테스트·보안 스킬

Build a vulnerability exception and risk acceptance tracking system with approval workflows, compensating controls documentation, and expiration management.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Build automated threat intelligence enrichment pipelines in Splunk Enterprise Security using lookup tables, modular inputs, and the Threat Intelligence Framework.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Discovering and accessing unprotected pages, APIs, and administrative interfaces by enumerating URLs and bypassing authentication controls during authorized security assessments.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Parses Software Bill of Materials (SBOM) in CycloneDX and SPDX JSON formats to identify supply chain vulnerabilities by correlating components against the NVD CVE database via the NVD 2.0 API. Builds dependency graphs, calculates risk scores, identifies transitive vulnerability paths, and generates compliance reports. Activates for requests involving SBOM analysis, software composition analysis, supply chain security assessment, dependency vulnerability scanning, CycloneDX/SPDX parsing, or CVE correlation.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Analyzes UEFI bootkit persistence mechanisms including firmware implants in SPI flash, EFI System Partition (ESP) modifications, Secure Boot bypass techniques, and UEFI variable manipulation. Covers detection of known bootkit families (BlackLotus, LoJax, MosaicRegressor, MoonBounce, CosmicStrand), ESP partition forensic inspection, chipsec-based firmware integrity verification, and Secure Boot configuration auditing. Activates for requests involving UEFI malware analysis, firmware persistence investigation, boot chain integrity verification, or Secure Boot bypass detection.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Analyzes Windows Security, System, and Sysmon event logs in Splunk to detect authentication attacks, privilege escalation, persistence mechanisms, and lateral movement using SPL queries mapped to MITRE ATT&CK techniques. Use when SOC analysts need to investigate Windows-based threats, build detection queries, or perform forensic timeline analysis of Windows endpoints and domain controllers.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Detect and analyze Linux persistence mechanisms including crontab entries, systemd service units, LD_PRELOAD hijacking, bashrc modifications, and authorized_keys backdoors using auditd and file integrity monitoring

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Parse Office 365 Unified Audit Logs via Microsoft Graph API to detect email forwarding rule creation, inbox delegation, suspicious OAuth app grants, and other indicators of account compromise.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Systematically audit AWS S3 bucket permissions to identify publicly accessible buckets, overly permissive ACLs, misconfigured bucket policies, and missing encryption settings using AWS CLI, S3audit, and Prowler to enforce least-privilege data access controls.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Analyzes network traffic captures and flow data to identify adversary activity during security incidents, including command-and-control communications, lateral movement, data exfiltration, and exploitation attempts. Uses Wireshark, Zeek, and NetFlow analysis techniques. Activates for requests involving network traffic analysis, packet capture investigation, PCAP analysis, network forensics, C2 traffic detection, or exfiltration detection.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Leverages Splunk Enterprise Security and SPL (Search Processing Language) to investigate security incidents through log correlation, timeline reconstruction, and anomaly detection. Covers Windows event logs, firewall logs, proxy logs, and authentication data analysis. Activates for requests involving Splunk investigation, SPL queries, SIEM log analysis, security event correlation, or log-based incident investigation.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Craft, send, sniff, and dissect network packets using Scapy for protocol analysis, network reconnaissance, and traffic anomaly detection in authorized security testing

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Runtime iOS app security testing with Objection (Frida): inspect keychain and filesystem data, explore app internals at runtime, and validate/bypass client-side protections during authorized mobile assessments.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Analyzes DNS query logs to detect data exfiltration via DNS tunneling, DGA domain communication, and covert C2 channels using entropy analysis, query volume anomalies, and subdomain length detection in SIEM platforms. Use when SOC teams need to identify DNS-based threats that bypass traditional network security controls.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Perform static and symbolic analysis of Solidity smart contracts using Slither and Mythril to detect reentrancy, integer overflow, access control, and other vulnerability classes before deployment to Ethereum mainnet.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Standard Operating Procedures for architecture decisions, security audits, deep code analysis, risk assessment, and critical problem solving.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Parses Kubernetes API server audit logs (JSON lines) to detect exec-into-pod, secret access, RBAC modifications, privileged pod creation, and anonymous API access. Builds threat detection rules from audit event patterns. Use when investigating Kubernetes cluster compromise or building k8s-specific SIEM detection rules.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Analyzes indicators of compromise (IOCs) including IP addresses, domains, file hashes, URLs, and email artifacts to determine maliciousness confidence, campaign attribution, and blocking priority. Use when triaging IOCs from phishing emails, security alerts, or external threat feeds; enriching raw IOCs with multi-source intelligence; or making block/monitor/whitelist decisions. Activates for requests involving VirusTotal, AbuseIPDB, MalwareBazaar, MISP, or IOC enrichment pipelines.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Standard Operating Procedures for backend development, bug fixing, DevOps, infrastructure deployment, and security hardening.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Uses the Linux Audit framework (auditd) with ausearch and aureport utilities to detect intrusion attempts, unauthorized access, privilege escalation, and suspicious system activity. Covers audit rule configuration, log querying, timeline reconstruction, and integration with SIEM platforms. Activates for requests involving auditd analysis, Linux audit log investigation, ausearch queries, aureport summaries, or host-based intrusion detection on Linux.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Audit, detect, and remediate Shadow Credentials misconfigurations on msDS-KeyCredentialLink in Active Directory. Focuses on access-controls, monitoring Event ID 5136, and credential-management hygiene.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Analyzes intrusion activity against the Lockheed Martin Cyber Kill Chain framework to identify which phases an adversary has completed, where defenses succeeded or failed, and what controls would have interrupted the attack at earlier phases. Use when conducting post-incident analysis, building prevention-focused security controls, or mapping detection gaps to kill chain phases. Activates for requests involving kill chain analysis, intrusion kill chain, attack phase mapping, or Lockheed Martin kill chain framework.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Prepare a defense-contractor environment for CMMC Level 2 certification: scope CUI and FCI, implement the 110 NIST SP 800-171 Rev 2 security requirements across 14 families, compute the SPRS score with the DoD Assessment Methodology, manage a compliant POA&M, and ready the organization for a C3PAO assessment. Use when an organization handles Controlled Unclassified Information (CUI) under a DoD contract, when a contract carries DFARS clause 252.204-7012/7019/7020/7021, when preparing for or responding to a CMMC assessment, when computing or improving an SPRS score, when building a System Security Plan or POA&M for 800-171, or when scoping which systems are in the CUI boundary. Keywords: CMMC, CMMC Level 2, NIST 800-171, SP 800-171 Rev 2, CUI, FCI, SPRS, DFARS 7012, C3PAO, POA&M, System Security Plan, DoD Assessment Methodology, 110 controls, defense industrial base, DIB, FedRAMP equivalency.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Validate Commodore 1540/1541/1541C/1541-II compatible disk-drive behavior in EMULATORS, including IEC serial bus protocol, device numbers, KERNAL traps, CBM DOS commands/status, D64 image parsing, BAM/directory/file chains, PETSCII filenames, 6502 drive CPU/ROM/RAM expectations, 6522 VIA wiring, GCR/track/sector geometry, motor/head timing, and compatibility boundaries for 1541-like devices. Use when Codex reviews or edits C64, VIC-20, C264, COMMODORE disk, serial I/O, D64, CBM DOS, IEC, VIA, GCR, or 1541 drive code.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.