Testing & Security skills

Use Scapy, a Python library for working with network packets, to inspect saved captures or authorized live traffic. Summarize protocols and connections, identify suspicious patterns, craft test packets, and export findings as structured JSON reports.

• Investigating saved network captures
• Summarizing traffic volumes, protocols, and connection endpoints
• Checking for SYN floods and DNS data leakage indicators

Investigate Office 365 account compromise by reviewing audit logs, email forwarding rules, mailbox permissions, and application access grants. Produce a JSON report with risk scores and a timeline showing suspicious activity and affected mailboxes.

• Investigating suspicious email forwarding
• Reviewing mailbox delegation changes
• Checking suspicious application access grants

Investigate Linux intrusions using auditd records. Configure audit rules, search events with ausearch, summarize activity with aureport, reconstruct a timeline of suspicious actions, and forward logs to a central security monitoring system.

• Investigating unauthorized access or privilege escalation
• Checking changes to critical files and SSH keys
• Reconstructing an incident timeline

Observe malware in an isolated Cuckoo Sandbox environment and review its processes, network traffic, and system changes. Use the findings to trace infection stages, identify persistence mechanisms, and extract indicators of compromise for behavioral reports.

• Investigating suspicious files after static analysis
• Tracing multi-stage infections and persistence mechanisms
• Extracting indicators of compromise from observed behavior

Analyze suspicious Linux ELF executables through file inspection, runtime tracing, and reverse engineering. Identify malware behavior, network destinations, and persistence mechanisms, then organize findings and indicators for investigations involving servers, containers, or cloud infrastructure.

• Triaging suspicious executables on Linux servers
• Investigating suspected cryptominers
• Analyzing malware found in containers

Analyze suspicious email headers to trace delivery routes and assess sender spoofing. Review SPF, DKIM, and DMARC sender authentication results, compare sender and reply addresses, and examine links and attachment hashes for phishing indicators.

• Triaging a suspicious email reported by a user
• Checking whether a sender domain was spoofed
• Tracing the delivery route of a phishing email

Extract Cobalt Strike Beacon settings from executable files and memory dumps to identify command-and-control servers, communication patterns, and identifying markers. Use the findings to compare samples, investigate incidents, and develop file and network detection rules.

• Extract Beacon settings from suspicious files
• Identify command-and-control servers and traffic patterns
• Compare samples using watermark identifiers

Use Wireshark and tshark to capture and inspect network packets, the small units of network communication. Investigate suspicious connections and protocol problems, extract transferred files, and export evidence and summaries for incident investigations.

• Investigating suspected intrusions or data leaks
• Diagnosing retransmissions and DNS failures
• Checking traffic against firewall and IDS rules

Inspect suspicious Android APK files without running them. Analyze permissions, app components, suspicious code patterns, and network indicators, then produce a JSON risk report to support malware triage and detection rule development.

• Triage suspicious APK files without running them
• Inspect dangerous permission combinations and suspicious API calls
• Extract network indicators for malware detection rules

Compare evidence from cyber operations to assess which attacker may be responsible. Weigh shared infrastructure, attack methods, malware similarities, timing, and language clues against competing explanations, then report attribution findings with justified confidence levels.

• Assessing possible attackers during an incident investigation
• Comparing infrastructure and attack methods across campaigns
• Evaluating conflicting evidence against multiple hypotheses

Acquire Linux memory with LiME and examine it using Volatility 3. Extract processes, network connections, command history, loaded kernel modules, and signs of injected code to support investigations of compromised Linux systems.

• Acquiring memory from a compromised Linux system
• Comparing process lists to investigate hidden processes
• Reviewing command history and network connections

Analyze DNS query logs for signs of hidden data transfers and attacker command channels. This skill uses unusual name lengths, randomness, and traffic volumes, then correlates findings with endpoint processes and estimates possible data loss.

• Investigating suspected data theft through DNS
• Finding algorithmically generated domains used by malware
• Reviewing hosts with unusually high DNS query volumes

Prepare for CMMC Level 2, a cybersecurity certification for defense contractors. Define the systems handling controlled information, review security requirements, calculate the SPRS assessment score, and organize remediation plans and evidence into a readiness report.

• Define the assessment scope for systems handling controlled information
• Calculate an SPRS score and prioritize unmet security requirements
• Prepare security plans, remediation milestones, and assessment evidence

Analyze Solidity smart contracts with Slither and Mythril before Ethereum deployment. Combine code inspection with execution path analysis, review potential vulnerabilities, remove duplicate findings, and produce an audit report with severity ratings and suggested fixes.

• Checking Solidity contracts before deployment
• Investigating reentrancy and access control weaknesses
• Consolidating findings from Slither and Mythril

Analyze access logs from AWS S3, GCS, and Azure Blob Storage to spot unusual downloads, unfamiliar IP addresses, and request spikes. Compare activity with normal patterns and prioritize findings for suspected data theft investigations.

• Investigating suspected data theft from cloud storage
• Finding bulk downloads outside normal working hours
• Checking unfamiliar IP addresses and sudden request spikes

Examine captured network traffic for hidden malware communications in DNS, ICMP, and HTTP. Analyze domain patterns, packet sizes, and traffic frequency to identify suspicious channels used for remote control or data theft.

• Investigating suspicious DNS, ICMP, or HTTP traffic
• Hunting for hidden malware control channels in packet captures
• Assessing possible data theft through unusual network traffic

Analyze malware communication with command servers to understand periodic check-ins, message formats, encoded data, and backup destinations. Produces a structured analysis report and network detection rules based on captured traffic and malware code.

• Investigating malware communication in captured traffic
• Measuring periodic check-in intervals and timing variation
• Mapping command servers and backup destinations

Analyze access logs from AWS API Gateway, Kong, and Nginx with pandas, a Python data analysis library. Examine resource access patterns, authentication failures, and suspicious requests to investigate API abuse and inform detection rules.

• Investigating sequential access to resource IDs
• Examining spikes in authentication failures
• Checking for rate limit bypass and injection attempts

Analyze Kubernetes API server audit logs to identify pod access, secret reads, permission changes, privileged pods, and anonymous requests. Use the event patterns to reconstruct suspicious activity and develop detection rules for security monitoring systems.

• Tracing API activity during a suspected cluster compromise
• Reviewing access to Kubernetes secrets
• Investigating permission changes and privileged pods

Examine Windows shortcuts and Jump Lists, records of recently used files, to reconstruct user activity. Extract paths, timestamps, and device details with LECmd and JLECmd, including traces that remain after target files are deleted.

• Reconstructing file access and program execution timelines
• Investigating access to files that have been deleted
• Examining traces of removable media use

Monitor public certificate issuance records to find suspected phishing domains, brand lookalikes, and unauthorized certificates. Use crt.sh for historical searches and Certstream for live alerts, then summarize suspicious findings and detection reasons in a report.

• Monitor domains that resemble a company brand
• Investigate certificate issuance history
• Discover subdomains in public certificate records

Map threat groups’ documented attack techniques in MITRE ATT&CK Navigator. Creates visual layers and heatmaps, compares groups, and highlights techniques missing from existing detection coverage to support security reporting and decisions about detection priorities.

• Visualizing a threat group's attack techniques
• Comparing techniques shared by multiple threat groups
• Finding gaps in existing detection coverage

Investigate suspicious Azure activity by querying administrative and sign-in logs. Create KQL queries, Azure's log search language, to examine role assignments, resource changes, unusual access, and other signals for cloud security monitoring.

• Investigate suspicious administrative activity in Azure
• Check newly added administrator roles
• Review resource and network security rule changes

Inspect Windows startup entries with Sysinternals Autoruns to find possible malware persistence, settings that let malware restart automatically. Review signatures, file locations, and changes from a clean baseline to identify entries that need investigation.

• Investigating suspicious startup entries on a Windows endpoint
• Comparing startup settings against a clean baseline
• Checking for remaining malware startup entries after cleanup