'cybersecurity' 검색 결과

Knowledge base from NIST Cybersecurity Framework (CSF) 2.0. Use for cybersecurity risk management, GOVERN, IDENTIFY, PROTECT, DETECT, RESPOND, RECOVER, Organizational Profiles, CSF Tiers, supply chain risk, enterprise risk management, incident response. Covers the CSF 2.0 document only; does not cover specific SP 800-53 controls, NIST RMF system authorization steps, or sector-specific regulations.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Synthesized reference notes from three US Government vehicle-safety sources: NHTSA Cybersecurity Best Practices for the Safety of Modern Vehicles (updated 2022, final), NHTSA Automated Driving Systems 2.0: A Vision for Safety (2017), and a 16-section selection of 49 CFR Part 571 (FMVSS) pinned at eCFR versioner date 2025-01-01. Use for voluntary vehicle cybersecurity practices, the ADS 2.0 twelve priority safety design elements, and FMVSS occupant protection, brakes/stability/lighting, and fuel/EV integrity requirements. Not ISO 26262, not ASPICE, not ISO/SAE 21434, not UNECE R155/R156, not SAE J3016, and not the full Part 571; the FMVSS material is a selection of vehicle-level minimum performance standards, not a process standard.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Knowledge base from the DoD Manufacturing Readiness Level (MRL) Deskbook (Version 2022, OSD ManTech / Joint Service–Industry MRL Working Group). Use for assessing and managing manufacturing maturity and producibility risk in defense acquisition: the 10-level MRL scale and its non-linear, target-not-grade nature; the five demonstration environments (laboratory → production-relevant → production-representative → pilot line → production line); the nine manufacturing-risk threads and sub-threads; how MRL targets map onto Adaptive Acquisition Framework milestones (MRL 4/6/7/8/9); conducting an MRL Assessment; building a Manufacturing Maturation Plan; putting MRL maturity into contract language (Section L/M, SOW, AS6500A, DIDs); tailoring criteria for S&T, single-system, ship, sustainment, and industry contexts; and screening operational-technology cybersecurity. Manufacturing-readiness focused — it measures producibility risk and frames mitigation; it is NOT a technology-readiness (TRL) guide, a full systems-engineering process model, a cost-estimating or schedule guide, or a deep cybersecurity audit method (see sibling packs for those).

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

CVE vulnerability lookup via NIST NVD, CISA KEV, EPSS scores, and MITRE ATT&CK. 7 tools for real-time cybersecurity intelligence.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

FETIH Siber Güvenlik Ana Orkestratörü — 912+ skill ile tüm siber güvenlik alanlarını kapsar. Tehdit avı, zararlı yazılım analizi, dijital adli bilişim, olay müdahalesi, bulut güvenliği, ağ güvenliği, web uygulama güvenliği, API güvenliği, sızma testi, red team, SOC operasyonları, OT/ICS güvenliği ve daha 25+ alt kategori. ljagiello/ctf-skills ve Eyadkelleh/awesome-claude-skills-security entegre edildi.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Complete cybersecurity assessment, threat modeling, and hardening system. Use when conducting security audits, threat modeling, penetration testing, incident response, or building security programs from scratch. Works with any stack — zero external dependencies.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Find WMI event subscriptions that let attackers retain access to Windows systems. Correlate Sysmon events with stored subscriptions and Autoruns results, inspect execution triggers and commands, and document risks and recommended remediation.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Triaging Sysmon alerts for events 19, 20, and 21
• Finding WMI persistence during incident response
• Distinguishing suspicious subscriptions from legitimate settings

Investigate stolen Kerberos tickets, authentication credentials that can be reused without a password, by correlating Windows security events. Build Splunk or Elastic detection rules for cross-host reuse, weaker encryption, and unusual request volumes, and report risk-scored findings.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Investigating suspected reuse of stolen Kerberos tickets
• Building Splunk or Elastic detection rules
• Finding unusual ticket request volumes

Detect attacks that misuse legitimate Windows utilities such as certutil and mshta. Analyze process logs, command arguments, and parent-child relationships with Sigma detection rules, then report suspicious events with severity scores and supporting event details.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Investigating suspicious use of built-in Windows utilities
• Creating Sigma rules for unusual command arguments
• Finding Office apps that launch unexpected system utilities

Use CloudFox to inspect AWS and Azure resources through read-only queries. Identify exposed endpoints, secrets, permissions, and role trust relationships, then organize findings into files for reviewing configuration weaknesses and potential paths to broader access.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Inventorying an unfamiliar AWS or Azure account
• Finding internet-facing resources
• Mapping role trust relationships and permissions

Build real-time detection for ransomware encryption by combining changes in data randomness with file modification rates, renames, and process activity. Define behavioral scores and response thresholds, then check detection accuracy and monitoring overhead.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Building ransomware monitoring for endpoints and file servers
• Tuning detection thresholds to reduce false positives
• Investigating processes suspected of encrypting files

Assess whether a container can escape its isolation and reach the host during an authorized security test. Review privileges, shared mounts, Docker socket exposure, and runC vulnerabilities, then document demonstrated impact and remediation.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Testing container escape within an approved scope
• Assessing the impact of privileged or hostPath workloads
• Validating controls that block container escape

Investigate suspicious PowerShell activity using endpoint monitoring data and security logs. Examine encoded commands, downloads, and attempts to evade inspection, then document evidence, affected systems, risk, and recommended response actions.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Hunting for suspicious PowerShell execution
• Investigating endpoint and security log alerts
• Assessing the scope of a PowerShell-related incident

Investigate Windows credential theft by correlating endpoint monitoring data, Sysmon events, and security logs. The skill provides detection queries and a reporting format to identify suspicious access and assess which credentials may be compromised.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Investigating alerts about suspicious LSASS access
• Hunting for credential theft across Windows systems
• Assessing the scope of potentially compromised credentials

Set up Zeek to observe network traffic and produce structured logs for security analysis. Create custom detection scripts, investigate suspicious DNS activity and repeated external connections, and forward logs to a central security monitoring system.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Set up passive monitoring at key network points
• Create detection scripts for suspicious DNS and repeated connections
• Forward Zeek logs to a central security monitoring system

Use Stratus Red Team to simulate attack techniques across AWS, Azure, GCP, and Kubernetes. Prepare test resources, run and repeat simulations, check logs and alerts, and remove resources to assess whether security detections work.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Checking whether cloud detection rules trigger
• Testing log ingestion and alert routing
• Running joint attack and defense exercises

Review application permissions and consent audit logs in Microsoft Entra ID using Microsoft Graph API. Identify overly broad access, unverified publishers, and suspicious consent patterns, then produce a JSON risk report with remediation recommendations.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Investigating suspicious application consent
• Reviewing apps with broad mail or file access
• Tracing consent events through audit logs

Audit Secure Boot settings, revoked boot components, and EFI startup files on Linux and Windows. The skill helps identify missing protections and signs of bootkits, malicious software that runs before the operating system.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Auditing Secure Boot after a bootkit advisory
• Checking revocation updates across managed devices
• Investigating suspected bootkit infections

Configure Fail2ban to detect port scans, repeated SSH login attempts, and suspicious web requests from server logs. Create custom detection patterns, automatically block source IP addresses, and set up notifications and longer bans for repeat offenders.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Automatically blocking port scans against public servers
• Defending SSH against repeated login attempts
• Detecting suspicious paths in Nginx access logs

Monitor Modbus traffic in industrial control networks to identify unauthorized writes, unusual commands, and departures from normal communication. Use packet analysis and intrusion detection rules to investigate suspected controller changes and produce reports with recommended actions.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Investigating unauthorized changes to PLC registers
• Setting up Modbus intrusion detection rules
• Checking communication patterns after a suspected compromise

Analyze Windows authentication logs for repeated password guesses against Remote Desktop services. Group failures by source IP and account, check for later successful logins, and produce a JSON report highlighting attack patterns and possible compromise.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Investigate repeated login failures on exposed RDP services
• Identify accounts targeted by password guessing
• Check for successful logins after repeated failures

Develop network monitoring for signs that may precede ransomware encryption. Uses detection rules, linked log events, and threat intelligence to identify suspicious activity and define how alerts should be investigated, prioritized, and escalated.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Creating detection rules for activity before ransomware encryption
• Linking suspicious logins, scans, and file share access
• Investigating unusual internal network communications

Investigate process hollowing, where malicious code replaces a legitimate process in memory. Compare memory with disk files, examine process relationships, and correlate network activity to document suspicious processes and guide containment.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Investigating process injection alerts from EDR
• Examining suspicious behavior in legitimate Windows processes
• Finding threats that run in memory

Analyze Modbus industrial network traffic to identify unauthorized commands, write operations, and unusual polling intervals. Compare activity with normal traffic patterns and allowed operations, then report anomalies by type and severity.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Investigating suspicious Modbus traffic
• Establishing normal polling patterns
• Defining allowed Modbus function codes