Mahipal

Set up an email reporting button and an automated security response workflow. Classify reported messages, extract attack indicators, remove confirmed phishing emails, and send feedback to the people who reported them.

• Deploying a phishing reporting button in Outlook
• Automating triage of a dedicated reporting mailbox
• Retracting confirmed phishing emails across inboxes

Analyze existing user permissions to propose roles for role-based access control, which assigns permissions by job role. Compare candidate role sets, identify overlap and excess access, and validate definitions against business responsibilities.

• Consolidating overlapping access roles
• Redesigning roles from existing permission data
• Reviewing excess and unusual permissions

Build a GitLab CI/CD pipeline with automated checks for vulnerable code, dependencies, container images, running applications, and exposed secrets. Covers scanner configuration, consolidated findings, and approval policies for serious vulnerabilities before production deployment.

• Add automated security scans to .gitlab-ci.yml
• Check dependencies and container images for known vulnerabilities
• Detect credentials and API keys committed to source control

Create a ransomware response playbook aligned with CISA guidance and NIST CSF, a cybersecurity framework. Organize preparation, detection, containment, recovery, and lessons learned into actionable checklists for readiness reviews and simulated incident exercises.

• Creating or updating a ransomware response playbook
• Assessing readiness against CISA guidance
• Validating response steps in a tabletop exercise

Build a central platform for collecting, analyzing, and sharing cyber threat information. Connect MISP, OpenCTI, TheHive, and Cortex to import feeds, add context to suspicious indicators, manage cases, and track platform activity.

• Build a central threat intelligence platform
• Automate threat feed ingestion
• Add context to suspicious IP addresses and domains

Build Splunk pipelines that import threat intelligence and match security events against indicators such as malicious IP addresses, domains, and file hashes. Add source, confidence, and severity details so analysts have context when investigating matches.

• Importing external threat feeds into Splunk
• Matching network and endpoint logs against threat indicators
• Adding threat and asset context to alerts

Investigate domains, IP addresses, and certificates linked to suspected attackers using public sources. This skill guides passive research and relationship mapping to support phishing investigations, external exposure reviews, and threat intelligence reports.

• Investigating infrastructure linked to a phishing campaign
• Adding public evidence to threat actor profiles
• Reviewing an organization's external exposure

Map an organization's internet-facing assets using public information, including domains, indexed services, employee details, and leaked data. Compile findings into a reconnaissance report to support authorized security assessments and identify potential exposure.

• Gathering public information before a penetration test
• Finding unknown internet-facing assets
• Checking public sources for leaked credentials and documents

Assess an internal network from the position of an intruder or malicious insider. Covers discovering systems, testing paths to other machines and higher privileges, demonstrating sensitive data access, and documenting findings with remediation recommendations.

• Assessing damage possible after a workstation compromise
• Reviewing Active Directory paths to higher privileges
• Testing internal network security controls

Build automated pipelines that collect threat indicators, such as malicious IP addresses and file hashes, from multiple feeds. Standardize formats, remove duplicates, assess confidence, and distribute indicators to security monitoring systems for matching and alerts.

• Automating threat feed ingestion
• Standardizing and deduplicating threat indicators
• Distributing indicators to multiple monitoring systems

Build a workflow that extracts and deduplicates threat indicators such as URLs and IP addresses, creates readable reports with links disabled, and prepares standardized STIX 2.1 data for sharing through MISP or TAXII.

• Preparing threat reports with links disabled
• Consolidating indicators from multiple sources
• Distributing threat indicators through MISP or TAXII

Build a ransomware response playbook for security monitoring teams, covering detection, containment, eradication, and recovery. Include log queries, decision trees, evidence collection, backup restoration, and incident reviews to prepare consistent procedures before an attack occurs.

• Creating a standardized ransomware response playbook
• Documenting host isolation and recovery procedures
• Addressing coordination gaps found in tabletop exercises

Turn threat intelligence and detection gaps into testable investigation hypotheses. Use endpoint monitoring and security log queries to examine evidence, validate findings, connect related activity, and document risks and recommended actions in a consistent hunt report.

• Planning a hunt based on threat intelligence
• Investigating gaps in ATT&CK coverage
• Testing hypotheses prompted by unusual activity

Configure SAML identity federation, a way to share authentication between systems, linking on-premises Active Directory with Microsoft Entra ID. Cover single sign-on for cloud applications, user attribute mapping, authentication model choices, and signing certificate management.

• Extending on-premises authentication to cloud resources
• Comparing authentication models for hybrid identity
• Setting up SAML single sign-on for SaaS applications

Build security detection rules in Splunk using SPL, its search language. Use examples for suspicious logins, network traffic, and PowerShell activity to develop searches, add context and severity, test historical logs, and measure false alerts.

• Creating rules to detect suspicious login activity
• Detecting large outbound transfers and access to multiple hosts
• Testing detection rules against historical logs

Create threat detection rules in Sigma, a shared format for security log searches, and convert them for Splunk, Elastic, or Microsoft Sentinel. Validate syntax, test expected matches and false positives, and map coverage to MITRE ATT&CK.

• Turning threat reports into detection rules
• Reusing detection logic across SIEM platforms
• Testing rule matches and reducing false positives

Plan and conduct authorized security tests of AWS, Azure, and GCP environments. Check access permissions, credential exposure, cross-account access, and monitoring, then organize findings into a report with severity, business impact, and remediation guidance.

• Assessing cloud security before production deployment
• Checking access controls after a cloud migration
• Testing monitoring and incident response readiness

Design employee access management across multiple systems using HR records. This skill covers account changes when people join, move roles, or leave, along with role definitions, approval workflows, periodic access reviews, and cleanup of accounts left behind.

• Automating account changes for hires, transfers, and departures
• Finding accounts that remain after employees leave
• Reviewing overlapping roles and unnecessary permissions

Build incident response dashboards that bring affected systems, containment progress, indicators of compromise, and response timelines into one view. Help security teams coordinate active incidents and prepare operational reports and executive briefings.

• Coordinating an active security incident
• Tracking affected systems and containment
• Reviewing response timelines after an incident

Build a repeatable process for Microsoft monthly security updates, from reviewing advisories and ranking vulnerabilities to testing, staged deployment, and verification. Helps teams set response deadlines based on risk and report remaining unpatched systems.

• Establishing a monthly Microsoft security update workflow
• Prioritizing vulnerabilities by exploitation risk
• Planning pilot and production deployment stages

Build a shared incident timeline in Timesketch from endpoint, server, and cloud logs. Search events, add tags and investigator notes, reconstruct the attack sequence, and organize findings into a story for incident reporting.

• Reconstructing the sequence of an incident
• Reviewing evidence with multiple analysts
• Combining Plaso output and other logs

Assess forced authentication and NTLM relay, the forwarding of authentication to another service, in authorized Windows environments. Use Coercer and PetitPotam to document exposed methods and check detection coverage, signing requirements, and Extended Protection for Authentication safeguards.

• Assessing exposed forced authentication methods
• Validating NTLM relay risks in authorized environments
• Generating activity to tune security detections

Support authorized Active Directory assessments of DCSync, which abuses directory replication rights to obtain credential data. Cover replication permission review, Golden Ticket persistence testing, detection validation, and documentation of evidence and remediation recommendations.

• Reviewing accounts with directory replication rights
• Testing DCSync risks in an authorized lab
• Validating detection of replication abuse and forged tickets

Create reusable procedures for responding to security incidents, from detection and containment to recovery. Define decision points, responsibilities, escalation rules, and workflows for security automation platforms so teams can follow a consistent response process.

• Establishing an incident response program
• Documenting phishing or ransomware response procedures
• Designing automated security response workflows