Mahipal

Investigate forged Kerberos authentication tickets in Active Directory by checking Windows logs for unusual encryption, excessive ticket lifetimes, and missing authentication requests. Produce a JSON report of suspicious indicators with risk ratings.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Investigating suspected forged authentication tickets
• Checking for possible krbtgt credential theft
• Building detection rules from authentication logs

Assess Bluetooth Low Energy devices by capturing wireless traffic, inspecting available data services, and checking pairing security. Identify signs of interception, reused commands, and data access that lacks authentication.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Assess BLE security on IoT devices
• Check whether devices accept replayed commands
• Investigate suspicious pairing and device impersonation

Investigate attackers moving between internal systems by correlating login records with network traffic. Supports detection rules, suspicious SMB and RDP activity analysis, and reports showing attack timelines, affected hosts, and monitoring gaps.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Investigating attacker movement across internal systems
• Creating rules for suspicious authentication patterns
• Tracing affected hosts after a PsExec alert

Examine Zeek connection logs for regular callbacks that may indicate communication with an attacker’s control server. Use ZAT and Pandas to group connections, measure timing variation, and identify source and destination pairs for further investigation.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Hunting for periodic callbacks in Zeek connection logs
• Comparing connection timing across source and destination pairs
• Developing beaconing detection rules and hunting queries

Connect security incidents across organizations by comparing attack indicators, techniques, and timelines. Build relationship graphs and campaign reports that document shared evidence, attribution confidence, and indicators useful for detection.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Linking incidents that share attack indicators
• Analyzing attacks across partner organizations
• Preparing reports on sustained attack campaigns

Conduct authorized WiFi security assessments covering authentication, encryption, rogue access points, and network separation. Test WPA2/WPA3 configurations and client behavior, then document weaknesses, evidence, business impact, and recommended fixes.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Assessing corporate, guest, and IoT WiFi security
• Evaluating WPA3 migration and transition mode
• Testing rogue access point detection

Screen AI application inputs and historical logs for prompt injection, where malicious instructions try to redirect the model. Combine pattern matching, text structure scoring, and a DeBERTa classifier to flag suspicious content and produce JSON results.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Screening chatbot and AI agent inputs
• Checking external text used in retrieval-based AI applications
• Auditing historical interaction logs for injection attempts

Deploy a Software-Defined Perimeter that connects verified users to authorized applications. Configure single-packet authorization, mutual certificate authentication, access policies, and monitoring, then test whether unauthorized connections and access between applications are blocked.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Building zero trust access to internal applications
• Hiding services from unauthenticated network scans
• Testing certificate authentication and access restrictions

Build normal traffic profiles for industrial control networks and identify unusual connections, polling intervals, and protocol operations. Use machine learning and process records to investigate deviations and produce anomaly reports with severity levels.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Establishing normal traffic profiles for industrial networks
• Detecting unusual connections and polling intervals
• Investigating Nozomi Guardian or Dragos alerts

Deploy decoy credentials, documents, and URLs with Canarytokens to detect suspicious access. Guides token generation, placement, alert testing, and inventory tracking, with email or webhook notifications when someone interacts with a planted token.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Add intrusion alerts to shared folders
• Detect use of decoy cloud credentials
• Monitor decoy documents for signs of data theft

Set up Cloudflare Access and Tunnel to protect internal applications using user identity and device health checks. Covers application access policies, WARP device enrollment, and audit logging for teams replacing VPN access.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Replace VPN access with application-specific permissions
• Expose internal apps without opening inbound ports
• Limit contractors to approved applications

Deploy osquery on Windows, macOS, and Linux to inspect processes, listening ports, software, and system settings using SQL, a database query language. Configure scheduled checks and centralized management to support threat hunting and compliance monitoring.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Deploying osquery across Windows, macOS, and Linux
• Investigating suspicious processes and network connections with SQL
• Periodically checking software inventories and system settings

Deploy Prisma Access to secure access to internal applications for remote users and branches. Configure connectors, GlobalProtect agents, access policies based on user groups and device security, and centralized logging through Strata Cloud Manager.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Migrating VPN and branch security to Prisma Access
• Restricting internal app access by user and device
• Integrating access controls with existing Palo Alto NGFW systems

Unwrap layers of obfuscated PowerShell malware to recover hidden commands, additional malicious code, and server addresses. Combines script structure analysis with execution tracing and decoding tools to support incident investigation and detection work.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Investigating an obfuscated PowerShell script
• Recovering hidden commands and additional malicious code
• Extracting suspicious URLs, IP addresses, and file paths

Deploy decoy accounts, service entries, and policy objects in Active Directory to detect suspicious activity. Configure monitoring rules for Windows security events and validate alerts for credential misuse, reconnaissance, and movement between systems.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Detecting Kerberoasting with decoy service entries
• Monitoring attempts to use decoy credentials
• Placing credential traps in decoy Group Policy objects

Design and configure VLANs, logical network partitions, to separate employee devices, servers, guests, and IoT equipment. Covers traffic restrictions between zones, switch security settings, and tests to verify that the intended isolation works.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Separating guest WiFi and IoT devices from internal systems
• Planning network isolation for payment processing systems
• Restricting communication between network zones

Analyze malicious JavaScript from phishing pages, payment data theft scripts, and malware downloaders. Unwrap encoded strings and nested execution layers to reveal hidden behavior, identify stolen data fields, and document suspicious destinations for incident response.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Analyzing obfuscated scripts on phishing pages
• Investigating payment data theft on checkout pages
• Examining JavaScript that downloads further malware

Contain an active security breach by isolating endpoints, blocking attacker communications, and revoking compromised access. Follow procedures to limit spread between systems, preserve evidence, verify containment, and report remaining risks and business impact.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Contain ransomware spreading between servers
• Revoke access through compromised accounts
• Isolate hosts communicating with attacker infrastructure

Deploy CrowdStrike Falcon sensors across Windows, macOS, and Linux endpoints. Configure threat prevention and response policies, verify installation and detection, troubleshoot sensor issues, and connect events to SIEM platforms, which collect security logs for analysis.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Deploying Falcon sensors across enterprise endpoints
• Configuring prevention and response policies by endpoint group
• Checking sensor connectivity and test detections

Deploy decoy files and monitor changes, renames, and deletions for early signs of ransomware. This skill guides Python monitoring, email, Slack, and syslog alerts, plus simulated file operations to verify that the detection and notification pipeline works.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Monitoring shared drives and NAS for suspicious file changes
• Adding decoy file monitoring alongside endpoint protection
• Testing incident response with decoy file triggers

Set up encrypted connections between devices with Tailscale and control access by user or device. The skill covers network routing, device name resolution, and self-hosting the coordination server with Headscale.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Replacing a traditional VPN with Tailscale
• Restricting server access by team or device
• Connecting remotely to internal networks

Plan and measure defensive deception operations with MITRE Engage. Connect decoy systems and credentials to specific attacker techniques, define measurable objectives, and document operating boundaries, response procedures, and criteria for assessing results.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Giving existing honeypots a coordinated strategy
• Selecting decoys for a specific threat actor
• Writing an adversary engagement operation plan

Set up decoy credentials, storage, and secrets across AWS, Azure, and GCP to detect suspicious access. Connect audit logs to security alerts, verify detection, and document permissions, resource inventories, and maintenance plans.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Detecting use of leaked cloud credentials
• Monitoring suspicious access to decoy storage and secrets
• Extending on-premises deception coverage to cloud environments

Configure Zscaler Private Access to replace VPN access with access to specific internal applications. The skill covers connectors, application groups, identity and device checks, browser access, and logging for deployment and migration reviews.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Migrating remote access from VPN to ZPA
• Limiting application access by user group and device condition
• Providing contractors with browser access to approved applications