Mahipal

Plan and run authorized security tests that simulate deceptive emails, calls, text messages, and in-person approaches. Measure employee responses, compare results across test methods, and report gaps in security awareness training and access controls.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Planning an authorized social engineering assessment
• Measuring responses to simulated phishing
• Evaluating phone and physical access checks

Design and configure VLANs, logical network partitions, to separate employee devices, servers, guests, and IoT equipment. Covers traffic restrictions between zones, switch security settings, and tests to verify that the intended isolation works.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Separating guest WiFi and IoT devices from internal systems
• Planning network isolation for payment processing systems
• Restricting communication between network zones

Plan authorized voice phishing assessments to evaluate how employees verify callers and report suspicious calls. Organize approved scenarios, record assessment outcomes, and summarize disclosure, verification, and reporting rates to review security awareness training.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Planning an authorized voice phishing assessment
• Evaluating caller verification and security reporting
• Reviewing the effectiveness of security awareness training

Set up host-based intrusion detection to monitor changes on Windows and Linux endpoints. Configure Wazuh agents, file integrity checks, registry monitoring, alert rules, and automated responses, with guidance on exclusions and centralized security monitoring.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Deploying Wazuh agents on Windows and Linux
• Monitoring critical files and registry changes
• Planning change detection for compliance requirements

Configure AWS Verified Access for VPN-free access to internal applications. Combine user identity and device security checks, write Cedar access policies, and use Terraform and AWS RAM to deploy and share access controls across AWS accounts.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Replacing VPN access to internal applications
• Writing policies based on users and device security
• Deploying Verified Access with Terraform

Configure Google Cloud IAP to check identity before granting access to internal applications and virtual machines. Set permissions by user group, device, and network, configure reauthentication, enable service-account access, and record access decisions for monitoring.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Replacing VPN access to internal Google Cloud applications
• Restricting sensitive tools to managed devices
• Configuring SSH and RDP access through IAP tunnels

Set up MISP to collect threat feeds and centrally manage indicators such as suspicious IP addresses and domains. Configure automated synchronization, connect related findings, and export indicators to security monitoring platforms or blocklists.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Centralizing threat indicators from multiple feeds
• Deploying MISP with Docker
• Automating threat feed synchronization

Design employee access management across multiple systems using HR records. This skill covers account changes when people join, move roles, or leave, along with role definitions, approval workflows, periodic access reviews, and cleanup of accounts left behind.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Automating account changes for hires, transfers, and departures
• Finding accounts that remain after employees leave
• Reviewing overlapping roles and unnecessary permissions

Build dashboards that show how long vulnerabilities remain unresolved and compare remediation times with severity-based deadlines. Define response policies, automate escalation notices, and report compliance rates and other measures of remediation progress.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Define vulnerability remediation deadlines
• Visualize overdue vulnerabilities
• Automate reminders and management escalations

Assess an internal network from the position of an intruder or malicious insider. Covers discovering systems, testing paths to other machines and higher privileges, demonstrating sensitive data access, and documenting findings with remediation recommendations.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Assessing damage possible after a workstation compromise
• Reviewing Active Directory paths to higher privileges
• Testing internal network security controls

Collect indicators of compromise, technical clues such as suspicious domains and file hashes, from incident evidence. Add context and confidence scores, then prepare them for detection, blocking, and structured sharing with partners.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Extracting threat indicators from incident evidence
• Adding threat context and confidence scores to indicators
• Preparing indicator lists for detection and blocking

Assess authorized web applications for pages and APIs that allow access without authentication. Discover hidden URLs and exposed configuration or backup files, compare signed-in and signed-out responses, and document affected resources, impact, and recommended fixes.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Finding administrative pages accessible without signing in
• Checking authentication requirements on APIs
• Locating exposed configuration and backup files

Draft malware incident communications for internal teams, executives, IT responders, customers, and regulators. Provides structured templates and severity-based notification workflows to organize impact details, response actions, decisions needed, and the timing of updates.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Prepare an initial internal notification about a malware incident
• Summarize business impact and decisions for executives
• Draft technical response instructions for IT teams

Build a ransomware response playbook for security monitoring teams, covering detection, containment, eradication, and recovery. Include log queries, decision trees, evidence collection, backup restoration, and incident reviews to prepare consistent procedures before an attack occurs.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Creating a standardized ransomware response playbook
• Documenting host isolation and recovery procedures
• Addressing coordination gaps found in tabletop exercises

Reconstruct activity on a compromised computer by combining file timestamps, event logs, browser history, and other evidence into one timeline. Extract and filter events with Plaso, then review and annotate them collaboratively in Timesketch.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Reconstructing the sequence of a computer compromise
• Comparing events across logs and file records
• Investigating timestamp changes and cleared logs

Create a ransomware response playbook aligned with CISA guidance and NIST CSF, a cybersecurity framework. Organize preparation, detection, containment, recovery, and lessons learned into actionable checklists for readiness reviews and simulated incident exercises.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Creating or updating a ransomware response playbook
• Assessing readiness against CISA guidance
• Validating response steps in a tabletop exercise

Support authorized Active Directory assessments of DCSync, which abuses directory replication rights to obtain credential data. Cover replication permission review, Golden Ticket persistence testing, detection validation, and documentation of evidence and remediation recommendations.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Reviewing accounts with directory replication rights
• Testing DCSync risks in an authorized lab
• Validating detection of replication abuse and forged tickets

Turn threat intelligence and detection gaps into testable investigation hypotheses. Use endpoint monitoring and security log queries to examine evidence, validate findings, connect related activity, and document risks and recommended actions in a consistent hunt report.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Planning a hunt based on threat intelligence
• Investigating gaps in ATT&CK coverage
• Testing hypotheses prompted by unusual activity

Build security detection rules in Splunk using SPL, its search language. Use examples for suspicious logins, network traffic, and PowerShell activity to develop searches, add context and severity, test historical logs, and measure false alerts.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Creating rules to detect suspicious login activity
• Detecting large outbound transfers and access to multiple hosts
• Testing detection rules against historical logs

Map Active Directory permissions, group memberships, and user sessions with BloodHound CE. Reveal paths from ordinary accounts to administrator privileges, prioritize findings, and document evidence for authorized assessments or checks after security hardening.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Find paths from ordinary accounts to Domain Admin
• Review access permissions and group relationships
• Verify that hardening closed known attack paths

Build threat actor profiles from public reports, social media, code repositories, and other intelligence sources. Correlates indicators, maps related infrastructure and attack techniques, and produces structured dossiers with confidence assessments about who may be responsible.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Consolidating public information about an attacker group
• Comparing aliases, targets, and motivations across sources
• Mapping related domains, IP addresses, and infrastructure

Build incident response dashboards that bring affected systems, containment progress, indicators of compromise, and response timelines into one view. Help security teams coordinate active incidents and prepare operational reports and executive briefings.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Coordinating an active security incident
• Tracking affected systems and containment
• Reviewing response timelines after an incident

Analyze existing user permissions to propose roles for role-based access control, which assigns permissions by job role. Compare candidate role sets, identify overlap and excess access, and validate definitions against business responsibilities.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Consolidating overlapping access roles
• Redesigning roles from existing permission data
• Reviewing excess and unusual permissions

Build a central platform for collecting, analyzing, and sharing cyber threat information. Connect MISP, OpenCTI, TheHive, and Cortex to import feeds, add context to suspicious indicators, manage cases, and track platform activity.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Build a central threat intelligence platform
• Automate threat feed ingestion
• Add context to suspicious IP addresses and domains