스킬 찾기

Analyze Windows authentication logs for repeated password guesses against Remote Desktop services. Group failures by source IP and account, check for later successful logins, and produce a JSON report highlighting attack patterns and possible compromise.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Investigate repeated login failures on exposed RDP services
• Identify accounts targeted by password guessing
• Check for successful logins after repeated failures

Audit GitHub Actions workflows and CI/CD configurations for supply chain risks. Use Python and YAML parsing to identify unpinned actions, unsafe event expressions, excessive permissions, dependency confusion, and potential exposure of secrets in build pipelines.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Reviewing GitHub Actions workflow security
• Checking action version pinning
• Finding unsafe event expressions in scripts

Set up Zeek to observe network traffic and produce structured logs for security analysis. Create custom detection scripts, investigate suspicious DNS activity and repeated external connections, and forward logs to a central security monitoring system.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Set up passive monitoring at key network points
• Create detection scripts for suspicious DNS and repeated connections
• Forward Zeek logs to a central security monitoring system

Build real-time detection for ransomware encryption by combining changes in data randomness with file modification rates, renames, and process activity. Define behavioral scores and response thresholds, then check detection accuracy and monitoring overhead.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Building ransomware monitoring for endpoints and file servers
• Tuning detection thresholds to reduce false positives
• Investigating processes suspected of encrypting files

Investigate service account misuse by examining unexpected interactive logons, privilege changes, and movement between systems. Correlate endpoint and security logs, distinguish suspicious activity from legitimate operations, and document evidence, risk, and recommended responses.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Investigating unexpected interactive logons by service accounts
• Checking service account access outside its assigned scope
• Tracing suspicious movement between systems after hours

Design monitoring for industrial attacks that alter controller programs while hiding changes with false sensor readings. Compare PLC program blocks against known-good copies and check physical measurements against process models to identify suspicious inconsistencies.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Monitoring industrial controller programs for unauthorized changes
• Investigating discrepancies between sensor readings and equipment behavior
• Planning detection across IT and industrial control systems

Build detection rules for suspicious Windows scheduled tasks by correlating Sysmon and Windows Security logs. Examine parent processes, file paths, encoded commands, and remote task creation to uncover persistent access and movement between systems.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Investigating suspicious scheduled task creation
• Hunting for tasks that run encoded commands
• Detecting remote task creation across systems

Monitor requests to an AI prediction API for signs of model copying or training-data exposure. Test an authorized model with simulated attacks, measure the risk, and evaluate defenses such as request limits and reduced prediction detail.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Monitoring a public or partner prediction API
• Measuring model copying risk before deployment
• Testing request limits and reduced prediction detail

Investigate stolen Kerberos tickets, authentication credentials that can be reused without a password, by correlating Windows security events. Build Splunk or Elastic detection rules for cross-host reuse, weaker encryption, and unusual request volumes, and report risk-scored findings.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Investigating suspected reuse of stolen Kerberos tickets
• Building Splunk or Elastic detection rules
• Finding unusual ticket request volumes

Investigate phishing emails that hide malicious links in QR codes. Decode destinations, analyze suspicious URLs, configure email detection rules, and plan mobile protections and awareness training for people who scan codes on their phones.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Investigating suspicious emails containing QR codes
• Configuring QR detection for email images and PDF attachments
• Protecting phones from malicious QR destinations

Audit Secure Boot settings, revoked boot components, and EFI startup files on Linux and Windows. The skill helps identify missing protections and signs of bootkits, malicious software that runs before the operating system.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Auditing Secure Boot after a bootkit advisory
• Checking revocation updates across managed devices
• Investigating suspected bootkit infections

Assess serverless functions, primarily AWS Lambda, for unsafe execution of external input and unauthorized changes to code or added libraries. Combine source inspection, activity logs, and permission reviews to identify injection risks and recommend detection and prevention measures.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Reviewing Lambda event handlers for injection vulnerabilities
• Investigating unauthorized function or layer changes
• Checking privilege escalation through Lambda execution roles

Find undocumented API endpoints, the addresses applications send requests to, by comparing traffic with OpenAPI specifications and examining cloud settings and source code. Build an inventory with activity and risk details to review forgotten or outdated APIs.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Finding API endpoints missing from documentation
• Auditing forgotten test APIs and outdated versions
• Prioritizing undocumented APIs for security review

Analyze ModSecurity, AWS WAF, and Cloudflare logs for SQL injection, attempts to manipulate database queries through web requests. Groups related requests, tracks source IPs, classifies attack methods, and produces incident reports.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Investigating suspected SQL injection attempts
• Tracking repeated attacks from the same source
• Connecting requests across an attack campaign

Detect attacks that misuse legitimate Windows utilities such as certutil and mshta. Analyze process logs, command arguments, and parent-child relationships with Sigma detection rules, then report suspicious events with severity scores and supporting event details.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Investigating suspicious use of built-in Windows utilities
• Creating Sigma rules for unusual command arguments
• Finding Office apps that launch unexpected system utilities

Inspect npm packages and dependency files for malicious installation scripts, credential theft, and self-spreading behavior. Use GuardDog scanning, source inspection, known-malicious version checks, and isolated execution to produce an evidence-based assessment.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Vetting a new npm dependency before adoption
• Reviewing dependency files during code review
• Checking lockfiles against known-malicious versions

Audit Azure Storage settings for public containers, encryption, access permissions, network restrictions, and logging gaps. Use command-line checks and monitoring alerts to produce findings and remediation guidance across subscriptions.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Auditing storage settings across Azure subscriptions
• Investigating publicly accessible blob containers
• Verifying encryption, network, and logging controls

Investigate suspicious mobile apps by examining permissions, network traffic, and runtime behavior. Use observed evidence to identify signs of data theft, SMS interception, credential stealing, or communication with attacker control servers, then classify the suspected malware.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Triaging suspicious APK or IPA samples
• Investigating possible data leaks from mobile apps
• Checking for SMS interception and credential theft

Create rules for Suricata and Snort, systems that detect suspicious network traffic, to flag port scans and reconnaissance. Combine packet patterns with connection counts, tune alert volume, and summarize scanning sources, targets, and activity.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Create rules to detect Nmap and Masscan activity
• Monitor scanning within an internal network
• Tune alerts for authorized vulnerability scanners

Investigate NTLM relay, an attack that forwards authentication messages to another service, by comparing Windows login events with host inventories. Use the supplied queries and audits to identify suspicious sources, weaker authentication, and gaps in signing enforcement.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Investigating mismatched login source addresses and hostnames
• Building SIEM rules to detect NTLM relay
• Auditing SMB and LDAP signing requirements

Investigate attempts to gain higher privileges on Windows and Linux using endpoint and security logs. Guide hypothesis testing, evidence analysis, false-positive checks, and reporting to help assess suspicious privilege changes and the scope of a compromise.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Hunting for signs of privilege escalation
• Investigating alerts about suspicious privilege changes
• Assessing compromise scope during incident response

Investigate process hollowing, where malicious code replaces a legitimate process in memory. Compare memory with disk files, examine process relationships, and correlate network activity to document suspicious processes and guide containment.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Investigating process injection alerts from EDR
• Examining suspicious behavior in legitimate Windows processes
• Finding threats that run in memory

Investigate suspected rootkits, malware that hides its presence, by comparing process lists, inspecting memory, and checking system integrity. Use Volatility and Windows or Linux scanners to identify hidden processes, suspicious drivers, altered system calls, and concealed connections.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Investigating compromise when standard tools show no anomalies
• Comparing process lists to find hidden activity
• Examining suspicious drivers and concealed connections

Investigate suspicious PowerShell activity using endpoint monitoring data and security logs. Examine encoded commands, downloads, and attempts to evade inspection, then document evidence, affected systems, risk, and recommended response actions.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Hunting for suspicious PowerShell execution
• Investigating endpoint and security log alerts
• Assessing the scope of a PowerShell-related incident