테스트·보안 스킬

Test whether API users can read or change fields beyond their permissions. Examine responses for sensitive data, inject extra request fields to check unauthorized updates, and use explicit lists of allowed fields to guide fixes.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Check API responses for excessive sensitive data
• Test whether added request fields allow unauthorized updates
• Compare field access across user privilege levels

Audit Azure Blob and ADLS storage accounts for public exposure, risky access tokens, encryption settings, and insecure transport configurations. Use the azure-mgmt-storage Python SDK to produce a JSON report with account findings, severity ratings, and remediation recommendations.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Auditing storage accounts across an Azure subscription
• Investigating suspected exposure through public blob access
• Reviewing SAS token permissions and expiration

Investigate Kerberoasting, an attack that targets service account passwords, using Active Directory authentication logs. Examine unusual service ticket requests, correlate endpoint and network evidence, and organize findings with risk levels and recommended response actions.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Hunting for unusual service ticket requests
• Investigating suspected service account password attacks
• Validating alerts and organizing response evidence

Investigate Windows malware that runs in memory or abuses legitimate system tools. Use logs, registry entries, and memory dumps to trace persistence, identify suspicious activity, and produce detection rules and an analysis report.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Investigating suspicious PowerShell activity
• Checking WMI persistence mechanisms
• Finding malicious code in memory dumps

Build detections for fileless attacks on Windows using process activity, script logs, and endpoint monitoring. Investigate suspicious PowerShell, code injected into running processes, WMI persistence, and registry-based execution with logging guidance and detection query examples.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Building detections for suspicious PowerShell activity
• Hunting for code injection into running processes
• Monitoring WMI persistence and registry-based execution

Investigate possible insider threats by correlating endpoint and security logs. Examine unusual data access, off-hours activity, bulk downloads, and privilege abuse, then document supporting evidence, risk, confidence, and recommended actions after checking the context for false positives.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Investigating bulk downloads before an employee leaves
• Reviewing data access outside an employee's duties
• Examining unauthorized queries by service accounts

Check training data and machine learning models for malicious changes, including backdoors that cause unexpected behavior on specific inputs. Combine data quality checks, model analysis, and file integrity verification, then document findings and retest after remediation.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Screening third-party data before training
• Checking downloaded model weights before deployment
• Investigating unexpected behavior on specific inputs

Investigate Entra ID reconnaissance by searching Graph API logs for tool signatures and unusual directory queries. Use KQL, a log query language, to correlate suspicious requests with sign-ins and turn useful searches into Sentinel detection rules.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Investigating Graph API activity after suspected credential theft
• Checking whether offensive tool activity is visible in logs
• Creating and tuning scheduled Sentinel detection rules

Investigate lateral movement, where attackers expand access across Azure identities and tenants. Correlate audit logs and unusual sign-ins, build Microsoft Sentinel detection queries, and report affected identities with recommended containment actions.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Investigating suspicious Azure sign-ins
• Building Microsoft Sentinel detection rules
• Reviewing suspicious OAuth app consent

Analyze DNS logs to find signs of hidden data transfers. Use query length, character randomness, traffic volume, and response sizes to identify suspicious domains and support monitoring rules with Python, Suricata, and Splunk examples.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Investigating possible data theft through DNS traffic
• Ranking suspicious domains found in DNS logs
• Creating DNS tunneling detection rules

Detect unexpected changes in running containers by comparing them with their original images and monitoring execution and file activity. Use Falco or Microsoft Defender for Containers to investigate changes and guide isolation, replacement, and preventive configuration.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Finding unexpected binaries executed inside running containers
• Investigating package installations and file changes at runtime
• Checking whether containers still match their approved images

Examine Zeek connection logs for regular callbacks that may indicate communication with an attacker’s control server. Use ZAT and Pandas to group connections, measure timing variation, and identify source and destination pairs for further investigation.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Hunting for periodic callbacks in Zeek connection logs
• Comparing connection timing across source and destination pairs
• Developing beaconing detection rules and hunting queries

Examine Windows endpoint logs for attempts to avoid security detection, including log clearing, altered file timestamps, injected code, and disabled protection. Correlate events to investigate suspicious behavior and develop detection rules with context for legitimate activity.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Investigating cleared logs and altered file timestamps
• Checking suspected attempts to disable security tools
• Finding abuse of legitimate Windows utilities

Build automated responses to AWS GuardDuty security findings using EventBridge and Lambda. Configure severity filters, isolate EC2 instances, disable compromised access keys, preserve disk snapshots for investigation, and send notifications to security teams.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Triggering responses to high-severity GuardDuty findings
• Isolating EC2 instances and preserving investigation data
• Disabling compromised IAM access keys

Investigate misuse of application identities in Microsoft Entra ID using audit and sign-in logs. Provides detection queries and investigation steps for suspicious credential additions, privileged role assignments, consent grants, and service principal enumeration.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Investigating suspicious additions of application credentials
• Reviewing privileged roles assigned to application identities
• Building detection rules for Entra ID identity abuse

Inspect DNP3 traffic, a communication protocol used in industrial control systems, for unauthorized sources and unexpected commands. The skill compares captured traffic with normal patterns and reports suspicious control actions, restarts, and file operations.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Investigating suspicious DNP3 control commands
• Checking substation traffic against normal patterns
• Preparing DNP3 intrusion detection rules

Assess Bluetooth Low Energy devices by capturing wireless traffic, inspecting available data services, and checking pairing security. Identify signs of interception, reused commands, and data access that lacks authentication.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Assess BLE security on IoT devices
• Check whether devices accept replayed commands
• Investigate suspicious pairing and device impersonation

Hunt for lateral movement, where attackers move between networked systems, using Splunk searches. Connect Windows logins with process and network activity to identify unusual host relationships, trace movement paths, and document affected accounts and systems.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Tracing activity after credential theft
• Investigating unusual logins between hosts
• Finding new or unexpected host connections

Check industrial process data servers for unauthorized clients and suspicious data patterns using a Python detector. Provides alerts for missing or constant values and investigation checks for attackers moving between IT and operational technology networks.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Checking industrial historian servers for unauthorized clients
• Investigating missing or suspiciously constant process data
• Reviewing signs of movement between IT and OT networks

Investigate business email compromise, where impersonated executives or vendors request payments or sensitive data. Check sender details, unusual communication patterns, mailbox changes, and payment approval procedures to develop detection rules and verification controls.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Investigating emails impersonating executives or vendors
• Reviewing requests to change vendor bank details
• Building detection rules for fraudulent payment requests

Set up AI email screening that compares writing style and communication habits to identify impersonation and suspicious payment requests. Connect detection policies to quarantine, warning banners, and analyst review workflows.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Detecting executive impersonation in emails
• Reviewing vendor payment change requests
• Flagging unusual employee email behavior

Detect unauthorized cryptocurrency mining in cloud workloads by combining billing changes, CPU usage, mining pool connections, and process alerts. Follow workflows to preserve evidence, isolate affected resources, and trace how attackers gained access.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Investigating sudden cloud billing increases
• Responding to GuardDuty cryptocurrency alerts
• Checking containers for unauthorized mining processes

Develop attack detection for SCADA systems that monitor and control industrial equipment. Compare network traffic and process measurements with normal behavior to identify unauthorized commands, altered sensor data, communication disruption, and indicators of known industrial malware.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Introducing intrusion detection in a SCADA environment
• Investigating suspected attacks on industrial control systems
• Creating detection rules for industrial protocol abuse

Monitor local network traffic for ARP spoofing, where false address mappings can redirect traffic. Use ARPWatch, Wireshark, switch inspection settings, and Python monitoring to flag address changes, duplicate IP claims, gateway impersonation, and unusual ARP volumes.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Investigating suspected interception on a local network
• Monitoring changes in IP-to-MAC address mappings
• Checking duplicate IP claims and gateway impersonation