Mahipal

Investigate suspicious email forwarding and hidden inbox rules that may expose messages after an account compromise. The skill guides log analysis, validation, and reporting, helping analysts document evidence, assess risk, and recommend response actions.

• Investigating external forwarding after an account compromise
• Checking rules that delete security alerts
• Hunting for rules that forward executive emails

Investigate attacks that make legitimate Windows applications load malicious DLL files. This skill examines loading events, digital signatures, file hashes, and unusual locations, then checks process behavior to document suspicious cases and guide remediation.

• Investigating alerts about unsigned DLL files
• Hunting for persistent threats using legitimate applications
• Checking suspicious DLL loading paths

Check training data and machine learning models for malicious changes, including backdoors that cause unexpected behavior on specific inputs. Combine data quality checks, model analysis, and file integrity verification, then document findings and retest after remediation.

• Screening third-party data before training
• Checking downloaded model weights before deployment
• Investigating unexpected behavior on specific inputs

Investigate attackers moving between internal systems by correlating login records with network traffic. Supports detection rules, suspicious SMB and RDP activity analysis, and reports showing attack timelines, affected hosts, and monitoring gaps.

• Investigating attacker movement across internal systems
• Creating rules for suspicious authentication patterns
• Tracing affected hosts after a PsExec alert

Set up Cisco Duo multi-factor authentication for VPN, RDP, SSH, and web applications. Configure access rules based on users and device health, introduce security keys, and establish authentication monitoring and emergency access procedures.

• Adding Duo authentication to VPN and remote server access
• Strengthening authentication for privileged accounts
• Restricting access based on device health

Deploy osquery on Windows, macOS, and Linux to inspect processes, listening ports, software, and system settings using SQL, a database query language. Configure scheduled checks and centralized management to support threat hunting and compliance monitoring.

• Deploying osquery across Windows, macOS, and Linux
• Investigating suspicious processes and network connections with SQL
• Periodically checking software inventories and system settings

Configure OAuth 2.0 authorization for web and mobile apps or service communication. Choose suitable flows, implement PKCE to protect authorization codes, limit permissions, and manage token storage, renewal, and revocation with security checks.

• Implement authorization with PKCE for web and mobile apps
• Configure authorization for service-to-service communication
• Review token storage, renewal, and revocation

Investigate security incidents in IBM QRadar SIEM by connecting events across network, endpoint, and application logs. Build search queries and correlation rules, adjust false positive filters, and create dashboards to track investigation activity.

• Investigating events grouped into QRadar offenses
• Detecting successful logins after repeated failures
• Tuning rules that generate false positives

Deploy decoy accounts, service entries, and policy objects in Active Directory to detect suspicious activity. Configure monitoring rules for Windows security events and validate alerts for credential misuse, reconnaissance, and movement between systems.

• Detecting Kerberoasting with decoy service entries
• Monitoring attempts to use decoy credentials
• Placing credential traps in decoy Group Policy objects

Assess whether stolen Kerberos tickets, credentials used for network authentication, can enable access to other systems during authorized testing. Guide ticket extraction and reuse, review detection indicators, and document evidence for security reports.

• Authorized testing of access through reused tickets
• Checking detection of Kerberos ticket theft
• Collecting evidence for lateral movement reports

Investigate reported phishing emails by checking sender details, links, and attachments. Identify affected recipients and exposed login credentials, guide removal of malicious messages across the organization, and secure compromised accounts with password resets and session revocation.

• Investigating a suspicious email reported by an employee
• Assessing exposure after a link click or credential entry
• Removing phishing messages across organizational mailboxes

Set up repeatable security tests for LLM apps with Promptfoo and DeepTeam. Connect them to automated build pipelines, detect renewed vulnerabilities to malicious instructions or data leakage, and compare results across model or prompt changes.

• Running automated attack tests on every code change
• Blocking merges when security tests fail
• Comparing security across model or prompt versions

Contain an active security breach by isolating endpoints, blocking attacker communications, and revoking compromised access. Follow procedures to limit spread between systems, preserve evidence, verify containment, and report remaining risks and business impact.

• Contain ransomware spreading between servers
• Revoke access through compromised accounts
• Isolate hosts communicating with attacker infrastructure

Analyze RAM dumps with Volatility 3 to investigate suspicious processes, network connections, injected code, and credential theft. Guides memory capture and evidence extraction, then organizes findings into a forensic report for incident response.

• Investigating malware that runs only in memory
• Checking suspicious processes and network connections
• Investigating signs of credential theft

Screen AI application inputs and historical logs for prompt injection, where malicious instructions try to redirect the model. Combine pattern matching, text structure scoring, and a DeBERTa classifier to flag suspicious content and produce JSON results.

• Screening chatbot and AI agent inputs
• Checking external text used in retrieval-based AI applications
• Auditing historical interaction logs for injection attempts

Assess authorized networks through host discovery, service checks, vulnerability identification, and controlled exploitation. Follow a structured testing process to document attack paths, demonstrate business impact, clean up test artifacts, and prioritize remediation.

• Assessing internal or external network security
• Validating firewall rules and network segmentation
• Verifying whether service vulnerabilities are exploitable

Design and validate rules that limit communication between servers and containers to necessary connections. The skill covers traffic mapping, label-based policies, staged enforcement, and checks for unauthorized movement between systems within a zero trust architecture.

• Planning communication rules for a zero trust network
• Separating production and development environments
• Restricting access to critical applications

Plan and run authorized security tests that simulate deceptive emails, calls, text messages, and in-person approaches. Measure employee responses, compare results across test methods, and report gaps in security awareness training and access controls.

• Planning an authorized social engineering assessment
• Measuring responses to simulated phishing
• Evaluating phone and physical access checks

Deploy decoy credentials, documents, and URLs with Canarytokens to detect suspicious access. Guides token generation, placement, alert testing, and inventory tracking, with email or webhook notifications when someone interacts with a planted token.

• Add intrusion alerts to shared folders
• Detect use of decoy cloud credentials
• Monitor decoy documents for signs of data theft

Unwrap layers of obfuscated PowerShell malware to recover hidden commands, additional malicious code, and server addresses. Combines script structure analysis with execution tracing and decoding tools to support incident investigation and detection work.

• Investigating an obfuscated PowerShell script
• Recovering hidden commands and additional malicious code
• Extracting suspicious URLs, IP addresses, and file paths

Configure Windows security logs for threat detection and incident investigation. Covers detailed audit policies, process command line recording, log storage sizing, and centralized forwarding so monitoring systems receive useful authentication and activity records.

• Record process launches with their command lines
• Monitor successful and failed sign-ins
• Forward Windows security events to a central monitoring system

Connect security incidents across organizations by comparing attack indicators, techniques, and timelines. Build relationship graphs and campaign reports that document shared evidence, attribution confidence, and indicators useful for detection.

• Linking incidents that share attack indicators
• Analyzing attacks across partner organizations
• Preparing reports on sustained attack campaigns

Plan authorized voice phishing assessments to evaluate how employees verify callers and report suspicious calls. Organize approved scenarios, record assessment outcomes, and summarize disclosure, verification, and reporting rates to review security awareness training.

• Planning an authorized voice phishing assessment
• Evaluating caller verification and security reporting
• Reviewing the effectiveness of security awareness training

Deploy Suricata to detect suspicious network traffic or block it inline. Configure protocol inspection, detection rules, and structured EVE JSON logs, then connect logs to analysis platforms and check packet drops and alert quality during operation.

• Deploying network intrusion monitoring
• Configuring inline blocking of malicious traffic
• Adding custom detection rules and reducing noisy alerts