Test design, vulnerability assessment, and quality assurance (13K skills)
Analyze RAM dumps with Volatility 3 to investigate suspicious processes, network connections, injected code, and credential theft. Guides memory capture and evidence extraction, then organizes findings into a forensic report for incident response.
Configure cryptographic key storage and operations through PKCS#11, a standard interface for security devices. Work with physical HSMs or SoftHSM2 for development to generate keys, sign data, encrypt information, and check key export restrictions.
Deploy CrowdStrike Falcon sensors across Windows, macOS, and Linux endpoints. Configure threat prevention and response policies, verify installation and detection, troubleshoot sensor issues, and connect events to SIEM platforms, which collect security logs for analysis.
Plan tiered administration for Active Directory by separating administrative accounts and systems into three levels. Cover dedicated administration workstations, authentication restrictions, and verification checks to help limit credential theft and the spread of compromise.
Build a two-tier certificate authority with OpenSSL and Python, separating the offline root from the issuing authority. Covers server and client certificates, revocation checks, and policies that define certificate usage and trust.
Set up host-based intrusion detection to monitor changes on Windows and Linux endpoints. Configure Wazuh agents, file integrity checks, registry monitoring, alert rules, and automated responses, with guidance on exclusions and centralized security monitoring.
Assess authorized networks through host discovery, service checks, vulnerability identification, and controlled exploitation. Follow a structured testing process to document attack paths, demonstrate business impact, clean up test artifacts, and prioritize remediation.
Build dashboards that show how long vulnerabilities remain unresolved and compare remediation times with severity-based deadlines. Define response policies, automate escalation notices, and report compliance rates and other measures of remediation progress.
Set up Havoc infrastructure for authorized attack simulations, including its command server, traffic listeners, Nginx relay servers, and Windows agents. The skill also covers communication profiles and operational precautions for running the infrastructure.
Set up an email reporting button and an automated security response workflow. Classify reported messages, extract attack indicators, remove confirmed phishing emails, and send feedback to the people who reported them.
Plan and run authorized security exercises that simulate an attacker's actions, from reconnaissance to activities after entry. Map techniques to MITRE ATT&CK, a framework of attack behaviors, and report detection gaps and response performance.
Build a recurring vulnerability scanning process with Nessus, Qualys, or OpenVAS. Prioritize findings using asset importance and known exploitation, then organize remediation deadlines, monitoring dashboards, and automatic tickets for urgent issues.
Map an organization's internet-facing assets using public information, including domains, indexed services, employee details, and leaked data. Compile findings into a reconnaissance report to support authorized security assessments and identify potential exposure.
Build a central vulnerability dashboard with DefectDojo to combine scanner findings, remove duplicates, and track remediation. Includes Docker deployment, automated scan imports from CI/CD pipelines, Jira ticket integration, and API queries for reporting metrics.
Build Splunk pipelines that import threat intelligence and match security events against indicators such as malicious IP addresses, domains, and file hashes. Add source, confidence, and severity details so analysts have context when investigating matches.
Collect indicators of compromise, technical clues such as suspicious domains and file hashes, from incident evidence. Add context and confidence scores, then prepare them for detection, blocking, and structured sharing with partners.
Support authorized Active Directory assessments of DCSync, which abuses directory replication rights to obtain credential data. Cover replication permission review, Golden Ticket persistence testing, detection validation, and documentation of evidence and remediation recommendations.
Assess authorized web applications for pages and APIs that allow access without authentication. Discover hidden URLs and exposed configuration or backup files, compare signed-in and signed-out responses, and document affected resources, impact, and recommended fixes.
Build automated pipelines that collect threat indicators, such as malicious IP addresses and file hashes, from multiple feeds. Standardize formats, remove duplicates, assess confidence, and distribute indicators to security monitoring systems for matching and alerts.
Guide response to suspected or confirmed malware infections across enterprise endpoints. Identify the malware and entry route, assess affected systems, coordinate containment and removal, and document recovery checks, infection timelines, and observable signs of compromise.
Assess forced authentication and NTLM relay, the forwarding of authentication to another service, in authorized Windows environments. Use Coercer and PetitPotam to document exposed methods and check detection coverage, signing requirements, and Extended Protection for Authentication safeguards.
Build a tracking system for vulnerabilities that cannot be fixed on time. Define exception requests, approval workflows, alternative protective measures, expiration checks, and audit records so teams can track accepted risks and support compliance reviews.
Turn threat intelligence and detection gaps into testable investigation hypotheses. Use endpoint monitoring and security log queries to examine evidence, validate findings, connect related activity, and document risks and recommended actions in a consistent hunt report.
Collect evidence from a compromised computer before shutdown or remediation erases it. Preserve memory, network connections, processes, and system state, then record integrity hashes and handling history to support incident investigation and evidence tracking.