Mahipal

Create rules for Suricata and Snort, systems that detect suspicious network traffic, to flag port scans and reconnaissance. Combine packet patterns with connection counts, tune alert volume, and summarize scanning sources, targets, and activity.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Create rules to detect Nmap and Masscan activity
• Monitor scanning within an internal network
• Tune alerts for authorized vulnerability scanners

Screen dependency names on npm, PyPI, and crates.io before installation to find lookalikes of legitimate packages. This skill compares spelling patterns and registry metadata, helping review AI-generated lists, lockfile changes, and new dependencies in CI/CD.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Screening a new dependency before installation
• Reviewing dependency lists generated by AI
• Checking lockfile changes for swapped packages

Detect attacks that misuse legitimate Windows utilities such as certutil and mshta. Analyze process logs, command arguments, and parent-child relationships with Sigma detection rules, then report suspicious events with severity scores and supporting event details.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Investigating suspicious use of built-in Windows utilities
• Creating Sigma rules for unusual command arguments
• Finding Office apps that launch unexpected system utilities

Guide malware cleanup on infected Windows and Linux systems after containment and investigation. Covers removing malicious files and mechanisms that preserve attacker access, rotating credentials, patching entry points, and documenting validation results before recovery.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Cleaning infected systems after containment
• Removing mechanisms that preserve attacker access
• Rotating compromised credentials and fixing entry points

Analyze Windows authentication logs for repeated password guesses against Remote Desktop services. Group failures by source IP and account, check for later successful logins, and produce a JSON report highlighting attack patterns and possible compromise.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Investigate repeated login failures on exposed RDP services
• Identify accounts targeted by password guessing
• Check for successful logins after repeated failures

Assess an authorized Active Directory environment by simulating attacks against credentials, permissions, and trust relationships. Use BloodHound and related testing tools to identify paths to administrator access, evaluate detection capabilities, and document findings with remediation recommendations.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Assessing Active Directory security with written authorization
• Finding paths from ordinary users to administrator access
• Reviewing Kerberos and delegation settings

Investigate process hollowing, where malicious code replaces a legitimate process in memory. Compare memory with disk files, examine process relationships, and correlate network activity to document suspicious processes and guide containment.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Investigating process injection alerts from EDR
• Examining suspicious behavior in legitimate Windows processes
• Finding threats that run in memory

Assess serverless functions, primarily AWS Lambda, for unsafe execution of external input and unauthorized changes to code or added libraries. Combine source inspection, activity logs, and permission reviews to identify injection risks and recommend detection and prevention measures.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Reviewing Lambda event handlers for injection vulnerabilities
• Investigating unauthorized function or layer changes
• Checking privilege escalation through Lambda execution roles

Analyze Modbus industrial network traffic to identify unauthorized commands, write operations, and unusual polling intervals. Compare activity with normal traffic patterns and allowed operations, then report anomalies by type and severity.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Investigating suspicious Modbus traffic
• Establishing normal polling patterns
• Defining allowed Modbus function codes

Find npm and PyPI packages that imitate trusted package names to exploit typing mistakes. Compare spelling similarity, publication dates, downloads, and maintainer details, then rank suspicious candidates and produce reports or blocklists for further review.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Auditing project dependencies for misleading package names
• Monitoring names similar to important packages
• Investigating a suspected misspelled package installation

Analyze proxy, DNS, and firewall traffic logs to uncover unapproved SaaS and cloud services. Group usage by domain, compare it with approved applications, and produce a report with traffic volumes, user counts, risk scores, and remediation recommendations.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Finding unapproved SaaS and cloud services
• Measuring traffic volumes and users by service
• Prioritizing services by potential data leakage risk

Assess whether a container can escape its isolation and reach the host during an authorized security test. Review privileges, shared mounts, Docker socket exposure, and runC vulnerabilities, then document demonstrated impact and remediation.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Testing container escape within an approved scope
• Assessing the impact of privileged or hostPath workloads
• Validating controls that block container escape

Use CloudFox to inspect AWS and Azure resources through read-only queries. Identify exposed endpoints, secrets, permissions, and role trust relationships, then organize findings into files for reviewing configuration weaknesses and potential paths to broader access.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Inventorying an unfamiliar AWS or Azure account
• Finding internet-facing resources
• Mapping role trust relationships and permissions

Investigate stolen Kerberos tickets, authentication credentials that can be reused without a password, by correlating Windows security events. Build Splunk or Elastic detection rules for cross-host reuse, weaker encryption, and unusual request volumes, and report risk-scored findings.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Investigating suspected reuse of stolen Kerberos tickets
• Building Splunk or Elastic detection rules
• Finding unusual ticket request volumes

Develop network monitoring for signs that may precede ransomware encryption. Uses detection rules, linked log events, and threat intelligence to identify suspicious activity and define how alerts should be investigated, prioritized, and escalated.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Creating detection rules for activity before ransomware encryption
• Linking suspicious logins, scans, and file share access
• Investigating unusual internal network communications

Investigate signs of Mimikatz credential theft using command lines, access to Windows authentication memory, file indicators, and known modules in memory. Correlate endpoint and security logs to assess suspicious alerts, document evidence, and recommend response actions.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Investigating alerts about Windows authentication memory access
• Hunting for signs of credential theft
• Assessing compromise scope during incident response

Use Stratus Red Team to simulate attack techniques across AWS, Azure, GCP, and Kubernetes. Prepare test resources, run and repeat simulations, check logs and alerts, and remove resources to assess whether security detections work.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Checking whether cloud detection rules trigger
• Testing log ingestion and alert routing
• Running joint attack and defense exercises

Investigate Windows credential theft by correlating endpoint monitoring data, Sysmon events, and security logs. The skill provides detection queries and a reporting format to identify suspicious access and assess which credentials may be compromised.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Investigating alerts about suspicious LSASS access
• Hunting for credential theft across Windows systems
• Assessing the scope of potentially compromised credentials

Find undocumented API endpoints, the addresses applications send requests to, by comparing traffic with OpenAPI specifications and examining cloud settings and source code. Build an inventory with activity and risk details to review forgotten or outdated APIs.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Finding API endpoints missing from documentation
• Auditing forgotten test APIs and outdated versions
• Prioritizing undocumented APIs for security review

Inspect npm packages and dependency files for malicious installation scripts, credential theft, and self-spreading behavior. Use GuardDog scanning, source inspection, known-malicious version checks, and isolated execution to produce an evidence-based assessment.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Vetting a new npm dependency before adoption
• Reviewing dependency files during code review
• Checking lockfiles against known-malicious versions

Monitor requests to an AI prediction API for signs of model copying or training-data exposure. Test an authorized model with simulated attacks, measure the risk, and evaluate defenses such as request limits and reduced prediction detail.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Monitoring a public or partner prediction API
• Measuring model copying risk before deployment
• Testing request limits and reduced prediction detail

Build detection rules for suspicious Windows scheduled tasks by correlating Sysmon and Windows Security logs. Examine parent processes, file paths, encoded commands, and remote task creation to uncover persistent access and movement between systems.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Investigating suspicious scheduled task creation
• Hunting for tasks that run encoded commands
• Detecting remote task creation across systems

Investigate excessive privileges inside Kubernetes pods by reviewing security settings, runtime events, and audit logs. Use admission policies to restrict risky configurations and Falco monitoring to detect suspicious privilege changes and container activity.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Finding pods running as root or in privileged mode
• Reviewing host filesystem access and dangerous Linux permissions
• Detecting privilege changes while containers are running

Set up Zeek to observe network traffic and produce structured logs for security analysis. Create custom detection scripts, investigate suspicious DNS activity and repeated external connections, and forward logs to a central security monitoring system.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Set up passive monitoring at key network points
• Create detection scripts for suspicious DNS and repeated connections
• Forward Zeek logs to a central security monitoring system