테스트·보안 스킬

Deploy osquery on Windows, macOS, and Linux to inspect processes, listening ports, software, and system settings using SQL, a database query language. Configure scheduled checks and centralized management to support threat hunting and compliance monitoring.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Deploying osquery across Windows, macOS, and Linux
• Investigating suspicious processes and network connections with SQL
• Periodically checking software inventories and system settings

Set up decoy credentials, storage, and secrets across AWS, Azure, and GCP to detect suspicious access. Connect audit logs to security alerts, verify detection, and document permissions, resource inventories, and maintenance plans.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Detecting use of leaked cloud credentials
• Monitoring suspicious access to decoy storage and secrets
• Extending on-premises deception coverage to cloud environments

Assess authorized networks through host discovery, service checks, vulnerability identification, and controlled exploitation. Follow a structured testing process to document attack paths, demonstrate business impact, clean up test artifacts, and prioritize remediation.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Assessing internal or external network security
• Validating firewall rules and network segmentation
• Verifying whether service vulnerabilities are exploitable

Deploy Suricata to detect suspicious network traffic or block it inline. Configure protocol inspection, detection rules, and structured EVE JSON logs, then connect logs to analysis platforms and check packet drops and alert quality during operation.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Deploying network intrusion monitoring
• Configuring inline blocking of malicious traffic
• Adding custom detection rules and reducing noisy alerts

Unwrap layers of obfuscated PowerShell malware to recover hidden commands, additional malicious code, and server addresses. Combines script structure analysis with execution tracing and decoding tools to support incident investigation and detection work.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Investigating an obfuscated PowerShell script
• Recovering hidden commands and additional malicious code
• Extracting suspicious URLs, IP addresses, and file paths

Deploy decoy credentials, documents, and URLs with Canarytokens to detect suspicious access. Guides token generation, placement, alert testing, and inventory tracking, with email or webhook notifications when someone interacts with a planted token.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Add intrusion alerts to shared folders
• Detect use of decoy cloud credentials
• Monitor decoy documents for signs of data theft

Contain an active security breach by isolating endpoints, blocking attacker communications, and revoking compromised access. Follow procedures to limit spread between systems, preserve evidence, verify containment, and report remaining risks and business impact.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Contain ransomware spreading between servers
• Revoke access through compromised accounts
• Isolate hosts communicating with attacker infrastructure

Design and validate rules that limit communication between servers and containers to necessary connections. The skill covers traffic mapping, label-based policies, staged enforcement, and checks for unauthorized movement between systems within a zero trust architecture.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Planning communication rules for a zero trust network
• Separating production and development environments
• Restricting access to critical applications

Configure cryptographic key storage and operations through PKCS#11, a standard interface for security devices. Work with physical HSMs or SoftHSM2 for development to generate keys, sign data, encrypt information, and check key export restrictions.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Configure protected key storage on a physical HSM
• Test PKCS#11 workflows with SoftHSM2
• Sign and encrypt data using keys stored inside an HSM

Assess whether stolen Kerberos tickets, credentials used for network authentication, can enable access to other systems during authorized testing. Guide ticket extraction and reuse, review detection indicators, and document evidence for security reports.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Authorized testing of access through reused tickets
• Checking detection of Kerberos ticket theft
• Collecting evidence for lateral movement reports

Analyze RAM dumps with Volatility 3 to investigate suspicious processes, network connections, injected code, and credential theft. Guides memory capture and evidence extraction, then organizes findings into a forensic report for incident response.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Investigating malware that runs only in memory
• Checking suspicious processes and network connections
• Investigating signs of credential theft

Analyze malicious JavaScript from phishing pages, payment data theft scripts, and malware downloaders. Unwrap encoded strings and nested execution layers to reveal hidden behavior, identify stolen data fields, and document suspicious destinations for incident response.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Analyzing obfuscated scripts on phishing pages
• Investigating payment data theft on checkout pages
• Examining JavaScript that downloads further malware

Build normal traffic profiles for industrial control networks and identify unusual connections, polling intervals, and protocol operations. Use machine learning and process records to investigate deviations and produce anomaly reports with severity levels.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Establishing normal traffic profiles for industrial networks
• Detecting unusual connections and polling intervals
• Investigating Nozomi Guardian or Dragos alerts

Add checks to LLM prompts and responses using Llama Guard 3, NeMo Guardrails, and LLM Guard. Configure content screening, conversation boundaries, and sensitive-data filtering, then measure blocking and false-positive rates with labeled test prompts.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Adding runtime safety checks to LLM, RAG, or agent apps
• Screening prompts for injection and jailbreak attempts
• Filtering sensitive or toxic model responses

Configure Zscaler Private Access to replace VPN access with access to specific internal applications. The skill covers connectors, application groups, identity and device checks, browser access, and logging for deployment and migration reviews.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Migrating remote access from VPN to ZPA
• Limiting application access by user group and device condition
• Providing contractors with browser access to approved applications

Plan authorized spearphishing simulations, personalized phishing tests aimed at specific people. Prepare scenarios and email infrastructure, track delivery and participant responses, and document findings to assess email security controls and improve security awareness.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Designing authorized phishing simulations for specific personnel
• Preparing test email delivery infrastructure
• Measuring delivery, opens, clicks, and reporting behavior

Conduct authorized WiFi security assessments covering authentication, encryption, rogue access points, and network separation. Test WPA2/WPA3 configurations and client behavior, then document weaknesses, evidence, business impact, and recommended fixes.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Assessing corporate, guest, and IoT WiFi security
• Evaluating WPA3 migration and transition mode
• Testing rogue access point detection

Deploy CrowdStrike Falcon sensors across Windows, macOS, and Linux endpoints. Configure threat prevention and response policies, verify installation and detection, troubleshoot sensor issues, and connect events to SIEM platforms, which collect security logs for analysis.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Deploying Falcon sensors across enterprise endpoints
• Configuring prevention and response policies by endpoint group
• Checking sensor connectivity and test detections

Plan tiered administration for Active Directory by separating administrative accounts and systems into three levels. Cover dedicated administration workstations, authentication restrictions, and verification checks to help limit credential theft and the spread of compromise.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Designing tiered Active Directory administration
• Separating privileged accounts by administrative tier
• Planning dedicated administration workstations

Plan authorized voice phishing assessments to evaluate how employees verify callers and report suspicious calls. Organize approved scenarios, record assessment outcomes, and summarize disclosure, verification, and reporting rates to review security awareness training.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Planning an authorized voice phishing assessment
• Evaluating caller verification and security reporting
• Reviewing the effectiveness of security awareness training

Connect security incidents across organizations by comparing attack indicators, techniques, and timelines. Build relationship graphs and campaign reports that document shared evidence, attribution confidence, and indicators useful for detection.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Linking incidents that share attack indicators
• Analyzing attacks across partner organizations
• Preparing reports on sustained attack campaigns

Configure advanced Microsoft Defender protections on Windows, including rules that block risky behavior, protected folders, network filtering, and exploit defenses. Use audit modes to assess application impact, then deploy policies and monitor detections across an organization.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Strengthening Windows endpoint protection
• Assessing ASR rules in audit mode
• Configuring ransomware protection for folders

Assess iOS and Android app security using OWASP MASTG, a mobile security testing guide. Examine app files, runtime behavior, stored data, authentication, and API traffic, then document vulnerabilities, their impact, and suggested fixes.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Assess mobile app security before release
• Check sensitive data storage and network traffic
• Test authentication and resistance to runtime manipulation

Design and configure VLANs, logical network partitions, to separate employee devices, servers, guests, and IoT equipment. Covers traffic restrictions between zones, switch security settings, and tests to verify that the intended isolation works.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Separating guest WiFi and IoT devices from internal systems
• Planning network isolation for payment processing systems
• Restricting communication between network zones