Mahipal

Investigate possible insider threats by correlating endpoint and security logs. Examine unusual data access, off-hours activity, bulk downloads, and privilege abuse, then document supporting evidence, risk, confidence, and recommended actions after checking the context for false positives.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Investigating bulk downloads before an employee leaves
• Reviewing data access outside an employee's duties
• Examining unauthorized queries by service accounts

Analyze Zeek DNS logs for possible data theft hidden in domain queries. The skill examines unusual character patterns, long labels, distinct subdomains, and query volume, then ranks suspicious domains and produces a JSON evidence report.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Investigating suspected DNS tunneling
• Finding possible data leaks hidden in DNS queries
• Ranking suspicious domains and identifying source IPs

Find dependency confusion risks, where a public package can replace an internal package with the same name. Review dependency files, identify exposed names, and guide registry restrictions and recurring CI checks to prevent substitution.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Auditing projects that mix private and public package registries
• Checking exposure after internal package names have leaked
• Restricting package sources to approved private registries

Analyze Zeek network logs to find lateral movement, when an intruder spreads between internal computers. Examine administrative file sharing, authentication across multiple hosts, and remote service operations to identify suspicious connections and reconstruct incident timelines.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Tracing spread to other computers after an initial compromise
• Investigating unauthorized transfers to administrative shares
• Finding one account authenticating to many internal hosts

Investigate attackers moving between internal systems by correlating login records with network traffic. Supports detection rules, suspicious SMB and RDP activity analysis, and reports showing attack timelines, affected hosts, and monitoring gaps.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Investigating attacker movement across internal systems
• Creating rules for suspicious authentication patterns
• Tracing affected hosts after a PsExec alert

Investigate Active Directory authentication logs with Splunk and KQL queries to find signs of Golden Ticket attacks, which use forged Kerberos authentication tickets. Examine encryption mismatches, missing ticket requests, unusual lifetimes, and account inconsistencies.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Hunting for forged tickets after credential theft
• Investigating encryption mismatches in authentication logs
• Checking for persistent access after incident response

Set up and operate Amazon GuardDuty to detect threats in AWS. Configure protection features, centralize findings across accounts, investigate suspicious activity, and build automated responses with EventBridge and Lambda, including containment of potentially compromised resources.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Setting up threat detection for AWS accounts
• Investigating credential abuse and compromised instances
• Automating responses to high-severity findings

Analyze DNS logs for signs of hidden command traffic and data theft. Use character randomness, query timing, TXT record inspection, and machine learning to identify suspicious domains and support security monitoring rules.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Investigating suspected DNS tunneling
• Classifying algorithmically generated domains
• Detecting periodic DNS beacon traffic

Examine recorded calls and voicemails for signs of AI-generated speech. Extract acoustic features, classify samples with machine learning, and prepare reports with confidence scores and sound visualizations to support voice impersonation investigations.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Investigating calls impersonating executives
• Checking suspicious voicemails
• Comparing suspect recordings with genuine voice samples

Set up AI email screening that compares writing style and communication habits to identify impersonation and suspicious payment requests. Connect detection policies to quarantine, warning banners, and analyst review workflows.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Detecting executive impersonation in emails
• Reviewing vendor payment change requests
• Flagging unusual employee email behavior

Investigate business email compromise, where impersonated executives or vendors request payments or sensitive data. Check sender details, unusual communication patterns, mailbox changes, and payment approval procedures to develop detection rules and verification controls.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Investigating emails impersonating executives or vendors
• Reviewing requests to change vendor bank details
• Building detection rules for fraudulent payment requests

Test whether API users can read or change fields beyond their permissions. Examine responses for sensitive data, inject extra request fields to check unauthorized updates, and use explicit lists of allowed fields to guide fixes.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Check API responses for excessive sensitive data
• Test whether added request fields allow unauthorized updates
• Compare field access across user privilege levels

Investigate lateral movement, where attackers expand access across Azure identities and tenants. Correlate audit logs and unusual sign-ins, build Microsoft Sentinel detection queries, and report affected identities with recommended containment actions.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Investigating suspicious Azure sign-ins
• Building Microsoft Sentinel detection rules
• Reviewing suspicious OAuth app consent

Investigate suspected email account takeovers by examining audit logs, sign-ins, inbox rules, and app permissions. Identify suspicious forwarding, unlikely travel between sign-ins, and unusual access, then summarize findings and recommended containment actions in a severity-rated report.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Investigating suspected business email compromise
• Checking for suspicious external forwarding rules
• Reviewing unusual sign-ins and app permissions

Investigate compromised credentials across AWS, Azure, and GCP by correlating security alerts and audit logs. Examines unusual API activity and suspicious sign-ins, helps assess the affected scope, and guides containment actions such as disabling keys and revoking sessions.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Investigate cloud API activity from unfamiliar locations
• Assess exposure after a credential leak notification
• Correlate suspicious sign-ins across cloud providers

Create and tune Falco rules to detect possible container escapes, where a container gains access to its host. Define detection conditions, alert priorities, and output fields, then refine exceptions to reduce false positives.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Writing rules for suspicious host filesystem access
• Investigating noisy container escape alerts
• Reusing detection conditions through macros and lists

Analyze AWS IAM access policies with boto3 and Cloudsplaining-style checks to find permissions that could grant greater access. Produces a JSON report linking risky permissions to users or roles, with severity ratings and remediation guidance.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Audit AWS IAM policies for excessive permissions
• Find permission combinations that enable privilege escalation
• Trace risky policies to affected users and roles

Develop attack detection for SCADA systems that monitor and control industrial equipment. Compare network traffic and process measurements with normal behavior to identify unauthorized commands, altered sensor data, communication disruption, and indicators of known industrial malware.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Introducing intrusion detection in a SCADA environment
• Investigating suspected attacks on industrial control systems
• Creating detection rules for industrial protocol abuse

Monitor local network traffic for ARP spoofing, where false address mappings can redirect traffic. Use ARPWatch, Wireshark, switch inspection settings, and Python monitoring to flag address changes, duplicate IP claims, gateway impersonation, and unusual ARP volumes.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Investigating suspected interception on a local network
• Monitoring changes in IP-to-MAC address mappings
• Checking duplicate IP claims and gateway impersonation

Investigate misuse of application identities in Microsoft Entra ID using audit and sign-in logs. Provides detection queries and investigation steps for suspicious credential additions, privileged role assignments, consent grants, and service principal enumeration.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Investigating suspicious additions of application credentials
• Reviewing privileged roles assigned to application identities
• Building detection rules for Entra ID identity abuse

Investigate attacks that make legitimate Windows applications load malicious DLL files. This skill examines loading events, digital signatures, file hashes, and unusual locations, then checks process behavior to document suspicious cases and guide remediation.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Investigating alerts about unsigned DLL files
• Hunting for persistent threats using legitimate applications
• Checking suspicious DLL loading paths

Examine Windows and Active Directory logs for attempts to extract passwords and other credentials. Identify suspicious memory access and database exports, correlate events with user and host context, and produce findings with severity ratings and detection queries.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Investigating alerts about suspicious LSASS access
• Finding signs of SAM or NTDS.dit extraction
• Creating detection queries for Splunk or Elastic

Detect unexpected changes in running containers by comparing them with their original images and monitoring execution and file activity. Use Falco or Microsoft Defender for Containers to investigate changes and guide isolation, replacement, and preventive configuration.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Finding unexpected binaries executed inside running containers
• Investigating package installations and file changes at runtime
• Checking whether containers still match their approved images

Analyze authentication logs to spot suspicious sign-ins, password attacks, and possible account compromise. Statistical baselines and machine learning help compare login activity with normal user behavior, while example SIEM queries support security investigations.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Investigating suspicious sign-in alerts
• Detecting geographically inconsistent logins
• Finding brute force and password spraying