Mahipal

Search public TLS certificate records through crt.sh and pycrtsh to investigate lookalike domains, unexpected certificate issuers, and untracked IT assets. Compare domain spellings and review certificate details to support phishing detection and certificate monitoring.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Finding domains that imitate a brand
• Reviewing unexpected certificate issuers
• Investigating untracked domains and IT assets

Examine Outlook PST and OST archives to extract messages, headers, attachments, and recoverable deleted items. Use the extracted records to trace email routing, reconstruct communication patterns, and support incident investigations or legal evidence review.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Investigating suspicious emails in Outlook archives
• Tracing message routes through email headers
• Extracting attachments for further analysis

Build a Python system that follows DNS history, domain registration records, and certificate information from known suspicious domains or IP addresses. Map related attack infrastructure, identify shared connections, and monitor for newly discovered domains matching known patterns.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Finding related domains from a known suspicious IP
• Mapping attacker command-and-control infrastructure
• Monitoring domains that match known naming patterns

Set up and run kube-bench to check Kubernetes configuration against CIS security benchmarks. Select the appropriate benchmark and cluster components, then export JSON or JUnit results for automated pipelines and troubleshoot skipped checks or incorrect detection.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Setting up kube-bench for the first time
• Selecting benchmark versions and scan targets
• Exporting JSON or JUnit results for CI

Use ROADrecon and roadtx during authorized Microsoft Entra ID testing to inspect directory objects and authentication tokens, which represent access permissions. Explore collected configuration offline, test token exchanges, and assess conditional access and device controls.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Mapping tenant users, groups, roles, and applications
• Reviewing conditional access policies
• Testing token exchanges and device-based single sign-on

Identify and unpack malware compressed with UPX to prepare executable files for static analysis, which examines code without running it. The workflow covers altered header repair, debugger-based recovery, and validation before analysis in Ghidra or IDA.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Identifying suspected UPX-packed samples
• Investigating failed UPX decompression
• Recovering binaries with a debugger

Map attacker behaviors and indicators of compromise, or traces of an intrusion, to MITRE ATT&CK techniques. Build coverage heatmaps, compare threat groups, and identify monitoring gaps to guide detection improvements and threat intelligence reporting.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Mapping attacker behaviors and intrusion traces to ATT&CK techniques
• Visualizing detection coverage with ATT&CK Navigator
• Identifying attack techniques missing from monitoring

Analyze Windows Amcache records to investigate applications, deleted executable traces, and drivers. Extract file details, compare SHA-1 hashes with malware databases, and combine records into a timeline to support incident investigations.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Investigating traces of deleted executables
• Checking software installed during an incident
• Comparing file hashes with malware databases

Analyze threat intelligence feeds to extract indicators of compromise, observable clues of possible attacks, and their campaign context. Assess source quality, standardize formats, remove duplicates, and enrich indicators for distribution to security monitoring systems.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Assessing the quality and relevance of threat intelligence feeds
• Standardizing indicators into STIX 2.1
• Removing duplicates and adding attack campaign context

Use Intel CHIPSEC to inspect firmware protections, including BIOS write locks and Secure Boot settings. Save test results, extract firmware for offline comparison, and review UEFI variables to investigate configuration weaknesses or suspicious changes.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Establishing a firmware security baseline for new hardware
• Checking BIOS and SPI flash write protection
• Extracting firmware for comparison with a known-good image

Prepare for CMMC Level 2, a cybersecurity certification for defense contractors. Define the systems handling controlled information, review security requirements, calculate the SPRS assessment score, and organize remediation plans and evidence into a readiness report.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Define the assessment scope for systems handling controlled information
• Calculate an SPRS score and prioritize unmet security requirements
• Prepare security plans, remediation milestones, and assessment evidence

Investigate malware hidden in boot records, UEFI firmware, or the operating system’s core. The skill guides evidence collection, boot integrity checks, firmware and memory analysis, and reporting of persistence mechanisms and remediation steps when compromise survives an OS reinstall.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Investigating infections that survive an OS reinstall
• Examining unexplained Secure Boot integrity violations
• Finding hidden processes and suspicious kernel drivers

Create disk images for investigations using dd or dcfldd on Linux. The workflow covers write protection, bit-for-bit copying, hash checks to verify integrity, and documentation of the acquisition process.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Preserving a suspect drive before investigation
• Creating evidence copies of USB devices or memory cards
• Verifying that a disk image matches its source

Investigate captured network traffic and connection records with Wireshark, Zeek, and NetFlow analysis. Identify communications with attacker infrastructure, trace movement between internal systems, estimate data transfers, and produce findings linked to packet evidence and timestamps.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Investigating suspicious periodic connections
• Measuring the volume and destination of data transfers
• Tracing attacker movement between internal systems

Inspect suspicious PDFs without opening them in a document viewer. Use peepdf, pdfid, and pdf-parser to examine internal objects, extract embedded code and files, and report threat indicators such as URLs and hashes.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Triaging suspicious PDF email attachments
• Investigating PDF exploit documents
• Extracting embedded JavaScript and files

Analyze NetFlow v9 and IPFIX records, which summarize network connections, to spot traffic spikes, scanning, unusual outbound transfers, and periodic connections. Compare traffic against normal patterns and produce a prioritized findings report.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Investigating sudden increases in network traffic
• Checking unusual outbound transfers for possible data theft
• Finding periodic connections to external control servers

Map threat groups’ documented attack techniques in MITRE ATT&CK Navigator. Creates visual layers and heatmaps, compares groups, and highlights techniques missing from existing detection coverage to support security reporting and decisions about detection priorities.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Visualizing a threat group's attack techniques
• Comparing techniques shared by multiple threat groups
• Finding gaps in existing detection coverage

Examine captured network traffic for hidden malware communications in DNS, ICMP, and HTTP. Analyze domain patterns, packet sizes, and traffic frequency to identify suspicious channels used for remote control or data theft.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Investigating suspicious DNS, ICMP, or HTTP traffic
• Hunting for hidden malware control channels in packet captures
• Assessing possible data theft through unusual network traffic

Inspect Windows startup entries with Sysinternals Autoruns to find possible malware persistence, settings that let malware restart automatically. Review signatures, file locations, and changes from a clean baseline to identify entries that need investigation.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Investigating suspicious startup entries on a Windows endpoint
• Comparing startup settings against a clean baseline
• Checking for remaining malware startup entries after cleanup

Analyze access logs from AWS S3, GCS, and Azure Blob Storage to spot unusual downloads, unfamiliar IP addresses, and request spikes. Compare activity with normal patterns and prioritize findings for suspected data theft investigations.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Investigating suspected data theft from cloud storage
• Finding bulk downloads outside normal working hours
• Checking unfamiliar IP addresses and sudden request spikes

Analyze Solidity smart contracts with Slither and Mythril before Ethereum deployment. Combine code inspection with execution path analysis, review potential vulnerabilities, remove duplicate findings, and produce an audit report with severity ratings and suggested fixes.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Checking Solidity contracts before deployment
• Investigating reentrancy and access control weaknesses
• Consolidating findings from Slither and Mythril

Assess Shadow Credentials account takeover during authorized Active Directory testing. Examine permissions that allow public key registration, validate authentication without a password reset, and document credential cleanup, detection opportunities, and access control changes needed for remediation.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Assessing risky permissions identified in BloodHound
• Validating account takeover without resetting a password
• Generating directory change records during security exercises

Review Active Directory permissions with ldap3, a Python library for directory queries. Identify excessive access granted to non-administrative accounts, explain potential privilege escalation paths, and produce a JSON report with affected objects and remediation recommendations.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Auditing excessive Active Directory permissions
• Investigating privilege escalation paths from ordinary accounts
• Reporting affected objects and permission remediation recommendations

Investigate suspicious URLs with URLScan.io by reviewing screenshots, redirects, page content, and network requests. Extract domains, IP addresses, and file hashes as indicators of compromise, then compare findings with threat intelligence sources.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Investigating suspicious links in emails
• Checking pages for brand impersonation and credential forms
• Tracing redirects and extracting domains, IPs, and hashes