Tier-3 Incident Response & Core Malware Triage for Enterprise Networks

We provide deep-dive software reverse engineering, stealth adversary containment, and rapid forensic triage when your security infrastructure hits a wall.

Backed by elite threat research experience at Cisco Talos and peer-reviewed offensive engineering insights published in Phrack Magazine, Amethyst Systems delivers definitive technical clarity under high-stress breach conditions.

Technical R&D & Credentials

We bring deep binary-level execution authority to corporate threat landscapes.

• Published Research: Author of “A VX Adventure in Build Systems and Oldschool Techniques” in Phrack Magazine Issue 71, Phile #0x09.
• Industry Footprint: Past presenter and technical speaker at DEFCON 17 and THOTCON on binary obfuscation and anti-analysis mechanisms.
• Enterprise Pedigree: Former Malware Research and Reverse Engineering Specialist at the Cisco Talos Intelligence Group, mapping complex global campaigns and zero-day threat variants.
• Operational Validation: Verified technical backgrounds handling malware telemetry pipelines, protocol de-obfuscation, and certified incident response frameworks.

Core Enterprise Services

We do not manage helpdesks or deploy antivirus software. We are a specialized, on-call technical hammer brought in to solve complex architectural compromises.

🛡️ 1. Tier-3 Triage & Malware Reverse Engineering

On-demand code execution analysis for security architecture units and operations teams facing advanced, obfuscated threats.

• Configuration Extraction: Static and dynamic disassembly of complex or decoupled payloads to map local dependencies and strip parameters.
• C2 Infrastructure Uncovering: Reversing custom obfuscation and tracking down hardcoded command-and-control loops (such as RC4 parsing routines) to extract live indicators.
• High-Fidelity Detections: Blueprinting custom, zero-false-positive YARA and Sigma rules based on behavioral process anomalies and malicious script wrappers (.lnk, .vbs, .hta).

🔍 2. Compromise Assessments & Digital Forensics (DFIR)

Deep host-level and network-layer forensics designed to identify stealthy, persistent threat actors within your infrastructure.

• Volatile Memory Triage: Parsing large-scale system memory dumps to isolate running injection processes and hidden hooks.
• Process Tree Fingerprinting: Tracking convoluted system execution logic to establish accurate attack timelines and identify root entry vectors.
• Legal-Ready Documentation: Delivering highly granular, evidence-grade technical briefs compiled specifically for outside counsel, insurance panels, and regulators.

⚔️ 3. Targeted Adversary Simulation & Research

Proactive validation of internal EDR structures, cloud network boundaries, and defense controls against modern offensive vectors.

• EDR Control Auditing: Engineering localized, safe script instrumentation to explicitly test how your endpoint defenses react to sophisticated evasions.
• Cloud Boundary Reviews: Assessing access management parameters and cloud-hosted data isolation structures to eliminate exposure risks.
• AI/ML Integrity Validation: Reviewing data pipelining and boundary parameters against structural logic risks, including prompt injection vectors mapped to the OWASP GenAI framework.

Engagement Pipelines

We operate on a fixed-rate contract or structured monthly retainer framework tailored strictly for Managed Security Service Providers (MSSPs), internal corporate SOC units, and outside data breach counsel.

The Amethyst Rapid Intake Engine

For existing partners under emergency triage windows:

1. Isolate the Binary: Run our secure volatile-collection layout script on your isolated analysis guest to capture structural environmental context.
2. Submit the Payload Archive: Pass the encrypted zip package through our secure pipeline containing the raw process memory structures and the target file stub.
3. Receive Your Blueprint: Within our agreed SLA timeframe, your team receives an exhaustive execution matrix, verified C2 host indicators, and clean YARA hunting rules to secure your wider boundary.

Connect with an Engineer

To establish an NDA, discuss a contract engagement, or request emergency Tier-3 overflow support, contact our San Francisco hub directly.

• Email: amethyst@amethyst.systems
• Phone: (408) 475-8662
• Secure Intake & Verification: South San Francisco, CA