Mahipal

Prepare for CMMC Level 2, a cybersecurity certification for defense contractors. Define the systems handling controlled information, review security requirements, calculate the SPRS assessment score, and organize remediation plans and evidence into a readiness report.

• Define the assessment scope for systems handling controlled information
• Calculate an SPRS score and prioritize unmet security requirements
• Prepare security plans, remediation milestones, and assessment evidence

Map threat groups’ documented attack techniques in MITRE ATT&CK Navigator. Creates visual layers and heatmaps, compares groups, and highlights techniques missing from existing detection coverage to support security reporting and decisions about detection priorities.

• Visualizing a threat group's attack techniques
• Comparing techniques shared by multiple threat groups
• Finding gaps in existing detection coverage

Create disk images for investigations using dd or dcfldd on Linux. The workflow covers write protection, bit-for-bit copying, hash checks to verify integrity, and documentation of the acquisition process.

• Preserving a suspect drive before investigation
• Creating evidence copies of USB devices or memory cards
• Verifying that a disk image matches its source

Investigate suspicious Azure activity by querying administrative and sign-in logs. Create KQL queries, Azure's log search language, to examine role assignments, resource changes, unusual access, and other signals for cloud security monitoring.

• Investigate suspicious administrative activity in Azure
• Check newly added administrator roles
• Review resource and network security rule changes

Analyze Chrome, Edge, and other Chromium browser profiles with Hindsight to reconstruct web activity. Combine browsing history, downloads, cookies, and other stored records into a chronological timeline, with XLSX, JSON, or SQLite output for investigation.

• Reconstructing browsing activity during incident response
• Checking download times and source URLs
• Comparing cookies and history in insider threat investigations

Inspect Windows startup entries with Sysinternals Autoruns to find possible malware persistence, settings that let malware restart automatically. Review signatures, file locations, and changes from a clean baseline to identify entries that need investigation.

• Investigating suspicious startup entries on a Windows endpoint
• Comparing startup settings against a clean baseline
• Checking for remaining malware startup entries after cleanup

Examine Linux authentication logs, shell history, SSH keys, scheduled tasks, and system settings to investigate a compromise. Help reconstruct activity, identify ways attackers maintain access, and document suspicious accounts, files, and configuration changes.

• Investigating a potentially compromised Linux server
• Finding mechanisms that maintain unauthorized access
• Tracing user activity through logs and command history

Analyze NetFlow v9 and IPFIX records, which summarize network connections, to spot traffic spikes, scanning, unusual outbound transfers, and periodic connections. Compare traffic against normal patterns and produce a prioritized findings report.

• Investigating sudden increases in network traffic
• Checking unusual outbound transfers for possible data theft
• Finding periodic connections to external control servers

Investigate Linux intrusions using auditd records. Configure audit rules, search events with ausearch, summarize activity with aureport, reconstruct a timeline of suspicious actions, and forward logs to a central security monitoring system.

• Investigating unauthorized access or privilege escalation
• Checking changes to critical files and SSH keys
• Reconstructing an incident timeline

Analyze suspicious Linux ELF executables through file inspection, runtime tracing, and reverse engineering. Identify malware behavior, network destinations, and persistence mechanisms, then organize findings and indicators for investigations involving servers, containers, or cloud infrastructure.

• Triaging suspicious executables on Linux servers
• Investigating suspected cryptominers
• Analyzing malware found in containers

Monitor public certificate issuance records to find suspected phishing domains, brand lookalikes, and unauthorized certificates. Use crt.sh for historical searches and Certstream for live alerts, then summarize suspicious findings and detection reasons in a report.

• Monitor domains that resemble a company brand
• Investigate certificate issuance history
• Discover subdomains in public certificate records

Analyze malware communication with command servers to understand periodic check-ins, message formats, encoded data, and backup destinations. Produces a structured analysis report and network detection rules based on captured traffic and malware code.

• Investigating malware communication in captured traffic
• Measuring periodic check-in intervals and timing variation
• Mapping command servers and backup destinations

Use Scapy, a Python library for working with network packets, to inspect saved captures or authorized live traffic. Summarize protocols and connections, identify suspicious patterns, craft test packets, and export findings as structured JSON reports.

• Investigating saved network captures
• Summarizing traffic volumes, protocols, and connection endpoints
• Checking for SYN floods and DNS data leakage indicators

Map intrusion evidence to the seven stages of the Lockheed Martin Cyber Kill Chain, a model of attack progression. Show where defenses worked or missed activity, and recommend prioritized controls that could interrupt attacks earlier.

• Mapping attack progression after an incident
• Finding detection gaps at each attack stage
• Planning layered defenses to stop attacks earlier

Analyze access logs from AWS S3, GCS, and Azure Blob Storage to spot unusual downloads, unfamiliar IP addresses, and request spikes. Compare activity with normal patterns and prioritize findings for suspected data theft investigations.

• Investigating suspected data theft from cloud storage
• Finding bulk downloads outside normal working hours
• Checking unfamiliar IP addresses and sudden request spikes

Analyze Cobalt Strike communication profiles and Beacon payload configurations to extract request paths, headers, timing, and process injection settings. Turn these indicators into a JSON report and network detection rules for Suricata or Snort.

• Analyzing a captured Malleable C2 profile
• Extracting communication settings from a Beacon payload
• Creating Suricata or Snort detection rules

Compare evidence from cyber operations to assess which attacker may be responsible. Weigh shared infrastructure, attack methods, malware similarities, timing, and language clues against competing explanations, then report attribution findings with justified confidence levels.

• Assessing possible attackers during an incident investigation
• Comparing infrastructure and attack methods across campaigns
• Evaluating conflicting evidence against multiple hypotheses

Investigate Linux kernel rootkits, malware that hides inside the operating system's core. Analyze memory dumps with Volatility3, compare system views, and run live scans to identify hidden modules, altered calls, and suspicious inconsistencies.

• Investigate suspected Linux rootkit infections
• Find hidden kernel modules in memory dumps
• Compare module lists for signs of concealment

Test iOS apps while they run using Objection and Frida, tools for inspecting and changing runtime behavior. Examine stored credentials, files, memory, and authentication calls, and evaluate client-side protections during authorized security assessments.

• Check stored iOS app data for sensitive information
• Inspect HTTPS traffic during authorized testing
• Observe authentication behavior without source code

Analyze captured RAM with Volatility to investigate suspicious processes, injected code, network connections, and other evidence of compromise. The skill guides memory investigations and organizes findings into timelines and reports, including malware traces absent from disk.

• Investigating fileless malware after an endpoint alert
• Finding hidden processes and injected code
• Linking suspicious processes to network connections

Analyze access logs from AWS API Gateway, Kong, and Nginx with pandas, a Python data analysis library. Examine resource access patterns, authentication failures, and suspicious requests to investigate API abuse and inform detection rules.

• Investigating sequential access to resource IDs
• Examining spikes in authentication failures
• Checking for rate limit bypass and injection attempts

Examine suspicious Word, Excel, and PowerPoint documents by extracting macros and untangling code designed to hide its purpose. Identify download addresses, execution triggers, and attack steps, then document findings and indicators for detecting related threats.

• Investigating suspicious email attachments
• Finding download addresses hidden in VBA code
• Examining legacy Excel 4.0 macros

Assess Shadow Credentials account takeover during authorized Active Directory testing. Examine permissions that allow public key registration, validate authentication without a password reset, and document credential cleanup, detection opportunities, and access control changes needed for remediation.

• Assessing risky permissions identified in BloodHound
• Validating account takeover without resetting a password
• Generating directory change records during security exercises

Analyze Go malware binaries in Ghidra by extracting build metadata, function names, dependencies, and relevant strings. Use GoResolver to help recover obscured names and organize functions so analysts can focus their reverse engineering work.

• Investigating the structure of a Go malware sample
• Recovering function names from stripped or obfuscated binaries
• Identifying embedded Go modules and dependencies