Mahipal

Configure advanced Microsoft Defender protections on Windows, including rules that block risky behavior, protected folders, network filtering, and exploit defenses. Use audit modes to assess application impact, then deploy policies and monitor detections across an organization.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Strengthening Windows endpoint protection
• Assessing ASR rules in audit mode
• Configuring ransomware protection for folders

Deploy and configure Snort 3 to detect suspicious network traffic. Create custom detection rules, tune community rules to reduce false alerts, test them against captured traffic, and forward alerts to a central security monitoring platform.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Deploy intrusion detection at network boundaries
• Write rules for organization-specific threats
• Reduce noisy or false alerts

Analyze RAM dumps with Volatility 3 to investigate suspicious processes, network connections, injected code, and credential theft. Guides memory capture and evidence extraction, then organizes findings into a forensic report for incident response.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Investigating malware that runs only in memory
• Checking suspicious processes and network connections
• Investigating signs of credential theft

Deploy a Software-Defined Perimeter that connects verified users to authorized applications. Configure single-packet authorization, mutual certificate authentication, access policies, and monitoring, then test whether unauthorized connections and access between applications are blocked.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Building zero trust access to internal applications
• Hiding services from unauthenticated network scans
• Testing certificate authentication and access restrictions

Contain an active security breach by isolating endpoints, blocking attacker communications, and revoking compromised access. Follow procedures to limit spread between systems, preserve evidence, verify containment, and report remaining risks and business impact.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Contain ransomware spreading between servers
• Revoke access through compromised accounts
• Isolate hosts communicating with attacker infrastructure

Set up encrypted connections between devices with Tailscale and control access by user or device. The skill covers network routing, device name resolution, and self-hosting the coordination server with Headscale.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Replacing a traditional VPN with Tailscale
• Restricting server access by team or device
• Connecting remotely to internal networks

Unwrap layers of obfuscated PowerShell malware to recover hidden commands, additional malicious code, and server addresses. Combines script structure analysis with execution tracing and decoding tools to support incident investigation and detection work.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Investigating an obfuscated PowerShell script
• Recovering hidden commands and additional malicious code
• Extracting suspicious URLs, IP addresses, and file paths

Assess whether stolen Kerberos tickets, credentials used for network authentication, can enable access to other systems during authorized testing. Guide ticket extraction and reuse, review detection indicators, and document evidence for security reports.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Authorized testing of access through reused tickets
• Checking detection of Kerberos ticket theft
• Collecting evidence for lateral movement reports

Strengthen LDAP and Active Directory services by reviewing encrypted connections, signing, channel binding, access controls, and audit logging. Use the guidance to organize security settings, validate them in a test environment, and document implementation evidence.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Reviewing LDAP or Active Directory security settings
• Organizing encrypted connections and authentication protections
• Checking audit logging and monitoring arrangements

Set up Cloudflare Access and Tunnel to protect internal applications using user identity and device health checks. Covers application access policies, WARP device enrollment, and audit logging for teams replacing VPN access.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Replace VPN access with application-specific permissions
• Expose internal apps without opening inbound ports
• Limit contractors to approved applications

Configure Zscaler Private Access to replace VPN access with access to specific internal applications. The skill covers connectors, application groups, identity and device checks, browser access, and logging for deployment and migration reviews.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Migrating remote access from VPN to ZPA
• Limiting application access by user group and device condition
• Providing contractors with browser access to approved applications

Investigate reported phishing emails by checking sender details, links, and attachments. Identify affected recipients and exposed login credentials, guide removal of malicious messages across the organization, and secure compromised accounts with password resets and session revocation.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Investigating a suspicious email reported by an employee
• Assessing exposure after a link click or credential entry
• Removing phishing messages across organizational mailboxes

Plan and run authorized security tests that simulate deceptive emails, calls, text messages, and in-person approaches. Measure employee responses, compare results across test methods, and report gaps in security awareness training and access controls.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Planning an authorized social engineering assessment
• Measuring responses to simulated phishing
• Evaluating phone and physical access checks

Deploy Suricata to detect suspicious network traffic or block it inline. Configure protocol inspection, detection rules, and structured EVE JSON logs, then connect logs to analysis platforms and check packet drops and alert quality during operation.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Deploying network intrusion monitoring
• Configuring inline blocking of malicious traffic
• Adding custom detection rules and reducing noisy alerts

Plan authorized spearphishing simulations, personalized phishing tests aimed at specific people. Prepare scenarios and email infrastructure, track delivery and participant responses, and document findings to assess email security controls and improve security awareness.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Designing authorized phishing simulations for specific personnel
• Preparing test email delivery infrastructure
• Measuring delivery, opens, clicks, and reporting behavior

Plan and measure defensive deception operations with MITRE Engage. Connect decoy systems and credentials to specific attacker techniques, define measurable objectives, and document operating boundaries, response procedures, and criteria for assessing results.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Giving existing honeypots a coordinated strategy
• Selecting decoys for a specific threat actor
• Writing an adversary engagement operation plan

Configure cryptographic key storage and operations through PKCS#11, a standard interface for security devices. Work with physical HSMs or SoftHSM2 for development to generate keys, sign data, encrypt information, and check key export restrictions.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Configure protected key storage on a physical HSM
• Test PKCS#11 workflows with SoftHSM2
• Sign and encrypt data using keys stored inside an HSM

Set up Cisco Duo multi-factor authentication for VPN, RDP, SSH, and web applications. Configure access rules based on users and device health, introduce security keys, and establish authentication monitoring and emergency access procedures.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Adding Duo authentication to VPN and remote server access
• Strengthening authentication for privileged accounts
• Restricting access based on device health

Set up repeatable security tests for LLM apps with Promptfoo and DeepTeam. Connect them to automated build pipelines, detect renewed vulnerabilities to malicious instructions or data leakage, and compare results across model or prompt changes.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Running automated attack tests on every code change
• Blocking merges when security tests fail
• Comparing security across model or prompt versions

Deploy decoy files and monitor changes, renames, and deletions for early signs of ransomware. This skill guides Python monitoring, email, Slack, and syslog alerts, plus simulated file operations to verify that the detection and notification pipeline works.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Monitoring shared drives and NAS for suspicious file changes
• Adding decoy file monitoring alongside endpoint protection
• Testing incident response with decoy file triggers

Configure OAuth 2.0 authorization for web and mobile apps or service communication. Choose suitable flows, implement PKCE to protect authorization codes, limit permissions, and manage token storage, renewal, and revocation with security checks.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Implement authorization with PKCE for web and mobile apps
• Configure authorization for service-to-service communication
• Review token storage, renewal, and revocation

Configure pfSense to separate internal, guest, DMZ, and IoT networks. Set firewall rules, port forwarding, VPN connections, and bandwidth policies, then check traffic logs and test that each network can reach only its intended destinations.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Separate staff, guest, server, and IoT networks
• Set port forwarding rules for externally accessible services
• Configure VPN access and bandwidth policies

Configure Google Cloud IAP to check identity before granting access to internal applications and virtual machines. Set permissions by user group, device, and network, configure reauthentication, enable service-account access, and record access decisions for monitoring.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Replacing VPN access to internal Google Cloud applications
• Restricting sensitive tools to managed devices
• Configuring SSH and RDP access through IAP tunnels

Deploy decoy accounts, service entries, and policy objects in Active Directory to detect suspicious activity. Configure monitoring rules for Windows security events and validate alerts for credential misuse, reconnaissance, and movement between systems.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Detecting Kerberoasting with decoy service entries
• Monitoring attempts to use decoy credentials
• Placing credential traps in decoy Group Policy objects