테스트·보안 스킬

Audit Microsoft Entra ID identity settings to uncover weak authentication policies, excessive administrator privileges, inactive accounts, and guest access risks. Review conditional access rules and sign-in logs, then organize findings into a prioritized security report.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Auditing authentication and administrator access in an Azure tenant
• Assessing identity settings before integrating an acquired tenant
• Finding inactive accounts and privileged guest users

Parse Windows Prefetch files, which store traces of program execution, to extract run counts, timestamps, and referenced files. Build execution timelines and compare findings with other forensic evidence when investigating suspicious software or tool usage.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Checking whether a suspicious program ran
• Building a timeline of investigative tool findings
• Investigating compression and file transfer tool usage

Analyze Windows PowerShell event logs to reconstruct scripts split across records and identify encoded commands, suspicious downloads, and security scanning bypass attempts. Produce a report with recovered scripts, risk scores, and mappings to documented attack techniques.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Investigating suspicious PowerShell activity
• Reconstructing scripts split across log records
• Finding encoded commands and suspicious downloads

Audit AWS S3 buckets for public exposure, excessive permissions, and gaps in encryption or versioning settings. Use AWS CLI, Prowler, and access analysis to compile findings, prioritize issues, and plan or apply configuration fixes.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Reviewing S3 settings in a newly onboarded AWS account
• Investigating alerts about publicly exposed buckets
• Preparing periodic access control audit reports

Analyze Windows Amcache records to investigate applications, deleted executable traces, and drivers. Extract file details, compare SHA-1 hashes with malware databases, and combine records into a timeline to support incident investigations.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Investigating traces of deleted executables
• Checking software installed during an incident
• Comparing file hashes with malware databases

Reconstruct USB device usage on Windows by comparing registry records, Event Logs, and device installation logs. Identify devices, correlate connection times and drive letters, and build a timeline for removable media investigations.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Investigating suspected data removal through USB storage
• Checking whether unapproved USB devices were connected
• Correlating USB connections with malware execution

Build a Python system that follows DNS history, domain registration records, and certificate information from known suspicious domains or IP addresses. Map related attack infrastructure, identify shared connections, and monitor for newly discovered domains matching known patterns.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Finding related domains from a known suspicious IP
• Mapping attacker command-and-control infrastructure
• Monitoring domains that match known naming patterns

Audit Kubernetes RBAC, the rules that assign access through roles, to identify excessive permissions, risky role assignments, and paths to gaining higher privileges. Review service accounts and produce findings with recommended permission changes.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Reviewing access permissions in shared Kubernetes clusters
• Finding accounts that can read secrets or gain higher privileges
• Checking service account token mounts

Create automated workflows that add threat intelligence to suspicious IP addresses, domains, URLs, and file hashes. Combine findings from multiple services into consistent alert context and confidence scores to support analysts reviewing security alerts.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Adding threat context to security alerts
• Processing indicators from phishing email submissions
• Standardizing bulk indicator lookups from threat feeds

Investigate security incidents in Splunk by connecting authentication, endpoint, and network logs. Use SPL, Splunk’s search language, to identify suspicious activity, reconstruct event timelines, document findings, and develop detection rules.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Investigating suspicious logins across multiple log sources
• Reconstructing an incident timeline
• Tracing suspicious processes and outbound traffic

Analyze Windows Registry files to uncover user activity, installed software, USB connections, and automatic startup entries. Organize these traces into investigation summaries and timelines to help examine suspicious activity and possible malware persistence.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Investigating suspicious automatic startup entries
• Reconstructing user activity around an incident
• Checking USB device connection traces

Assess the security of RAG systems, which retrieve documents to support AI answers. Test whether stored vectors expose source text, leak documents between tenants, or allow inserted content to dominate search results, then document findings and controls.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Assessing source-text exposure from stored vectors
• Checking data isolation between tenants
• Testing retrieval manipulation in a test collection

Audit Google Cloud access permissions to find overly broad roles, unnecessary service account keys, public access, and impersonation risks. Use gcloud CLI, Policy Analyzer, and IAM Recommender to document findings and plan more limited permissions.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Reviewing access permissions across a GCP organization
• Replacing broad Owner and Editor roles with narrower roles
• Auditing unused service accounts and user-managed keys

Build an automated workflow that collects suspicious files, checks known malware records, and submits unknown samples to isolated analysis environments. Generate verdicts and indicators of compromise, then send results to security monitoring systems.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Automating analysis of quarantined email attachments
• Batch-processing files quarantined by endpoint security
• Extracting threat indicators during incident investigations

Audit Solidity contracts in Foundry projects before deployment using code analysis, randomized tests, manual review, and private key checks. Produces a JSON report with findings, remediation, test coverage, and a pass or fail deployment decision.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Auditing Solidity contracts before deployment
• Adding fuzz and invariant tests for contracts that move funds
• Reviewing private key storage and deployment scripts

Reconstruct Windows folder browsing activity from Shellbag registry records using SBECmd and ShellBags Explorer. Investigate traces of deleted directories, disconnected USB drives, and network shares while accounting for limits in what the records and timestamps show.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Reconstructing a user's folder browsing history
• Investigating browsing traces on disconnected USB drives
• Checking access traces for deleted folders

Turn cyber threat intelligence reports into a searchable library of attacker behaviors linked to MITRE ATT&CK techniques. Export structured STIX 2.1 data, a threat information exchange format, and create detection rule templates from documented activity.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Cataloging attacker behaviors from threat intelligence reports
• Organizing attack patterns by tactic, technique, and threat actor
• Creating detection rule templates from documented behaviors

Analyze Windows Prefetch files, which record application execution data, using Python. Reconstruct execution timelines, review run counts and accessed resources, and identify suspicious programs or signs that an executable has been renamed to disguise its identity.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Reconstructing a program execution timeline
• Investigating potentially renamed executables
• Reviewing suspicious tools and execution frequency

Monitor public Certificate Transparency logs, which record TLS certificates, to spot unexpected issuance and discover subdomains. Use crt.sh data to maintain a certificate inventory, check domain findings against DNS, and configure alerts for suspicious activity.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Monitoring owned domains for unexpected certificate issuance
• Discovering subdomains and checking their DNS records
• Investigating certificates for look-alike domains

Investigate malware that survives OS reinstallation by checking UEFI firmware, boot files, and Secure Boot settings. Use chipsec and supporting tools to compare trusted baselines, identify bootkit indicators, and document findings.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Investigating reinfection after OS reinstallation
• Checking unexpected Secure Boot changes
• Comparing firmware against a trusted vendor baseline

Find lookalike domains with dnstwist and prioritize suspicious results using DNS records, registration age, and website similarity. The skill also covers monitoring for new findings and producing blocklists and reports to support domain takedown requests.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Finding domains that imitate a company or brand
• Investigating suspected phishing domains
• Monitoring for newly discovered lookalike domains

Examine Outlook PST and OST archives to extract messages, headers, attachments, and recoverable deleted items. Use the extracted records to trace email routing, reconstruct communication patterns, and support incident investigations or legal evidence review.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Investigating suspicious emails in Outlook archives
• Tracing message routes through email headers
• Extracting attachments for further analysis

Identify and unpack malware compressed with UPX to prepare executable files for static analysis, which examines code without running it. The workflow covers altered header repair, debugger-based recovery, and validation before analysis in Ghidra or IDA.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Identifying suspected UPX-packed samples
• Investigating failed UPX decompression
• Recovering binaries with a debugger

Examine NTFS disk images for residual or hidden data beyond standard file recovery. Analyze file metadata, change records, unused space within allocated storage, and Alternate Data Streams to reconstruct available activity and identify suspicious timestamp differences.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Find residual data in file slack space
• Investigate metadata left by deleted files
• Reconstruct recorded file changes