'defense' 검색 결과

Detect DLL side-loading attacks where adversaries place malicious DLLs alongside legitimate applications to hijack execution flow for defense evasion.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Analyzes intrusion activity against the Lockheed Martin Cyber Kill Chain framework to identify which phases an adversary has completed, where defenses succeeded or failed, and what controls would have interrupted the attack at earlier phases. Use when conducting post-incident analysis, building prevention-focused security controls, or mapping detection gaps to kill chain phases. Activates for requests involving kill chain analysis, intrusion kill chain, attack phase mapping, or Lockheed Martin kill chain framework.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Review HTTP response headers and restrict browser features an application does not need, such as camera, microphone, and location access. Guide Permissions-Policy settings that limit what attackers could use if the site is compromised.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Review security headers before a release
• Disable unused camera and microphone features
• Check feature restrictions for third-party iframes

Plan security controls for LLM applications and AI agents, covering malicious instructions, data leakage, model tampering, and API access. Includes guidance and code examples for filtering outputs, enforcing permissions, isolating networks, and recording audit events.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Reviewing defenses against prompt injection in AI agents
• Filtering personal information from LLM responses
• Designing authentication and rate limits for LLM APIs

Break down major industrial trends into materials, components, and equipment to find listed suppliers at supply bottlenecks. Compare scarcity, financial performance, and valuation, then organize candidates into a ranked research board with supporting evidence and risks.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Find overlooked suppliers benefiting from AI infrastructure growth
• Compare supply constraints in energy transition supply chains
• Check valuations of companies at critical supply bottlenecks

Monitor requests to an AI prediction API for signs of model copying or training-data exposure. Test an authorized model with simulated attacks, measure the risk, and evaluate defenses such as request limits and reduced prediction detail.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Monitoring a public or partner prediction API
• Measuring model copying risk before deployment
• Testing request limits and reduced prediction detail

Investigate malicious code placed inside legitimate Windows processes using memory analysis, event logs, and API monitoring. Identify injection methods, examine extracted code, and produce evidence reports and detection rules for suspicious process behavior.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Investigating unexpected connections from legitimate processes
• Finding injected code in memory dumps
• Classifying process hollowing and other injection methods

Develop network monitoring for signs that may precede ransomware encryption. Uses detection rules, linked log events, and threat intelligence to identify suspicious activity and define how alerts should be investigated, prioritized, and escalated.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Creating detection rules for activity before ransomware encryption
• Linking suspicious logins, scans, and file share access
• Investigating unusual internal network communications

Investigate stolen OAuth tokens and their reuse in Microsoft Entra ID through sign-in log analysis. Follow response procedures for revoking sessions and reviewing app permissions, and configure device-bound token protection and session monitoring for Azure and M365 environments.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Investigating anomalous token usage alerts
• Responding to suspected session hijacking
• Finding token reuse in sign-in logs

Configure Fail2ban to detect port scans, repeated SSH login attempts, and suspicious web requests from server logs. Create custom detection patterns, automatically block source IP addresses, and set up notifications and longer bans for repeat offenders.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Automatically blocking port scans against public servers
• Defending SSH against repeated login attempts
• Detecting suspicious paths in Nginx access logs

Use Stratus Red Team to simulate attack techniques across AWS, Azure, GCP, and Kubernetes. Prepare test resources, run and repeat simulations, check logs and alerts, and remove resources to assess whether security detections work.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Checking whether cloud detection rules trigger
• Testing log ingestion and alert routing
• Running joint attack and defense exercises

Investigate attempts to gain higher privileges on Windows and Linux using endpoint and security logs. Guide hypothesis testing, evidence analysis, false-positive checks, and reporting to help assess suspicious privilege changes and the scope of a compromise.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Hunting for signs of privilege escalation
• Investigating alerts about suspicious privilege changes
• Assessing compromise scope during incident response

Investigate attacks that make legitimate Windows applications load malicious DLL files. This skill examines loading events, digital signatures, file hashes, and unusual locations, then checks process behavior to document suspicious cases and guide remediation.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Investigating alerts about unsigned DLL files
• Hunting for persistent threats using legitimate applications
• Checking suspicious DLL loading paths

Build a screening pipeline for web pages, PDFs, and images before an AI agent reads them. Extract hidden text, check for malicious instructions with detection models, and record decisions to block or allow content.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Screening external content before an agent reads it
• Checking uploaded PDFs and images for hidden instructions
• Scanning documents before adding them to a knowledge base

Examine Windows and Active Directory logs for attempts to extract passwords and other credentials. Identify suspicious memory access and database exports, correlate events with user and host context, and produce findings with severity ratings and detection queries.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Investigating alerts about suspicious LSASS access
• Finding signs of SAM or NTDS.dit extraction
• Creating detection queries for Splunk or Elastic

Screen AI application inputs and historical logs for prompt injection, where malicious instructions try to redirect the model. Combine pattern matching, text structure scoring, and a DeBERTa classifier to flag suspicious content and produce JSON results.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Screening chatbot and AI agent inputs
• Checking external text used in retrieval-based AI applications
• Auditing historical interaction logs for injection attempts

Deploy decoy files and monitor changes, renames, and deletions for early signs of ransomware. This skill guides Python monitoring, email, Slack, and syslog alerts, plus simulated file operations to verify that the detection and notification pipeline works.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Monitoring shared drives and NAS for suspicious file changes
• Adding decoy file monitoring alongside endpoint protection
• Testing incident response with decoy file triggers

Deploy decoy accounts, service entries, and policy objects in Active Directory to detect suspicious activity. Configure monitoring rules for Windows security events and validate alerts for credential misuse, reconnaissance, and movement between systems.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Detecting Kerberoasting with decoy service entries
• Monitoring attempts to use decoy credentials
• Placing credential traps in decoy Group Policy objects

Plan and run authorized security exercises that simulate an attacker's actions, from reconnaissance to activities after entry. Map techniques to MITRE ATT&CK, a framework of attack behaviors, and report detection gaps and response performance.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Planning the scope and objectives of a red team exercise
• Designing scenarios based on a specific threat actor
• Measuring detection and response during an exercise

Collect and organize victim postings from ransomware data leak sites through tracking feeds. Analyze group activity over time, compare sector and country patterns, and produce threat reports with risk assessments and defensive recommendations.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Track monthly activity across ransomware groups
• Assess ransomware exposure by sector or country
• Identify newly observed ransomware groups

Review security across web apps, APIs, mobile apps, Kubernetes, and AI agents using six OWASP references. Identify risky authentication, access controls, configurations, and prompt handling, then use examples and checklists to plan fixes.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Review login flows and access controls
• Check API authorization and data exposure
• Review mobile app storage and communications

Review Google Cloud workloads against the security principles of the Well-Architected Framework. Identify gaps in access control, network protection, data handling, and security operations, then receive prioritized recommendations linked to relevant Google Cloud products.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Reviewing security during Google Cloud architecture design
• Checking access permissions and network defenses
• Identifying gaps in data protection and security monitoring

Research U.S. legal questions using Westlaw materials, including cases, statutes, and administrative decisions. Receive a written report analyzing relevant legal authorities, with support for questions covering up to three jurisdictions.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Researching how courts have ruled on a legal issue
• Checking claim elements and available defenses
• Examining how statutes and regulations are applied

Set up a litigation practice profile through an interview tailored to your role and the side you represent. Record risk preferences, writing conventions, and working context in CLAUDE.md for later litigation tasks, and check available integrations.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Set up a litigation plugin for the first time
• Tailor practice settings to your role and litigation side
• Update risk preferences and document style