테스트·보안 스킬

Extract Cobalt Strike Beacon settings from executable files and memory dumps to identify command-and-control servers, communication patterns, and identifying markers. Use the findings to compare samples, investigate incidents, and develop file and network detection rules.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Extract Beacon settings from suspicious files
• Identify command-and-control servers and traffic patterns
• Compare samples using watermark identifiers

Analyze malware network captures to investigate command-and-control traffic, data theft, and downloaded files. Use packet analysis tools to identify suspicious destinations and recurring connections, extract artifacts, and create detection rules from observed patterns.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Analyzing malware sandbox network captures
• Investigating command-and-control traffic
• Tracing data theft and file downloads

Create disk images for investigations using dd or dcfldd on Linux. The workflow covers write protection, bit-for-bit copying, hash checks to verify integrity, and documentation of the acquisition process.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Preserving a suspect drive before investigation
• Creating evidence copies of USB devices or memory cards
• Verifying that a disk image matches its source

Use Wireshark and tshark to capture and inspect network packets, the small units of network communication. Investigate suspicious connections and protocol problems, extract transferred files, and export evidence and summaries for incident investigations.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Investigating suspected intrusions or data leaks
• Diagnosing retransmissions and DNS failures
• Checking traffic against firewall and IDS rules

Analyze memory dumps with Volatility3 to find heap spraying, an attack that fills memory with attacker-controlled data. Examine suspicious allocations and repeated byte patterns, extract suspicious code, and report affected processes and memory regions in JSON.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Investigating suspected heap spraying in a memory dump
• Extracting suspicious code from memory
• Organizing evidence for detection rule development

Analyze access logs from AWS S3, GCS, and Azure Blob Storage to spot unusual downloads, unfamiliar IP addresses, and request spikes. Compare activity with normal patterns and prioritize findings for suspected data theft investigations.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Investigating suspected data theft from cloud storage
• Finding bulk downloads outside normal working hours
• Checking unfamiliar IP addresses and sudden request spikes

Use Scapy, a Python library for working with network packets, to inspect saved captures or authorized live traffic. Summarize protocols and connections, identify suspicious patterns, craft test packets, and export findings as structured JSON reports.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Investigating saved network captures
• Summarizing traffic volumes, protocols, and connection endpoints
• Checking for SYN floods and DNS data leakage indicators

Analyze disk images with Autopsy and The Sleuth Kit to recover deleted files, search content, and examine recorded activity. Build investigation timelines and visual reports that help stakeholders understand evidence from one or multiple disk images.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Recovering deleted files from a disk image
• Searching evidence for confidential files and keywords
• Reconstructing activity around a malware infection

Analyze suspicious email headers to trace delivery routes and assess sender spoofing. Review SPF, DKIM, and DMARC sender authentication results, compare sender and reply addresses, and examine links and attachment hashes for phishing indicators.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Triaging a suspicious email reported by a user
• Checking whether a sender domain was spoofed
• Tracing the delivery route of a phishing email

Analyze captured RAM with Volatility to investigate suspicious processes, injected code, network connections, and other evidence of compromise. The skill guides memory investigations and organizes findings into timelines and reports, including malware traces absent from disk.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Investigating fileless malware after an endpoint alert
• Finding hidden processes and injected code
• Linking suspicious processes to network connections

Analyze NTFS file records and change journals to investigate deleted files on Windows disks. Recover surviving metadata and content where possible, reconstruct file activity timelines, and compare timestamps for signs of deliberate manipulation.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Recovering names and paths of deleted files
• Assessing whether deleted file content can be recovered
• Reconstructing file creation, modification, and deletion timelines

Investigate suspicious Azure activity by querying administrative and sign-in logs. Create KQL queries, Azure's log search language, to examine role assignments, resource changes, unusual access, and other signals for cloud security monitoring.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Investigate suspicious administrative activity in Azure
• Check newly added administrator roles
• Review resource and network security rule changes

Examine captured network traffic for hidden malware communications in DNS, ICMP, and HTTP. Analyze domain patterns, packet sizes, and traffic frequency to identify suspicious channels used for remote control or data theft.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Investigating suspicious DNS, ICMP, or HTTP traffic
• Hunting for hidden malware control channels in packet captures
• Assessing possible data theft through unusual network traffic

Observe malware in an isolated Cuckoo Sandbox environment and review its processes, network traffic, and system changes. Use the findings to trace infection stages, identify persistence mechanisms, and extract indicators of compromise for behavioral reports.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Investigating suspicious files after static analysis
• Tracing multi-stage infections and persistence mechanisms
• Extracting indicators of compromise from observed behavior

Analyze Cobalt Strike communication profiles and Beacon payload configurations to extract request paths, headers, timing, and process injection settings. Turn these indicators into a JSON report and network detection rules for Suricata or Snort.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Analyzing a captured Malleable C2 profile
• Extracting communication settings from a Beacon payload
• Creating Suricata or Snort detection rules

Assess exposure of Windows secrets protected by DPAPI, the operating system’s data protection service, during authorized security tests. Guide examination and decryption of saved credentials and browser data using available user sessions, credentials, or backup keys.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Assessing saved credential exposure in authorized tests
• Examining collected DPAPI files offline
• Reviewing protected browser and RDP credentials

Inspect Windows startup entries with Sysinternals Autoruns to find possible malware persistence, settings that let malware restart automatically. Review signatures, file locations, and changes from a clean baseline to identify entries that need investigation.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Investigating suspicious startup entries on a Windows endpoint
• Comparing startup settings against a clean baseline
• Checking for remaining malware startup entries after cleanup

Investigate compromised Docker containers by preserving evidence and examining image layers, logs, file changes, and host settings. Summarize suspicious activity, security configuration issues, and vulnerability findings to support incident response.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Investigating a compromised application container
• Examining a suspicious image from a registry
• Checking evidence of a container escape attempt

Map threat groups’ documented attack techniques in MITRE ATT&CK Navigator. Creates visual layers and heatmaps, compares groups, and highlights techniques missing from existing detection coverage to support security reporting and decisions about detection priorities.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Visualizing a threat group's attack techniques
• Comparing techniques shared by multiple threat groups
• Finding gaps in existing detection coverage

Assess Shadow Credentials account takeover during authorized Active Directory testing. Examine permissions that allow public key registration, validate authentication without a password reset, and document credential cleanup, detection opportunities, and access control changes needed for remediation.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Assessing risky permissions identified in BloodHound
• Validating account takeover without resetting a password
• Generating directory change records during security exercises

Investigate Linux kernel rootkits, malware that hides inside the operating system's core. Analyze memory dumps with Volatility3, compare system views, and run live scans to identify hidden modules, altered calls, and suspicious inconsistencies.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Investigate suspected Linux rootkit infections
• Find hidden kernel modules in memory dumps
• Compare module lists for signs of concealment

Monitor public certificate issuance records to find suspected phishing domains, brand lookalikes, and unauthorized certificates. Use crt.sh for historical searches and Certstream for live alerts, then summarize suspicious findings and detection reasons in a report.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Monitor domains that resemble a company brand
• Investigate certificate issuance history
• Discover subdomains in public certificate records

Analyze malware communication with command servers to understand periodic check-ins, message formats, encoded data, and backup destinations. Produces a structured analysis report and network detection rules based on captured traffic and malware code.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Investigating malware communication in captured traffic
• Measuring periodic check-in intervals and timing variation
• Mapping command servers and backup destinations

Examine suspicious Word, Excel, and PowerPoint documents by extracting macros and untangling code designed to hide its purpose. Identify download addresses, execution triggers, and attack steps, then document findings and indicators for detecting related threats.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Investigating suspicious email attachments
• Finding download addresses hidden in VBA code
• Examining legacy Excel 4.0 macros