz.com/skills/packet-analysis/https://mkaimouz.com/skills/vpn-logs/https://mkaimouz.com/skills/ot-monitoring/https://mkaimouz.com/skills/claroty/https://mkaimouz.com/skills/network-segmentation-testing/https://mkaimouz.com/skills/malware-analysis/https://mkaimouz.com/skills/static-analysis/https://mkaimouz.com/skills/dynamic-analysis/https://mkaimouz.com/skills/procmon/https://mkaimouz.com/skills/threat-intelligence/https://mkaimouz.com/skills/virustotal/https://mkaimouz.com/skills/any-run/https://mkaimouz.com/skills/soc-leadership/https://mkaimouz.com/skills/analyst-development/https://mkaimouz.com/skills/recruitment-and-onboarding/https://mkaimouz.com/skills/investigation-standards/https://mkaimouz.com/skills/mdr-transition/https://mkaimouz.com/skills/offensive-service-delivery/https://mkaimouz.com/skills/engagement-scoping/https://mkaimouz.com/skills/technical-leadership/https://mkaimouz.com/skills/client-communication/https://mkaimouz.com/skills/technical-reporting/https://mkaimouz.com/skills/incident-reporting/https://mkaimouz.com/skills/executive-communication/https://mkaimouz.com/skills/risk-prioritisation/https://mkaimouz.com/skills/operational-handover/https://mkaimouz.com/skills/powershell/https://mkaimouz.com/skills/python/https://mkaimouz.com/skills/bash/https://mkaimouz.com/skills/linux/https://mkaimouz.com/skills/windows/https://mkaimouz.com/skills/windows-security-events/https://mkaimouz.com/skills/data-analysis/https://mkaimouz.com/skills/git/https://mkaimouz.com/skills/azure-devops/https://mkaimouz.com/skills/technical-documentation/https://mkaimouz.com/skills/php/https://mkaimouz.com/skills/mysql/https://mkaimouz.com/skills/nginx/https://mkaimouz.com/skills/wordpress/https://mkaimouz.com/skills/craft-cms/https://mkaimouz.com/skills/aws-ec2/https://mkaimouz.com/skills/data-migration/https://mkaimouz.com/skills/production-troubleshooting/https://mkaimouz.com/skills/information-security/https://mkaimouz.com/skills/computer-science/https://mkaimouz.com/skills/ransomware-research/https://mkaimouz.com/skills/cryptography/https://mkaimouz.com/skills/network-security/https://mkaimouz.com/skills/philosophy/https://mkaimouz.com/skills/community-leadership/https://mkaimouz.com/skills/edr-evaluation/https://mkaimouz.com/skills/sentinelone/https://mkaimouz.com/skills/api-integration/https://mkaimouz.com/skills/helk/https://mkaimouz.com/skills/microsoft-defender-xdr/https://mkaimouz.com/skills/sql-server-security/https://mkaimouz.com/skills/smb-enumeration-detection/https://mkaimouz.com/skills/credential-exposure-hunting/https://mkaimouz.com/skills/responder/https://mkaimouz.com/skills/authentication-relay/https://mkaimouz.com/skills/password-hash-cracking/https://mkaimouz.com/skills/abuseipdb/https://mkaimouz.com/skills/access-control-assessment/https://mkaimouz.com/skills/azure-sign-in-logs/https://mkaimouz.com/skills/browser-artefacts/https://mkaimouz.com/skills/claroty-context/https://mkaimouz.com/skills/client-reporting/https://mkaimouz.com/skills/concurrency-control/https://mkaimouz.com/skills/control-coverage-review/https://mkaimouz.com/skills/corrective-action-reporting/https://mkaimouz.com/skills/cross-source-investigation/https://mkaimouz.com/skills/detection-feasibility/https://mkaimouz.com/skills/developer-onboarding/https://mkaimouz.com/skills/edr-coverage/https://mkaimouz.com/skills/endpoint-configuration/https://mkaimouz.com/skills/engagement-oversight/https://mkaimouz.com/skills/evidence-handover/https://mkaimouz.com/skills/ip-attribution/https://mkaimouz.com/skills/inbox-rule-analysis/https://mkaimouz.com/skills/incident-investigation/https://mkaimouz.com/skills/incident-lifecycle-design/https://mkaimouz.com/skills/investigation-quality-assurance/https://mkaimouz.com/skills/management-cover/https://mkaimouz.com/skills/mdr-collaboration/https://mkaimouz.com/skills/msbuild/https://mkaimouz.com/skills/nat/https://mkaimouz.com/skills/netsupport/https://mkaimouz.com/skills/ntlmv2/https://mkaimouz.com/skills/prefetch/https://mkaimouz.com/skills/process-analysis/https://mkaimouz.com/skills/qr-code-assessment/https://mkaimouz.com/skills/quick-assist/https://mkaimouz.com/skills/raspberry-pi/https://mkaimouz.com/skills/registry-persistence/https://mkaimouz.com/skills/report-review/https://mkaimouz.com/skills/response-ownership/https://mkaimouz.com/skills/soc-continuity/https://mkaimouz.com/skills/soc-shift-leadership/https://mkaimouz.com/skills/service-requirements/https://mkaimouz.com/skills/servicenow-sir/https://mkaimouz.com/skills/technical-governance/https://mkaimouz.com/skills/telemetry-dependencies/https://mkaimouz.com/skills/mssp-siem/https://mkaimouz.com/skills/mssp-soar/https://mkaimouz.com/skills/windows-api-analysis/https://mkaimouz.com/skills/security-testing/https://mkaimouz.com/work/detection-engineering/https://mkaimouz.com/work/soc-operations/https://mkaimouz.com/work/security-engineering/https://mkaimouz.com/work/automation/https://mkaimouz.com/work/incident-response/https://mkaimouz.com/work/offensive-security/https://mkaimouz.com/work/leadership/https://mkaimouz.com/work/engineering-foundation/https://mkaimouz.com/cases/response-tooling/https://mkaimouz.com/cases/response-tooling/notes/services-and-run-registry-persistence-signals/https://mkaimouz.com/cases/response-tooling/notes/live-response-commands-and-current-defender-state/https://mkaimouz.com/cases/response-tooling/notes/native-automated-account-containment/https://mkaimouz.com/cases/response-tooling/notes/queries-and-investigation-standards/https://mkaimouz.com/cases/response-tooling/context/https://mkaimouz.com/cases/response-tooling/approach/https://mkaimouz.com/cases/response-tooling/outcome/https://mkaimouz.com/cases/vishing-investigation/https://mkaimouz.com/cases/vishing-investigation/notes/working-without-early-endpoint-logs/https://mkaimouz.com/cases/vishing-investigation/notes/windows-and-support-session-artefacts/https://mkaimouz.com/cases/vishing-investigation/notes/the-reconstructed-timeline/https://mkaimouz.com/cases/vishing-investigation/context/https://mkaimouz.com/cases/vishing-investigation/approach/https://mkaimouz.com/cases/vishing-investigation/outcome/https://mkaimouz.com/cases/red-team-to-detection/https://mkaimouz.com/cases/red-team-to-detection/notes/from-observation-to-use-case/https://mkaimouz.com/cases/red-team-to-detection/notes/a-backlog-that-records-dependencies/https://mkaimouz.com/cases/red-team-to-detection/notes/validation-as-a-planned-next-step/https://mkaimouz.com/cases/red-team-to-detection/notes/sql-server-command-shell-detection/https://mkaimouz.com/cases/red-team-to-detection/notes/smb-enumeration-in-defender-xdr/https://mkaimouz.com/cases/red-team-to-detection/notes/credential-hunting-and-identity-hardening/https://mkaimouz.com/cases/red-team-to-detection/context/https://mkaimouz.com/cases/red-team-to-detection/approach/https://mkaimouz.com/cases/red-team-to-detection/outcome/https://mkaimouz.com/cases/self-service-testing/https://mkaimouz.com/cases/self-service-testing/notes/curated-entities-and-incident-fields/https://mkaimouz.com/cases/self-service-testing/notes/repeatable-test-data/https://mkaimouz.com/cases/self-service-testing/notes/guardrails-and-rule-reset/https://mkaimouz.com/cases/self-service-testing/notes/fresh-incidents-and-handover/https://mkaimouz.com/cases/self-service-testing/context/https://mkaimouz.com/cases/self-service-testing/approach/https://mkaimouz.com/cases/self-service-testing/outcome/https://mkaimouz.com/cases/soc-continuity/https://mkaimouz.com/cases/soc-continuity/notes/interim-operations/https://mkaimouz.com/cases/soc-continuity/notes/an-out-of-hours-escalation-route/https://mkaimouz.com/cases/soc-continuity/notes/replacement-service-requirements/https://mkaimouz.com/cases/soc-continuity/context/https://mkaimouz.com/cases/soc-continuity/approach/https://mkaimouz.com/cases/soc-continuity/outcome/https://mkaimouz.com/cases/physical-security-assessments/https://mkaimouz.com/cases/physical-security-assessments/notes/guest-room-and-television-networks/https://mkaimouz.com/cases/physical-security-assessments/notes/employee-interaction/https://mkaimouz.com/cases/physical-security-assessments/notes/small-device-placement/https://mkaimouz.com/cases/physical-security-assessments/notes/restricted-spaces-and-shift-differences/https://mkaimouz.com/cases/physical-security-assessments/context/https://mkaimouz.com/cases/physical-security-assessments/approach/https://mkaimouz.com/cases/physical-security-assessments/outcome/https://mkaimouz.com/cases/incident-integration/https://mkaimouz.com/cases/incident-integration/notes/incident-meaning-across-platforms/https://mkaimouz.com/cases/incident-integration/notes/bidirectional-closure-mappings/https://mkaimouz.com/cases/incident-integration/notes/a-bounded-acceptance-result/https://mkaimouz.com/cases/incident-integration/context/https://mkaimouz.com/cases/incident-integration/approach/https://mkaimouz.com/cases/incident-integration/outcome/https://mkaimouz.com/cases/vpn-investigation/https://mkaimouz.com/cases/vpn-investigation/notes/authentication-beyond-the-domain/https://mkaimouz.com/cases/vpn-investigation/notes/historical-vpn-attribution/https://mkaimouz.com/cases/vpn-investigation/notes/observed-access-and-unresolved-entry-point/https://mkaimouz.com/cases/vpn-investigation/context/https://mkaimouz.com/cases/vpn-investigation/approach/https://mkaimouz.com/cases/vpn-investigation/outcome/https://mkaimouz.com/cases/business-email-compromise/https://mkaimouz.com/cases/business-email-compromise/notes/access-and-persistence/https://mkaimouz.com/cases/business-email-compromise/notes/identity-mailbox-and-browser-correlation/https://mkaimouz.com/cases/business-email-compromise/notes/account-recovery-and-visible-scope/https://mkaimouz.com/cases/business-email-compromise/context/https://mkaimouz.com/cases/business-email-compromise/approach/https://mkaimouz.com/cases/business-email-compromise/outcome/https://mkaimouz.com/cases/new-case/https://mkaimouz.com/cases/new-case/notes/technical-detail/https://mkaimouz.com/cases/new-case/notes/technical-detail-2/https://mkaimouz.com/cases/new-case/notes/technical-detail-3/https://mkaimouz.com/cases/malware-analysis/https://mkaimouz.com/cases/malware-analysis/notes/obfuscation-and-conflicting-product-verdicts/https://mkaimouz.com/cases/malware-analysis/notes/decoding-and-controlled-execution/https://mkaimouz.com/cases/malware-analysis/notes/sample-behaviour-and-endpoint-activity/https://mkaimouz.com/cases/malware-analysis/context/https://mkaimouz.com/cases/malware-analysis/approach/https://mkaimouz.com/cases/malware-analysis/outcome/https://mkaimouz.com/cases/threat-to-assurance/https://mkaimouz.com/cases/threat-to-assurance/notes/two-inputs-meet-at-the-use-case/https://mkaimouz.com/cases/threat-to-assurance/notes/a-delivered-lifecycle-for-detection-work/https://mkaimouz.com/cases/threat-to-assurance/notes/logic-in-git-ownership-and-approvals-in-work-tracking/https://mkaimouz.com/cases/threat-to-assurance/notes/coverage-is-an-evidence-relationship/https://mkaimouz.com/cases/threat-to-assurance/context/https://mkaimouz.com/cases/threat-to-assurance/approach/https://mkaimouz.com/cases/threat-to-assurance/outcome/https://mkaimouz.com/cases/mssp-soc-leadership/https://mkaimouz.com/cases/mssp-soc-leadership/notes/the-operating-environment/https://mkaimouz.com/cases/mssp-soc-leadership/notes/investigation-and-communication/https://mkaimouz.com/cases/mssp-soc-leadership/notes/examples-from-the-casework/https://mkaimouz.com/cases/mssp-soc-leadership/context/https://mkaimouz.com/cases/mssp-soc-leadership/approach/https://mkaimouz.com/cases/mssp-soc-leadership/outcome/https://mkaimouz.com/cases/team-development/https://mkaimouz.com/cases/team-development/notes/recruitment-and-onboarding/https://mkaimouz.com/cases/team-development/notes/practical-technical-teaching/https://mkaimouz.com/cases/team-development/notes/management-cover-and-standards/https://mkaimouz.com/cases/team-development/context/https://mkaimouz.com/cases/team-development/approach/https://mkaimouz.com/cases/team-development/outcome/https://mkaimouz.com/cases/offensive-delivery/https://mkaimouz.com/cases/offensive-delivery/notes/a-portfolio-of-engagements/https://mkaimouz.com/cases/offensive-delivery/notes/client-communication/https://mkaimouz.com/cases/offensive-delivery/context/https://mkaimouz.com/cases/offensive-delivery/approach/https://mkaimouz.com/cases/offensive-delivery/outcome/https://mkaimouz.com/cases/offensive-assessments/https://mkaimouz.com/cases/offensive-assessments/notes/breadth-of-assessment/https://mkaimouz.com/cases/offensive-assessments/notes/simulation-and-payload-work/https://mkaimouz.com/cases/offensive-assessments/notes/an-application-finding/https://mkaimouz.com/cases/offensive-assessments/context/https://mkaimouz.com/cases/offensive-assessments/approach/https://mkaimouz.com/cases/offensive-assessments/outcome/https://mkaimouz.com/cases/offensive-scoping/https://mkaimouz.com/cases/offensive-scoping/notes/business-context-changes-the-scope/https://mkaimouz.com/cases/offensive-scoping/notes/an-external-view-of-the-environment/https://mkaimouz.com/cases/offensive-scoping/notes/email-identity-and-critical-components/https://mkaimouz.com/cases/offensive-scoping/notes/detection-and-response-coverage/https://mkaimouz.com/cases/offensive-scoping/notes/internal-and-assumed-breach-assessment/https://mkaimouz.com/cases/offensive-scoping/notes/testing-as-the-environment-evolves/https://mkaimouz.com/cases/offensive-scoping/context/https://mkaimouz.com/cases/offensive-scoping/approach/https://mkaimouz.com/cases/offensive-scoping/outcome/https://mkaimouz.com/cases/recon-automation/https://mkaimouz.com/cases/recon-automation/notes/an-organisation-led-starting-point/https://mkaimouz.com/cases/recon-automation/notes/reusable-code/https://mkaimouz.com/cases/recon-automation/context/https://mkaimouz.com/cases/recon-automation/approach/https://mkaimouz.com/cases/recon-automation/outcome/https://mkaimouz.com/cases/ot-investigation/https://mkaimouz.com/cases/ot-investigation/notes/backup-activity-and-ot-context/https://mkaimouz.com/cases/ot-investigation/notes/corroborating-the-traffic/https://mkaimouz.com/cases/ot-investigation/notes/response-ownership-and-telemetry/https://mkaimouz.com/cases/ot-investigation/context/https://mkaimouz.com/cases/ot-investigation/approach/https://mkaimouz.com/cases/ot-investigation/outcome/https://mkaimouz.com/cases/identity-validation/https://mkaimouz.com/cases/identity-validation/notes/the-authentication-question/https://mkaimouz.com/cases/identity-validation/notes/server-level-event-analysis/https://mkaimouz.com/cases/identity-validation/notes/what-the-change-review-established/https://mkaimouz.com/cases/identity-validation/context/https://mkaimouz.com/cases/identity-validation/approach/https://mkaimouz.com/cases/identity-validation/outcome/https://mkaimouz.com/cases/engineering-foundation/https://mkaimouz.com/cases/engineering-foundation/notes/publishing-systems-in-production/https://mkaimouz.com/cases/engineering-foundation/notes/application-and-migration-work/https://mkaimouz.com/cases/engineering-foundation/notes/documentation-and-developer-handover/https://mkaimouz.com/cases/engineering-foundation/context/https://mkaimouz.com/cases/engineering-foundation/approach/https://mkaimouz.com/cases/engineering-foundation/outcome/https://mkaimouz.com/cases/academic-foundation/https://mkaimouz.com/cases/academic-foundation/notes/full-scholarships-and-distinction/https://mkaimouz.com/cases/academic-foundation/notes/security-research/https://mkaimouz.com/cases/academic-foundation/notes/breadth-beyond-computing/https://mkaimouz.com/cases/academic-foundation/notes/putting-learning-into-service/https://mkaimouz.com/cases/academic-foundation/context/https://mkaimouz.com/cases/academic-foundation/approach/https://mkaimouz.com/cases/academic-foundation/outcome/https://mkaimouz.com/cases/retainer-collection/https://mkaimouz.com/cases/retainer-collection/notes/windows-and-linux-collection/https://mkaimouz.com/cases/retainer-collection/notes/deployment-through-evidence-transfer/https://mkaimouz.com/cases/retainer-collection/notes/secured-upload-link/https://mkaimouz.com/cases/retainer-collection/context/https://mkaimouz.com/cases/retainer-collection/approach/https://mkaimouz.com/cases/retainer-collection/outcome/https://mkaimouz.com/cases/executive-briefing/https://mkaimouz.com/cases/executive-briefing/notes/incident-of-note-presentation/https://mkaimouz.com/cases/executive-briefing/notes/follow-up-actions/https://mkaimouz.com/cases/executive-briefing/notes/the-weakness-behind-the-event/https://mkaimouz.com/cases/executive-briefing/context/https://mkaimouz.com/cases/executive-briefing/approach/https://mkaimouz.com/cases/executive-briefing/outcome/https://mkaimouz.com/cases/edr-capability-evaluation/https://mkaimouz.com/cases/edr-capability-evaluation/notes/investigation-and-containment-criteria/https://mkaimouz.com/cases/edr-capability-evaluation/notes/recovery-and-platform-integration/https://mkaimouz.com/cases/edr-capability-evaluation/notes/operational-and-licensing-boundaries/https://mkaimouz.com/cases/helk-detection-lab/https://mkaimouz.com/cases/helk-detection-lab/notes/deployment-and-windows-logging/https://mkaimouz.com/cases/helk-detection-lab/notes/simulated-attacks-and-observed-detection/