Detect unauthorized SaaS and cloud service usage (shadow IT) by analyzing proxy logs, DNS query logs, and netflow data using Python pandas for traffic pattern analysis and domain classification.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Detect and prevent QR code phishing (quishing) attacks that bypass traditional email security by embedding malicious URLs in QR code images within emails.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Detect and prevent privilege escalation in Kubernetes pods by monitoring security contexts, capabilities, and syscall patterns with Falco and OPA policies.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Detects AI-generated deepfake audio used in voice phishing (vishing) attacks by extracting spectral features (MFCC, spectral centroid, spectral contrast, zero-crossing rate) and classifying samples with machine learning models. Supports batch analysis of audio files, generates confidence scores, and produces forensic reports. Activates for requests involving deepfake voice detection, vishing investigation, AI-generated speech analysis, voice cloning detection, or audio authenticity verification.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Detecting exposed AWS credentials in source code repositories, CI/CD pipelines, and configuration files using TruffleHog, git-secrets, and AWS-native detection mechanisms to prevent credential theft and unauthorized account access.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Detect DLL side-loading attacks where adversaries place malicious DLLs alongside legitimate applications to hijack execution flow for defense evasion.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Write and deploy Falco rules with the modern eBPF driver to detect container escape, namespace abuse, privileged mounts, and anomalous syscalls at runtime in Kubernetes and Docker.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Detect and prevent public-over-private name resolution in npm, PyPI, and Maven.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Identify poisoned training data and backdoored models across the ML pipeline.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
This skill teaches security teams how to detect and respond to unauthorized cryptocurrency mining operations in cloud environments. It covers identifying cryptomining indicators through compute usage anomalies, network traffic patterns to mining pools, GuardDuty CryptoCurrency findings, and runtime process monitoring on EC2, ECS, EKS, and Azure Automation workloads.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Detect anomalies in DNP3 (Distributed Network Protocol 3) communications used in SCADA systems by monitoring for unauthorized control commands, firmware update attempts, protocol violations, and deviations from baseline traffic patterns using deep packet inspection and machine learning approaches.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Detect DCSync attacks where adversaries abuse Active Directory replication privileges to extract password hashes by monitoring for non-domain-controller accounts requesting directory replication via DsGetNCChanges.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
This skill teaches security teams how to deploy and operationalize Amazon GuardDuty for continuous threat detection across AWS accounts and workloads. It covers enabling protection plans for S3, EKS, EC2 runtime monitoring, and Lambda, interpreting finding severity levels, and building automated response workflows using EventBridge and Lambda.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Detect unauthorized modifications to running containers by monitoring for binary execution drift, file system changes, and configuration deviations from the original container image.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Business Email Compromise (BEC) is a sophisticated fraud scheme where attackers impersonate executives, vendors, or trusted partners to trick employees into transferring funds, sharing sensitive data,
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Detect and test for OWASP API3:2023 Broken Object Property Level Authorization vulnerabilities including excessive data exposure and mass assignment attacks.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Systematically deobfuscate multi-layer PowerShell malware using AST analysis, dynamic tracing, and tools like PSDecode and PowerDecode to reveal hidden payloads and C2 infrastructure.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Container escape is a critical attack technique where an adversary breaks out of container isolation to access the host system or other containers. Detection involves monitoring for escape indicators
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Detects and analyzes Bluetooth Low Energy (BLE) security attacks including sniffing, replay attacks, GATT enumeration abuse, and Man-in-the-Middle interception. Uses Ubertooth One and nRF52840 sniffers for packet capture, the bleak Python library for GATT service enumeration, and crackle for BLE encryption cracking. Use when assessing IoT device BLE security, monitoring for BLE-based attacks on wireless infrastructure, or performing authorized BLE penetration testing. Activates for requests involving BLE security assessment, Ubertooth sniffing, GATT enumeration, or BLE replay detection.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Detect AWS IAM privilege escalation paths using boto3 and Cloudsplaining policy analysis to identify overly permissive policies, dangerous permission combinations, and least-privilege violations
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Detects command-and-control (C2) communications tunneled through DNS protocol including DNS tunneling tools (Iodine, dnscat2, dns2tcp, Cobalt Strike DNS beacon), domain generation algorithms (DGA), encoded payload delivery via TXT/CNAME records, and DNS beaconing patterns. Covers Shannon entropy analysis of query subdomains, statistical anomaly detection, ML-based DGA classification, passive DNS correlation, and Zeek/Suricata signature development. Activates for requests involving DNS-based C2 detection, DNS tunnel identification, suspicious DNS traffic investigation, or DGA domain classification.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Automate AWS GuardDuty threat detection findings processing using EventBridge and Lambda to enable real-time incident response, automatic quarantine of compromised resources, and security notification workflows.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Detect unusual API call patterns in AWS CloudTrail logs using boto3, statistical baselining, and behavioral analysis to identify credential compromise, privilege escalation, and unauthorized resource access.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Deploy AI and NLP-powered detection systems to identify business email compromise attacks by analyzing writing style, behavioral patterns, and contextual anomalies that evade traditional rule-based filters.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.