Mahipal

Find npm and PyPI packages that imitate trusted package names to exploit typing mistakes. Compare spelling similarity, publication dates, downloads, and maintainer details, then rank suspicious candidates and produce reports or blocklists for further review.

• Auditing project dependencies for misleading package names
• Monitoring names similar to important packages
• Investigating a suspected misspelled package installation

Investigate signs of Mimikatz credential theft using command lines, access to Windows authentication memory, file indicators, and known modules in memory. Correlate endpoint and security logs to assess suspicious alerts, document evidence, and recommend response actions.

• Investigating alerts about Windows authentication memory access
• Hunting for signs of credential theft
• Assessing compromise scope during incident response

Examine Windows endpoint logs for attempts to avoid security detection, including log clearing, altered file timestamps, injected code, and disabled protection. Correlate events to investigate suspicious behavior and develop detection rules with context for legitimate activity.

• Investigating cleared logs and altered file timestamps
• Checking suspected attempts to disable security tools
• Finding abuse of legitimate Windows utilities

Investigate attackers moving between internal systems by correlating login records with network traffic. Supports detection rules, suspicious SMB and RDP activity analysis, and reports showing attack timelines, affected hosts, and monitoring gaps.

• Investigating attacker movement across internal systems
• Creating rules for suspicious authentication patterns
• Tracing affected hosts after a PsExec alert

Examine Windows and Active Directory logs for attempts to extract passwords and other credentials. Identify suspicious memory access and database exports, correlate events with user and host context, and produce findings with severity ratings and detection queries.

• Investigating alerts about suspicious LSASS access
• Finding signs of SAM or NTDS.dit extraction
• Creating detection queries for Splunk or Elastic

Assess Bluetooth Low Energy devices by capturing wireless traffic, inspecting available data services, and checking pairing security. Identify signs of interception, reused commands, and data access that lacks authentication.

• Assess BLE security on IoT devices
• Check whether devices accept replayed commands
• Investigate suspicious pairing and device impersonation

Analyze DNS logs for signs of hidden command traffic and data theft. Use character randomness, query timing, TXT record inspection, and machine learning to identify suspicious domains and support security monitoring rules.

• Investigating suspected DNS tunneling
• Classifying algorithmically generated domains
• Detecting periodic DNS beacon traffic

Analyze endpoint, cloud storage, and email logs for signs of insider data theft. Use pandas to compare upload volumes with normal user behavior and examine data loss prevention alerts, unusual file access, and activity outside working hours.

• Investigating suspected insider data theft
• Finding users with unusually large uploads
• Reviewing file access outside working hours

Investigate Windows malware that runs in memory or abuses legitimate system tools. Use logs, registry entries, and memory dumps to trace persistence, identify suspicious activity, and produce detection rules and an analysis report.

• Investigating suspicious PowerShell activity
• Checking WMI persistence mechanisms
• Finding malicious code in memory dumps

Inspect DNP3 traffic, a communication protocol used in industrial control systems, for unauthorized sources and unexpected commands. The skill compares captured traffic with normal patterns and reports suspicious control actions, restarts, and file operations.

• Investigating suspicious DNP3 control commands
• Checking substation traffic against normal patterns
• Preparing DNP3 intrusion detection rules

Investigate business email compromise, where impersonated executives or vendors request payments or sensitive data. Check sender details, unusual communication patterns, mailbox changes, and payment approval procedures to develop detection rules and verification controls.

• Investigating emails impersonating executives or vendors
• Reviewing requests to change vendor bank details
• Building detection rules for fraudulent payment requests

Develop attack detection for SCADA systems that monitor and control industrial equipment. Compare network traffic and process measurements with normal behavior to identify unauthorized commands, altered sensor data, communication disruption, and indicators of known industrial malware.

• Introducing intrusion detection in a SCADA environment
• Investigating suspected attacks on industrial control systems
• Creating detection rules for industrial protocol abuse

Find dependency confusion risks, where a public package can replace an internal package with the same name. Review dependency files, identify exposed names, and guide registry restrictions and recurring CI checks to prevent substitution.

• Auditing projects that mix private and public package registries
• Checking exposure after internal package names have leaked
• Restricting package sources to approved private registries

Set up and operate Amazon GuardDuty to detect threats in AWS. Configure protection features, centralize findings across accounts, investigate suspicious activity, and build automated responses with EventBridge and Lambda, including containment of potentially compromised resources.

• Setting up threat detection for AWS accounts
• Investigating credential abuse and compromised instances
• Automating responses to high-severity findings

Check training data and machine learning models for malicious changes, including backdoors that cause unexpected behavior on specific inputs. Combine data quality checks, model analysis, and file integrity verification, then document findings and retest after remediation.

• Screening third-party data before training
• Checking downloaded model weights before deployment
• Investigating unexpected behavior on specific inputs

Set up AI email screening that compares writing style and communication habits to identify impersonation and suspicious payment requests. Connect detection policies to quarantine, warning banners, and analyst review workflows.

• Detecting executive impersonation in emails
• Reviewing vendor payment change requests
• Flagging unusual employee email behavior

Scan code, configuration files, and Git history for exposed AWS credentials with TruffleHog. Checks whether detected keys remain active and guides key replacement, incident investigation, and automated checks before commits and during CI/CD.

• Auditing Git history for exposed AWS keys
• Adding credential checks before commits and in CI/CD
• Investigating credential exposure after a GuardDuty alert

Analyze Zeek DNS logs for possible data theft hidden in domain queries. The skill examines unusual character patterns, long labels, distinct subdomains, and query volume, then ranks suspicious domains and produces a JSON evidence report.

• Investigating suspected DNS tunneling
• Finding possible data leaks hidden in DNS queries
• Ranking suspicious domains and identifying source IPs

Build a screening pipeline for web pages, PDFs, and images before an AI agent reads them. Extract hidden text, check for malicious instructions with detection models, and record decisions to block or allow content.

• Screening external content before an agent reads it
• Checking uploaded PDFs and images for hidden instructions
• Scanning documents before adding them to a knowledge base

Create and tune Falco rules to detect possible container escapes, where a container gains access to its host. Define detection conditions, alert priorities, and output fields, then refine exceptions to reduce false positives.

• Writing rules for suspicious host filesystem access
• Investigating noisy container escape alerts
• Reusing detection conditions through macros and lists

Investigate DCSync attacks, which abuse Active Directory replication to steal password hashes. Use audit events and network traffic to identify suspicious replication requests, examine their sources, and check for subsequent credential misuse.

• Hunting for credential theft in Active Directory
• Investigating suspected Mimikatz or Impacket use
• Auditing accounts with directory replication permissions

Investigate possible insider threats by correlating endpoint and security logs. Examine unusual data access, off-hours activity, bulk downloads, and privilege abuse, then document supporting evidence, risk, confidence, and recommended actions after checking the context for false positives.

• Investigating bulk downloads before an employee leaves
• Reviewing data access outside an employee's duties
• Examining unauthorized queries by service accounts

Analyze Zeek network logs to find lateral movement, when an intruder spreads between internal computers. Examine administrative file sharing, authentication across multiple hosts, and remote service operations to identify suspicious connections and reconstruct incident timelines.

• Tracing spread to other computers after an initial compromise
• Investigating unauthorized transfers to administrative shares
• Finding one account authenticating to many internal hosts

Monitor local network traffic for ARP spoofing, where false address mappings can redirect traffic. Use ARPWatch, Wireshark, switch inspection settings, and Python monitoring to flag address changes, duplicate IP claims, gateway impersonation, and unusual ARP volumes.

• Investigating suspected interception on a local network
• Monitoring changes in IP-to-MAC address mappings
• Checking duplicate IP claims and gateway impersonation