'evasion' 검색 결과

Detect DLL side-loading attacks where adversaries place malicious DLLs alongside legitimate applications to hijack execution flow for defense evasion.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Detect DLL side-loading attacks where adversaries place malicious DLLs alongside legitimate applications to hijack execution flow for defense evasion.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

You are helping a penetration tester bypass AV/EDR that is blocking payload

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Anti-forensics and evidence destruction techniques for red team operators conducting authorized engagements. Covers log clearing on Windows (wevtutil, Clear-EventLog, ETW provider patching) and Linux (journal truncation, utmp/wtmp binary editing, syslog manipulation), timestamp manipulation via Timestomp and SetMACE to defeat timeline analysis, filesystem-level anti-forensics including NTFS Alternate Data Streams for payload hiding and secure deletion with sdelete/shred, memory artifact removal to counter live forensics, disk artifact manipulation targeting MFT entries and USN journal records, network forensics evasion through encrypted C2 channels and DNS-over-HTTPS tunneling, and anti-VM/sandbox detection to avoid dynamic analysis environments. Tools: Timestomp, wevtutil, sdelete, shred, MimiPenguin, Invoke-Phant0m. Aligns to MITRE ATT&CK T1070 (Indicator Removal), T1027 (Obfuscated Files or Information), T1497 (Virtualization/Sandbox Evasion). Each technique includes the forensic artifact it targets, t...

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Analyze how EDR, software that monitors endpoint threats, and antivirus products detect activity. Support authorized exercises by examining monitoring mechanisms, assessing evasion approaches, and checking detection results in an isolated test environment.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Assessing EDR detection coverage in authorized exercises
• Examining internal monitoring mechanisms
• Testing an in-house implant against security products

Identify software protections that hinder inspection, such as debugger detection and obfuscation that makes code harder to understand. Support authorized binary analysis and CTF security challenges with protection findings, bypass strategies, reports, and analysis scripts.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Identify protections in an authorized malware sample
• Plan analysis of a packed executable
• Implement debugger detection for a CTF challenge

Investigate suspicious PowerShell activity using endpoint monitoring data and security logs. Examine encoded commands, downloads, and attempts to evade inspection, then document evidence, affected systems, risk, and recommended response actions.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Hunting for suspicious PowerShell execution
• Investigating endpoint and security log alerts
• Assessing the scope of a PowerShell-related incident

Investigate malicious code placed inside legitimate Windows processes using memory analysis, event logs, and API monitoring. Identify injection methods, examine extracted code, and produce evidence reports and detection rules for suspicious process behavior.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Investigating unexpected connections from legitimate processes
• Finding injected code in memory dumps
• Classifying process hollowing and other injection methods

Investigate attacks that make legitimate Windows applications load malicious DLL files. This skill examines loading events, digital signatures, file hashes, and unusual locations, then checks process behavior to document suspicious cases and guide remediation.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Investigating alerts about unsigned DLL files
• Hunting for persistent threats using legitimate applications
• Checking suspicious DLL loading paths

Examine Windows and Active Directory logs for attempts to extract passwords and other credentials. Identify suspicious memory access and database exports, correlate events with user and host context, and produce findings with severity ratings and detection queries.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Investigating alerts about suspicious LSASS access
• Finding signs of SAM or NTDS.dit extraction
• Creating detection queries for Splunk or Elastic

Review articles, emails, documentation, and other reader-facing prose for invisible characters and formulaic writing. When measured signals are high, revise the wording while preserving facts, the writer’s voice, code, citations, and required disclosures.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Final checks on articles and manuscripts
• Polishing emails and product copy
• Reviewing prose in Markdown and HTML

Assess AWS, Azure, and GCP environments by identifying identities, permissions, and paths to broader access or data exposure. Covers cloud storage, secrets, cross-account trust, and CI/CD, the automated systems used to build and deploy software.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Planning an AWS, Azure, or GCP security assessment
• Tracing privilege escalation from current permissions
• Reviewing CI/CD credentials and OIDC trust settings

Organize red team exercises that simulate adversaries to assess an organization's detection and response. Covers engagement rules, infrastructure, operational controls, evidence handling, and reports that help security teams review gaps and prioritize improvements.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Defining red team objectives and engagement rules
• Designing an exercise that assumes an existing breach
• Organizing evidence and activity logs

Test application business rules by mapping workflows and checking unexpected actions, inputs, identities, and repetition. The skill helps investigate checkout, refunds, subscriptions, permissions, and concurrency flaws, then document reproduction steps and financial impact.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Checking checkout and refund workflows
• Testing price, quantity, and coupon rules
• Reviewing role and tenant boundaries

Assess server-side template injection, where user input is interpreted as template code. Identify template engines, evaluate information exposure and code execution risks, and organize evidence alongside detection and prevention measures.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Assessing template rendering endpoints
• Identifying the template engine in use
• Evaluating information exposure and code execution risks

Review lateral movement, the ways access spreads between systems, during authorized security tests. Covers credential reuse, remote execution, network tunnels, prerequisites, and the logs or defensive controls associated with each technique.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Compare lateral movement methods for an internal penetration test
• Plan tunnels across segmented networks
• Review detection logs and controls for lateral movement

Organize authorized phishing exercises from sending infrastructure and email scenarios to landing pages and reporting. Uses GoPhish campaign tracking to review opens, clicks, and submissions while assessing employee awareness and email security controls.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Planning an authorized phishing exercise
• Preparing sending infrastructure and landing pages
• Reviewing email, QR code, and callback scenarios

Assess how Wi-Fi clients respond to impersonated access points using Evil Twin, KARMA, and Mana methods. Covers portal-based credential exposure, traffic interception conditions, client behavior, and limits imposed by modern protections.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Assessing client connections to rogue Wi-Fi
• Planning captive portal security exercises
• Reviewing conditions for traffic interception

Assess WPS, a router feature for easy Wi-Fi setup, for weaknesses in PIN authentication. The skill covers device discovery, offline and online testing, lockout behavior, and how a recovered PIN can expose the network password.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Assessing WPS exposure on home and small-office routers
• Comparing offline and online PIN testing methods
• Reviewing PIN lockouts and push-button pairing behavior

Assess Active Directory security by mapping accounts, permissions, and paths to administrative access. The skill covers credential misuse, certificate service misconfigurations, movement between systems, and hybrid identity environments involving Entra ID.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Mapping paths to administrative access in Active Directory
• Reviewing ADCS certificate service configurations
• Assessing permissions, delegation, and group policies

Provides malware analysis and network traffic techniques for CTF challenges. Use when analyzing obfuscated scripts, malicious packages, custom crypto protocols, C2 traffic, PE/.NET binaries, RC4/AES encrypted communications, YARA rules, shellcode analysis, memory forensics for malware (Volatility malfind, process injection detection), anti-analysis techniques (VM/sandbox detection, timing evasion, API hashing, process injection, environment checks), or extracting malware configurations and indicators of compromise.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Network protocol attack playbook. Use when exploiting layer 2/3 protocols including ARP spoofing, LLMNR/NBT-NS/mDNS poisoning, WPAD abuse, DHCPv6 attacks, VLAN hopping, STP manipulation, DNS spoofing, IPv6 attacks, and IDS/IPS evasion.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

WAF bypass methodology and generic evasion techniques. Use when a web application firewall blocks injection payloads (SQLi, XSS, RCE) and you need to craft bypasses using encoding, protocol-level tricks, or WAF-specific weaknesses.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Draft, audit, or minimally revise English- or Chinese-language academic prose to reduce formulaic, vacuous, mechanically repetitive, or process-leaking language while preserving claims, evidence strength, logical relations, manuscript-wide terminology identity, document-level pattern variation, and scholarly register. Use for papers, abstracts, grants, cover letters, and reviewer responses when the user asks to de-AI, humanize, audit AI-like phrasing, or rewrite text without changing meaning. English is primary; Chinese is supported. Not for detector evasion, policy circumvention, pure translation, non-academic copy, or adding facts, citations, examples, or author experiences that the source does not contain.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.