Test design, vulnerability assessment, and quality assurance (13K skills)
Analyze DNS logs for signs of hidden command traffic and data theft. Use character randomness, query timing, TXT record inspection, and machine learning to identify suspicious domains and support security monitoring rules.
Hunt for lateral movement, where attackers move between networked systems, using Splunk searches. Connect Windows logins with process and network activity to identify unusual host relationships, trace movement paths, and document affected accounts and systems.
Create detection rules and investigation queries from API access logs to flag repeated identifier probing and unusual authorization responses. Helps investigate attempts to access other users’ data and review logging and rate limits.
Investigate attacks that make legitimate Windows applications load malicious DLL files. This skill examines loading events, digital signatures, file hashes, and unusual locations, then checks process behavior to document suspicious cases and guide remediation.
Investigate Active Directory authentication logs with Splunk and KQL queries to find signs of Golden Ticket attacks, which use forged Kerberos authentication tickets. Examine encryption mismatches, missing ticket requests, unusual lifetimes, and account inconsistencies.
Develop attack detection for SCADA systems that monitor and control industrial equipment. Compare network traffic and process measurements with normal behavior to identify unauthorized commands, altered sensor data, communication disruption, and indicators of known industrial malware.
Analyze Zeek network logs to find lateral movement, when an intruder spreads between internal computers. Examine administrative file sharing, authentication across multiple hosts, and remote service operations to identify suspicious connections and reconstruct incident timelines.
Build a screening pipeline for web pages, PDFs, and images before an AI agent reads them. Extract hidden text, check for malicious instructions with detection models, and record decisions to block or allow content.
Investigate misuse of application identities in Microsoft Entra ID using audit and sign-in logs. Provides detection queries and investigation steps for suspicious credential additions, privileged role assignments, consent grants, and service principal enumeration.
Investigate Entra ID reconnaissance by searching Graph API logs for tool signatures and unusual directory queries. Use KQL, a log query language, to correlate suspicious requests with sign-ins and turn useful searches into Sentinel detection rules.
Scan code, configuration files, and Git history for exposed AWS credentials with TruffleHog. Checks whether detected keys remain active and guides key replacement, incident investigation, and automated checks before commits and during CI/CD.
Deploy and operate Falco to monitor running containers in Kubernetes or Docker. Choose a driver, validate detection rules, confirm alerts for suspicious activity, and forward those alerts to a central security monitoring system.
Build detections for fileless attacks on Windows using process activity, script logs, and endpoint monitoring. Investigate suspicious PowerShell, code injected into running processes, WMI persistence, and registry-based execution with logging guidance and detection query examples.
Assess iOS and Android app security using OWASP MASTG, a mobile security testing guide. Examine app files, runtime behavior, stored data, authentication, and API traffic, then document vulnerabilities, their impact, and suggested fixes.
Deploy and configure Snort 3 to detect suspicious network traffic. Create custom detection rules, tune community rules to reduce false alerts, test them against captured traffic, and forward alerts to a central security monitoring platform.
Configure Zscaler Private Access to replace VPN access with access to specific internal applications. The skill covers connectors, application groups, identity and device checks, browser access, and logging for deployment and migration reviews.
Design and configure VLANs, logical network partitions, to separate employee devices, servers, guests, and IoT equipment. Covers traffic restrictions between zones, switch security settings, and tests to verify that the intended isolation works.
Set up Cisco Duo multi-factor authentication for VPN, RDP, SSH, and web applications. Configure access rules based on users and device health, introduce security keys, and establish authentication monitoring and emergency access procedures.
Contain an active security breach by isolating endpoints, blocking attacker communications, and revoking compromised access. Follow procedures to limit spread between systems, preserve evidence, verify containment, and report remaining risks and business impact.
Deploy Suricata to detect suspicious network traffic or block it inline. Configure protocol inspection, detection rules, and structured EVE JSON logs, then connect logs to analysis platforms and check packet drops and alert quality during operation.
Set up repeatable security tests for LLM apps with Promptfoo and DeepTeam. Connect them to automated build pipelines, detect renewed vulnerabilities to malicious instructions or data leakage, and compare results across model or prompt changes.
Set up decoy files on endpoints and shared folders to detect possible ransomware activity. Monitor modifications, deletions, and renaming with file monitoring tools, connect events to alerts, and test whether the detection and response process works.
Plan and measure defensive deception operations with MITRE Engage. Connect decoy systems and credentials to specific attacker techniques, define measurable objectives, and document operating boundaries, response procedures, and criteria for assessing results.
Design and validate rules that limit communication between servers and containers to necessary connections. The skill covers traffic mapping, label-based policies, staged enforcement, and checks for unauthorized movement between systems within a zero trust architecture.