테스트·보안 스킬

Investigate Pass-the-Hash attacks, where stolen password hashes are reused for authentication. Examine unusual NTLM logins alongside credential theft indicators, validate suspicious findings across security logs, and document evidence, affected hosts, confidence, and recommended responses.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Hunting for movement using stolen password hashes
• Triaging suspicious NTLM login alerts
• Assessing the scope of a compromise

Evaluate threat intelligence platforms, which collect and organize cyber threat information. Define requirements, compare integrations and operating costs, plan practical trials, and use weighted scoring to select a platform and outline its rollout.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Preparing requirements for TIP procurement
• Comparing platforms before a TIP migration
• Checking whether an existing TIP meets team needs

Investigate malicious code placed inside legitimate Windows processes using memory analysis, event logs, and API monitoring. Identify injection methods, examine extracted code, and produce evidence reports and detection rules for suspicious process behavior.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Investigating unexpected connections from legitimate processes
• Finding injected code in memory dumps
• Classifying process hollowing and other injection methods

Audit GitHub Actions workflows and CI/CD configurations for supply chain risks. Use Python and YAML parsing to identify unpinned actions, unsafe event expressions, excessive permissions, dependency confusion, and potential exposure of secrets in build pipelines.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Reviewing GitHub Actions workflow security
• Checking action version pinning
• Finding unsafe event expressions in scripts

Inspect npm packages and dependency files for malicious installation scripts, credential theft, and self-spreading behavior. Use GuardDog scanning, source inspection, known-malicious version checks, and isolated execution to produce an evidence-based assessment.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Vetting a new npm dependency before adoption
• Reviewing dependency files during code review
• Checking lockfiles against known-malicious versions

Assess an authorized Active Directory environment by simulating attacks against credentials, permissions, and trust relationships. Use BloodHound and related testing tools to identify paths to administrator access, evaluate detection capabilities, and document findings with remediation recommendations.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Assessing Active Directory security with written authorization
• Finding paths from ordinary users to administrator access
• Reviewing Kerberos and delegation settings

Find npm and PyPI packages that imitate trusted package names to exploit typing mistakes. Compare spelling similarity, publication dates, downloads, and maintainer details, then rank suspicious candidates and produce reports or blocklists for further review.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Auditing project dependencies for misleading package names
• Monitoring names similar to important packages
• Investigating a suspected misspelled package installation

Monitor Modbus traffic in industrial control networks to identify unauthorized writes, unusual commands, and departures from normal communication. Use packet analysis and intrusion detection rules to investigate suspected controller changes and produce reports with recommended actions.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Investigating unauthorized changes to PLC registers
• Setting up Modbus intrusion detection rules
• Checking communication patterns after a suspected compromise

Investigate excessive privileges inside Kubernetes pods by reviewing security settings, runtime events, and audit logs. Use admission policies to restrict risky configurations and Falco monitoring to detect suspicious privilege changes and container activity.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Finding pods running as root or in privileged mode
• Reviewing host filesystem access and dangerous Linux permissions
• Detecting privilege changes while containers are running

Analyze Windows authentication logs for repeated password guesses against Remote Desktop services. Group failures by source IP and account, check for later successful logins, and produce a JSON report highlighting attack patterns and possible compromise.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Investigate repeated login failures on exposed RDP services
• Identify accounts targeted by password guessing
• Check for successful logins after repeated failures

Find undocumented API endpoints, the addresses applications send requests to, by comparing traffic with OpenAPI specifications and examining cloud settings and source code. Build an inventory with activity and risk details to review forgotten or outdated APIs.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Finding API endpoints missing from documentation
• Auditing forgotten test APIs and outdated versions
• Prioritizing undocumented APIs for security review

Investigate attempts to gain higher privileges on Windows and Linux using endpoint and security logs. Guide hypothesis testing, evidence analysis, false-positive checks, and reporting to help assess suspicious privilege changes and the scope of a compromise.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Hunting for signs of privilege escalation
• Investigating alerts about suspicious privilege changes
• Assessing compromise scope during incident response

Investigate NTLM relay, an attack that forwards authentication messages to another service, by comparing Windows login events with host inventories. Use the supplied queries and audits to identify suspicious sources, weaker authentication, and gaps in signing enforcement.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Investigating mismatched login source addresses and hostnames
• Building SIEM rules to detect NTLM relay
• Auditing SMB and LDAP signing requirements

Audit Secure Boot settings, revoked boot components, and EFI startup files on Linux and Windows. The skill helps identify missing protections and signs of bootkits, malicious software that runs before the operating system.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Auditing Secure Boot after a bootkit advisory
• Checking revocation updates across managed devices
• Investigating suspected bootkit infections

Assess whether a container can escape its isolation and reach the host during an authorized security test. Review privileges, shared mounts, Docker socket exposure, and runC vulnerabilities, then document demonstrated impact and remediation.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Testing container escape within an approved scope
• Assessing the impact of privileged or hostPath workloads
• Validating controls that block container escape

Configure email security gateways to detect targeted phishing messages. Set up sender impersonation protection, link checks, isolated attachment analysis, and custom rules, then validate quarantine actions and alerts for suspected attacks.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Strengthening protection against targeted phishing
• Detecting executive or vendor impersonation
• Reviewing link and attachment protection

Develop network monitoring for signs that may precede ransomware encryption. Uses detection rules, linked log events, and threat intelligence to identify suspicious activity and define how alerts should be investigated, prioritized, and escalated.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Creating detection rules for activity before ransomware encryption
• Linking suspicious logins, scans, and file share access
• Investigating unusual internal network communications

Investigate stolen OAuth tokens and their reuse in Microsoft Entra ID through sign-in log analysis. Follow response procedures for revoking sessions and reviewing app permissions, and configure device-bound token protection and session monitoring for Azure and M365 environments.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Investigating anomalous token usage alerts
• Responding to suspected session hijacking
• Finding token reuse in sign-in logs

Investigate signs of Mimikatz credential theft using command lines, access to Windows authentication memory, file indicators, and known modules in memory. Correlate endpoint and security logs to assess suspicious alerts, document evidence, and recommend response actions.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Investigating alerts about Windows authentication memory access
• Hunting for signs of credential theft
• Assessing compromise scope during incident response

Analyze Modbus industrial network traffic to identify unauthorized commands, write operations, and unusual polling intervals. Compare activity with normal traffic patterns and allowed operations, then report anomalies by type and severity.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Investigating suspicious Modbus traffic
• Establishing normal polling patterns
• Defining allowed Modbus function codes

Monitor requests to an AI prediction API for signs of model copying or training-data exposure. Test an authorized model with simulated attacks, measure the risk, and evaluate defenses such as request limits and reduced prediction detail.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Monitoring a public or partner prediction API
• Measuring model copying risk before deployment
• Testing request limits and reduced prediction detail

Create rules for Suricata and Snort, systems that detect suspicious network traffic, to flag port scans and reconnaissance. Combine packet patterns with connection counts, tune alert volume, and summarize scanning sources, targets, and activity.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Create rules to detect Nmap and Masscan activity
• Monitor scanning within an internal network
• Tune alerts for authorized vulnerability scanners

Investigate process hollowing, where malicious code replaces a legitimate process in memory. Compare memory with disk files, examine process relationships, and correlate network activity to document suspicious processes and guide containment.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Investigating process injection alerts from EDR
• Examining suspicious behavior in legitimate Windows processes
• Finding threats that run in memory

Investigate suspicious privilege increases, including Windows UAC approval bypasses and Linux sudo or setuid abuse. Use registry changes, process relationships, and permission changes to identify possible abuse and document affected hosts, methods, and risk levels.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Investigating Windows UAC bypass activity
• Tracing how administrative access was obtained
• Monitoring Linux sudo and setuid abuse