Testing & Security skills

Analyze how ransomware encrypts files and manages keys to assess whether decryption is feasible. Examine implementation weaknesses, check existing decryptors, and document recovery options with technical reasons for the assessment.

• Assessing whether ransomware-encrypted files can be decrypted
• Examining encryption routines and key management
• Investigating key recovery from memory dumps

Search public TLS certificate records through crt.sh and pycrtsh to investigate lookalike domains, unexpected certificate issuers, and untracked IT assets. Compare domain spellings and review certificate details to support phishing detection and certificate monitoring.

• Finding domains that imitate a brand
• Reviewing unexpected certificate issuers
• Investigating untracked domains and IT assets

Inspect Linux scheduled tasks, services, shell profiles, shared library settings, and SSH keys for mechanisms that maintain attacker access. Correlate findings with audit logs to produce a timeline, risk scores, and remediation commands.

• Investigating how attackers maintained access to a Linux host
• Hunting for suspicious scheduled tasks and services
• Building a timeline from persistence-related audit events

Analyze threat intelligence stored in MISP, a platform for sharing security threat data. Summarize event counts, indicator types, attacker groups, and trends over time to create a threat landscape report for a chosen period.

• Create a threat landscape report for the past 90 days
• Summarize attacker activity and frequently tagged attack techniques
• Track changes in submitted threat indicator types and volumes

Analyze Windows Prefetch files, which record application execution data, using Python. Reconstruct execution timelines, review run counts and accessed resources, and identify suspicious programs or signs that an executable has been renamed to disguise its identity.

• Reconstructing a program execution timeline
• Investigating potentially renamed executables
• Reviewing suspicious tools and execution frequency

Investigate malicious software delivered through trusted updates or dependencies. Compare suspect files with legitimate versions, examine signing anomalies and injected code, and organize evidence to assess the infection path and downstream impact.

• Comparing suspicious updates with legitimate versions
• Investigating software signatures and injected code
• Tracing infection through build artifacts

Reconstruct USB device usage on Windows by comparing registry records, Event Logs, and device installation logs. Identify devices, correlate connection times and drive letters, and build a timeline for removable media investigations.

• Investigating suspected data removal through USB storage
• Checking whether unapproved USB devices were connected
• Correlating USB connections with malware execution

Inspect suspicious PDFs without opening them in a reader. Use PDFiD, pdf-parser, and peepdf to examine internal objects, extract scripts, embedded files, and URLs, and document how the suspected attack works.

• Triage suspicious PDF email attachments
• Investigate embedded JavaScript and automatic actions
• Extract embedded files and external URLs

Audit AWS S3 buckets for public exposure, excessive permissions, and gaps in encryption or versioning settings. Use AWS CLI, Prowler, and access analysis to compile findings, prioritize issues, and plan or apply configuration fixes.

• Reviewing S3 settings in a newly onboarded AWS account
• Investigating alerts about publicly exposed buckets
• Preparing periodic access control audit reports

Analyze Windows event logs in Splunk to investigate suspicious logins, privilege changes, persistence, and movement between computers. Build detection searches and organize endpoint activity into timelines, with findings linked to MITRE ATT&CK attack techniques.

• Investigating suspicious Windows logins
• Building detection searches in Splunk
• Creating incident timelines

Simulate device-code and app-consent phishing in an explicitly authorized Microsoft Entra ID environment. Assess whether authentication and consent controls prevent token misuse, map reachable Microsoft 365 resources, and document findings with remediation recommendations.

• Run authorized Microsoft 365 phishing exercises
• Validate Conditional Access and MFA controls
• Test restrictions on app consent

Audit Kubernetes RBAC, the rules that assign access through roles, to identify excessive permissions, risky role assignments, and paths to gaining higher privileges. Review service accounts and produce findings with recommended permission changes.

• Reviewing access permissions in shared Kubernetes clusters
• Finding accounts that can read secrets or gain higher privileges
• Checking service account token mounts

Investigate malware that survives OS reinstallation by checking UEFI firmware, boot files, and Secure Boot settings. Use chipsec and supporting tools to compare trusted baselines, identify bootkit indicators, and document findings.

• Investigating reinfection after OS reinstallation
• Checking unexpected Secure Boot changes
• Comparing firmware against a trusted vendor baseline

Turn cyber threat intelligence reports into a searchable library of attacker behaviors linked to MITRE ATT&CK techniques. Export structured STIX 2.1 data, a threat information exchange format, and create detection rule templates from documented activity.

• Cataloging attacker behaviors from threat intelligence reports
• Organizing attack patterns by tactic, technique, and threat actor
• Creating detection rule templates from documented behaviors

Audit MCP servers, which provide external tools to AI agents, for hidden instructions, changes after approval, unsafe internal requests, and missing authentication. Use mcp-scan and manual checks to document risks and recommended fixes.

• Reviewing an MCP server before adding it to an agent
• Auditing an internally developed MCP server
• Checking approved tools for unexpected changes

Analyze Windows Amcache records to investigate applications, deleted executable traces, and drivers. Extract file details, compare SHA-1 hashes with malware databases, and combine records into a timeline to support incident investigations.

• Investigating traces of deleted executables
• Checking software installed during an incident
• Comparing file hashes with malware databases

Analyze a software bill of materials, an inventory of software components, against known vulnerability records. Trace indirect dependencies, assess risk, and produce reports that help teams prioritize fixes and review supplier software.

• Assessing vulnerabilities in vendor-provided software inventories
• Checking whether a newly disclosed CVE affects deployed software
• Adding SBOM vulnerability checks to CI/CD

Audit Kubernetes access rules to find excessive permissions and service account token abuse paths. Trace which users or workloads could gain cluster administrator access, then produce prioritized findings and recommendations for reducing permissions.

• Reviewing Kubernetes privilege escalation paths
• Checking permissions after an RBAC change
• Tracing workloads with overprivileged service accounts

Map attacker behaviors and indicators of compromise, or traces of an intrusion, to MITRE ATT&CK techniques. Build coverage heatmaps, compare threat groups, and identify monitoring gaps to guide detection improvements and threat intelligence reporting.

• Mapping attacker behaviors and intrusion traces to ATT&CK techniques
• Visualizing detection coverage with ATT&CK Navigator
• Identifying attack techniques missing from monitoring

Collect and organize victim postings from ransomware data leak sites through tracking feeds. Analyze group activity over time, compare sector and country patterns, and produce threat reports with risk assessments and defensive recommendations.

• Track monthly activity across ransomware groups
• Assess ransomware exposure by sector or country
• Identify newly observed ransomware groups

Investigate ransomware payment addresses using public blockchain records. Trace transfers, group addresses likely controlled by the same entity, identify links to exchanges or mixing services, and organize findings into a report for incident responders and investigators.

• Investigating a payment address found in a ransom note
• Tracing funds after a ransom payment
• Comparing related wallets across ransomware incidents

Search Windows PowerShell logs for traces of Empire, a framework used after a system is compromised. Identify characteristic launch commands, encoded code, module calls, and communication paths, then report suspicious events with timelines and severity scores.

• Investigating suspected Empire activity
• Checking encoded commands and communication paths
• Building detection rules from Empire indicators

Reconstruct Windows folder browsing activity from Shellbag registry records using SBECmd and ShellBags Explorer. Investigate traces of deleted directories, disconnected USB drives, and network shares while accounting for limits in what the records and timestamps show.

• Reconstructing a user's folder browsing history
• Investigating browsing traces on disconnected USB drives
• Checking access traces for deleted folders

Analyze Windows PowerShell event logs to reconstruct scripts split across records and identify encoded commands, suspicious downloads, and security scanning bypass attempts. Produce a report with recovered scripts, risk scores, and mappings to documented attack techniques.

• Investigating suspicious PowerShell activity
• Reconstructing scripts split across log records
• Finding encoded commands and suspicious downloads