Mahipal

Set up MISP to collect threat feeds and centrally manage indicators such as suspicious IP addresses and domains. Configure automated synchronization, connect related findings, and export indicators to security monitoring platforms or blocklists.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Centralizing threat indicators from multiple feeds
• Deploying MISP with Docker
• Automating threat feed synchronization

Reconstruct activity on a compromised computer by combining file timestamps, event logs, browser history, and other evidence into one timeline. Extract and filter events with Plaso, then review and annotate them collaboratively in Timesketch.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Reconstructing the sequence of a computer compromise
• Comparing events across logs and file records
• Investigating timestamp changes and cleared logs

Collect indicators of compromise, technical clues such as suspicious domains and file hashes, from incident evidence. Add context and confidence scores, then prepare them for detection, blocking, and structured sharing with partners.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Extracting threat indicators from incident evidence
• Adding threat context and confidence scores to indicators
• Preparing indicator lists for detection and blocking

Review personal data handling against GDPR requirements, covering processing records, legal grounds, individual rights, breach procedures, and international transfers. Produce findings by article and a prioritized improvement roadmap with responsibilities, estimated costs, and timelines.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Preparing evidence for a regulatory audit
• Reviewing privacy requirements for a new system
• Assessing GDPR gaps during acquisition due diligence

Set up Microsoft Sentinel to collect security logs from AWS, Azure, and GCP. Build detection queries, investigate historical activity, and create automated response workflows for a centralized security operations team.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Centralizing security monitoring across multiple clouds
• Migrating from an existing SIEM platform
• Automating responses to suspicious cloud activity

Set up an email reporting button and an automated security response workflow. Classify reported messages, extract attack indicators, remove confirmed phishing emails, and send feedback to the people who reported them.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Deploying a phishing reporting button in Outlook
• Automating triage of a dedicated reporting mailbox
• Retracting confirmed phishing emails across inboxes

Map Active Directory permissions, group memberships, and user sessions with BloodHound CE. Reveal paths from ordinary accounts to administrator privileges, prioritize findings, and document evidence for authorized assessments or checks after security hardening.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Find paths from ordinary accounts to Domain Admin
• Review access permissions and group relationships
• Verify that hardening closed known attack paths

Collect evidence from a compromised computer before shutdown or remediation erases it. Preserve memory, network connections, processes, and system state, then record integrity hashes and handling history to support incident investigation and evidence tracking.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Preserving evidence before shutting down a compromised computer
• Collecting memory evidence for suspected fileless malware
• Recording active connections and processes during an intrusion

Collect and organize victim postings from ransomware data leak sites through tracking feeds. Analyze group activity over time, compare sector and country patterns, and produce threat reports with risk assessments and defensive recommendations.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Track monthly activity across ransomware groups
• Assess ransomware exposure by sector or country
• Identify newly observed ransomware groups

Audit Microsoft Entra ID identity settings to uncover weak authentication policies, excessive administrator privileges, inactive accounts, and guest access risks. Review conditional access rules and sign-in logs, then organize findings into a prioritized security report.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Auditing authentication and administrator access in an Azure tenant
• Assessing identity settings before integrating an acquired tenant
• Finding inactive accounts and privileged guest users

Audit Kubernetes access rules to find excessive permissions and service account token abuse paths. Trace which users or workloads could gain cluster administrator access, then produce prioritized findings and recommendations for reducing permissions.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Reviewing Kubernetes privilege escalation paths
• Checking permissions after an RBAC change
• Tracing workloads with overprivileged service accounts

Analyze a software bill of materials, an inventory of software components, against known vulnerability records. Trace indirect dependencies, assess risk, and produce reports that help teams prioritize fixes and review supplier software.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Assessing vulnerabilities in vendor-provided software inventories
• Checking whether a newly disclosed CVE affects deployed software
• Adding SBOM vulnerability checks to CI/CD

Audit Kubernetes RBAC, the rules that assign access through roles, to identify excessive permissions, risky role assignments, and paths to gaining higher privileges. Review service accounts and produce findings with recommended permission changes.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Reviewing access permissions in shared Kubernetes clusters
• Finding accounts that can read secrets or gain higher privileges
• Checking service account token mounts

Simulate device-code and app-consent phishing in an explicitly authorized Microsoft Entra ID environment. Assess whether authentication and consent controls prevent token misuse, map reachable Microsoft 365 resources, and document findings with remediation recommendations.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Run authorized Microsoft 365 phishing exercises
• Validate Conditional Access and MFA controls
• Test restrictions on app consent

Create automated workflows that add threat intelligence to suspicious IP addresses, domains, URLs, and file hashes. Combine findings from multiple services into consistent alert context and confidence scores to support analysts reviewing security alerts.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Adding threat context to security alerts
• Processing indicators from phishing email submissions
• Standardizing bulk indicator lookups from threat feeds

Use ROADrecon and roadtx during authorized Microsoft Entra ID testing to inspect directory objects and authentication tokens, which represent access permissions. Explore collected configuration offline, test token exchanges, and assess conditional access and device controls.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Mapping tenant users, groups, roles, and applications
• Reviewing conditional access policies
• Testing token exchanges and device-based single sign-on

Identify and unpack malware compressed with UPX to prepare executable files for static analysis, which examines code without running it. The workflow covers altered header repair, debugger-based recovery, and validation before analysis in Ghidra or IDA.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Identifying suspected UPX-packed samples
• Investigating failed UPX decompression
• Recovering binaries with a debugger

Analyze threat intelligence feeds to extract indicators of compromise, observable clues of possible attacks, and their campaign context. Assess source quality, standardize formats, remove duplicates, and enrich indicators for distribution to security monitoring systems.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Assessing the quality and relevance of threat intelligence feeds
• Standardizing indicators into STIX 2.1
• Removing duplicates and adding attack campaign context

Examine Outlook PST and OST archives to extract messages, headers, attachments, and recoverable deleted items. Use the extracted records to trace email routing, reconstruct communication patterns, and support incident investigations or legal evidence review.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Investigating suspicious emails in Outlook archives
• Tracing message routes through email headers
• Extracting attachments for further analysis

Map threat groups and their attack techniques to MITRE ATT&CK, a catalog of adversary behavior. Generate Navigator visualization files, compare groups, and overlay detection coverage to identify gaps that can guide defensive planning.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Profiling the attack techniques used by a specific threat group
• Comparing techniques across multiple threat groups
• Finding detection gaps against a target adversary

Analyze Windows Registry files to uncover user activity, installed software, USB connections, and automatic startup entries. Organize these traces into investigation summaries and timelines to help examine suspicious activity and possible malware persistence.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Investigating suspicious automatic startup entries
• Reconstructing user activity around an incident
• Checking USB device connection traces

Audit MCP servers, which provide external tools to AI agents, for hidden instructions, changes after approval, unsafe internal requests, and missing authentication. Use mcp-scan and manual checks to document risks and recommended fixes.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Reviewing an MCP server before adding it to an agent
• Auditing an internally developed MCP server
• Checking approved tools for unexpected changes

Examine NTFS disk images for residual or hidden data beyond standard file recovery. Analyze file metadata, change records, unused space within allocated storage, and Alternate Data Streams to reconstruct available activity and identify suspicious timestamp differences.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Find residual data in file slack space
• Investigate metadata left by deleted files
• Reconstruct recorded file changes

Map attacker behaviors and indicators of compromise, or traces of an intrusion, to MITRE ATT&CK techniques. Build coverage heatmaps, compare threat groups, and identify monitoring gaps to guide detection improvements and threat intelligence reporting.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Mapping attacker behaviors and intrusion traces to ATT&CK techniques
• Visualizing detection coverage with ATT&CK Navigator
• Identifying attack techniques missing from monitoring