테스트·보안 스킬

Inspect DNP3 traffic, a communication protocol used in industrial control systems, for unauthorized sources and unexpected commands. The skill compares captured traffic with normal patterns and reports suspicious control actions, restarts, and file operations.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Investigating suspicious DNP3 control commands
• Checking substation traffic against normal patterns
• Preparing DNP3 intrusion detection rules

Create detection rules and investigation queries from API access logs to flag repeated identifier probing and unusual authorization responses. Helps investigate attempts to access other users’ data and review logging and rate limits.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Investigating suspected unauthorized API data access
• Creating detection rules for repeated identifier probing
• Reviewing API logging and rate limits

Build or tune a monitoring pipeline that learns normal user behavior from activity logs. Use Elasticsearch or OpenSearch to score unusual activity, compare colleagues in similar roles, and combine warning signs into insider threat alerts.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Building continuous monitoring for insider threats
• Scoring unusual logins and large downloads
• Comparing behavior across similar job roles

Investigate possible insider threats by correlating endpoint and security logs. Examine unusual data access, off-hours activity, bulk downloads, and privilege abuse, then document supporting evidence, risk, confidence, and recommended actions after checking the context for false positives.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Investigating bulk downloads before an employee leaves
• Reviewing data access outside an employee's duties
• Examining unauthorized queries by service accounts

Analyze AWS IAM access policies with boto3 and Cloudsplaining-style checks to find permissions that could grant greater access. Produces a JSON report linking risky permissions to users or roles, with severity ratings and remediation guidance.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Audit AWS IAM policies for excessive permissions
• Find permission combinations that enable privilege escalation
• Trace risky policies to affected users and roles

Test whether API users can read or change fields beyond their permissions. Examine responses for sensitive data, inject extra request fields to check unauthorized updates, and use explicit lists of allowed fields to guide fixes.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Check API responses for excessive sensitive data
• Test whether added request fields allow unauthorized updates
• Compare field access across user privilege levels

Build a screening pipeline for web pages, PDFs, and images before an AI agent reads them. Extract hidden text, check for malicious instructions with detection models, and record decisions to block or allow content.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Screening external content before an agent reads it
• Checking uploaded PDFs and images for hidden instructions
• Scanning documents before adding them to a knowledge base

Check industrial process data servers for unauthorized clients and suspicious data patterns using a Python detector. Provides alerts for missing or constant values and investigation checks for attackers moving between IT and operational technology networks.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Checking industrial historian servers for unauthorized clients
• Investigating missing or suspiciously constant process data
• Reviewing signs of movement between IT and OT networks

Analyze Zeek DNS logs for possible data theft hidden in domain queries. The skill examines unusual character patterns, long labels, distinct subdomains, and query volume, then ranks suspicious domains and produces a JSON evidence report.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Investigating suspected DNS tunneling
• Finding possible data leaks hidden in DNS queries
• Ranking suspicious domains and identifying source IPs

Investigate suspicious email forwarding and hidden inbox rules that may expose messages after an account compromise. The skill guides log analysis, validation, and reporting, helping analysts document evidence, assess risk, and recommend response actions.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Investigating external forwarding after an account compromise
• Checking rules that delete security alerts
• Hunting for rules that forward executive emails

Investigate compromised credentials across AWS, Azure, and GCP by correlating security alerts and audit logs. Examines unusual API activity and suspicious sign-ins, helps assess the affected scope, and guides containment actions such as disabling keys and revoking sessions.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Investigate cloud API activity from unfamiliar locations
• Assess exposure after a credential leak notification
• Correlate suspicious sign-ins across cloud providers

Plan and measure defensive deception operations with MITRE Engage. Connect decoy systems and credentials to specific attacker techniques, define measurable objectives, and document operating boundaries, response procedures, and criteria for assessing results.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Giving existing honeypots a coordinated strategy
• Selecting decoys for a specific threat actor
• Writing an adversary engagement operation plan

Simulate man-in-the-middle attacks, where traffic is intercepted between communicating systems, in authorized environments. Use Bettercap, Ettercap, and mitmproxy to test encryption enforcement, certificate validation, and network detection, then document findings and recommendations.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Testing HTTPS enforcement and certificate validation
• Checking detection of network spoofing
• Demonstrating the risks of unencrypted traffic

Deploy decoy files and monitor changes, renames, and deletions for early signs of ransomware. This skill guides Python monitoring, email, Slack, and syslog alerts, plus simulated file operations to verify that the detection and notification pipeline works.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Monitoring shared drives and NAS for suspicious file changes
• Adding decoy file monitoring alongside endpoint protection
• Testing incident response with decoy file triggers

Analyze malicious JavaScript from phishing pages, payment data theft scripts, and malware downloaders. Unwrap encoded strings and nested execution layers to reveal hidden behavior, identify stolen data fields, and document suspicious destinations for incident response.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Analyzing obfuscated scripts on phishing pages
• Investigating payment data theft on checkout pages
• Examining JavaScript that downloads further malware

Plan and run authorized security tests that simulate deceptive emails, calls, text messages, and in-person approaches. Measure employee responses, compare results across test methods, and report gaps in security awareness training and access controls.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Planning an authorized social engineering assessment
• Measuring responses to simulated phishing
• Evaluating phone and physical access checks

Assess authorized networks through host discovery, service checks, vulnerability identification, and controlled exploitation. Follow a structured testing process to document attack paths, demonstrate business impact, clean up test artifacts, and prioritize remediation.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Assessing internal or external network security
• Validating firewall rules and network segmentation
• Verifying whether service vulnerabilities are exploitable

Deploy Suricata to detect suspicious network traffic or block it inline. Configure protocol inspection, detection rules, and structured EVE JSON logs, then connect logs to analysis platforms and check packet drops and alert quality during operation.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Deploying network intrusion monitoring
• Configuring inline blocking of malicious traffic
• Adding custom detection rules and reducing noisy alerts

Design and validate rules that limit communication between servers and containers to necessary connections. The skill covers traffic mapping, label-based policies, staged enforcement, and checks for unauthorized movement between systems within a zero trust architecture.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Planning communication rules for a zero trust network
• Separating production and development environments
• Restricting access to critical applications

Set up Cisco Duo multi-factor authentication for VPN, RDP, SSH, and web applications. Configure access rules based on users and device health, introduce security keys, and establish authentication monitoring and emergency access procedures.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Adding Duo authentication to VPN and remote server access
• Strengthening authentication for privileged accounts
• Restricting access based on device health

Set up repeatable security tests for LLM apps with Promptfoo and DeepTeam. Connect them to automated build pipelines, detect renewed vulnerabilities to malicious instructions or data leakage, and compare results across model or prompt changes.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Running automated attack tests on every code change
• Blocking merges when security tests fail
• Comparing security across model or prompt versions

Deploy and configure Snort 3 to detect suspicious network traffic. Create custom detection rules, tune community rules to reduce false alerts, test them against captured traffic, and forward alerts to a central security monitoring platform.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Deploy intrusion detection at network boundaries
• Write rules for organization-specific threats
• Reduce noisy or false alerts

Guide a structured review after a security incident, using timelines and response data to identify root causes and process gaps. Produce review notes, response metrics, and practical improvements with named owners and deadlines.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Reviewing response after a ransomware incident
• Turning exercise findings into process improvements
• Updating incident response playbooks

Plan authorized voice phishing assessments to evaluate how employees verify callers and report suspicious calls. Organize approved scenarios, record assessment outcomes, and summarize disclosure, verification, and reporting rates to review security awareness training.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Planning an authorized voice phishing assessment
• Evaluating caller verification and security reporting
• Reviewing the effectiveness of security awareness training