'cybersecurity' 검색 결과

Investigate forged Kerberos authentication tickets in Active Directory by checking Windows logs for unusual encryption, excessive ticket lifetimes, and missing authentication requests. Produce a JSON report of suspicious indicators with risk ratings.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Investigating suspected forged authentication tickets
• Checking for possible krbtgt credential theft
• Building detection rules from authentication logs

Check industrial process data servers for unauthorized clients and suspicious data patterns using a Python detector. Provides alerts for missing or constant values and investigation checks for attackers moving between IT and operational technology networks.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Checking industrial historian servers for unauthorized clients
• Investigating missing or suspiciously constant process data
• Reviewing signs of movement between IT and OT networks

Analyze endpoint, cloud storage, and email logs for signs of insider data theft. Use pandas to compare upload volumes with normal user behavior and examine data loss prevention alerts, unusual file access, and activity outside working hours.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Investigating suspected insider data theft
• Finding users with unusually large uploads
• Reviewing file access outside working hours

Analyze Zeek network logs to find lateral movement, when an intruder spreads between internal computers. Examine administrative file sharing, authentication across multiple hosts, and remote service operations to identify suspicious connections and reconstruct incident timelines.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Tracing spread to other computers after an initial compromise
• Investigating unauthorized transfers to administrative shares
• Finding one account authenticating to many internal hosts

Deploy and operate Falco to monitor running containers in Kubernetes or Docker. Choose a driver, validate detection rules, confirm alerts for suspicious activity, and forward those alerts to a central security monitoring system.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Installing Falco on a Kubernetes cluster
• Choosing a driver for the Linux environment
• Checking alerts for suspicious container activity

Identify runtime signs of attackers breaking out of Docker or Kubernetes containers. Review namespace changes, privilege abuse, sensitive host access, and unusual system calls to guide incident investigations and compare monitoring coverage across security tools.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Investigating a suspected Docker or Kubernetes container escape
• Choosing runtime behaviors to monitor for escape attempts
• Comparing escape detection coverage across security sensors

Build detections for fileless attacks on Windows using process activity, script logs, and endpoint monitoring. Investigate suspicious PowerShell, code injected into running processes, WMI persistence, and registry-based execution with logging guidance and detection query examples.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Building detections for suspicious PowerShell activity
• Hunting for code injection into running processes
• Monitoring WMI persistence and registry-based execution

Analyze Zeek DNS logs for possible data theft hidden in domain queries. The skill examines unusual character patterns, long labels, distinct subdomains, and query volume, then ranks suspicious domains and produces a JSON evidence report.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Investigating suspected DNS tunneling
• Finding possible data leaks hidden in DNS queries
• Ranking suspicious domains and identifying source IPs

Examine Windows endpoint logs for attempts to avoid security detection, including log clearing, altered file timestamps, injected code, and disabled protection. Correlate events to investigate suspicious behavior and develop detection rules with context for legitimate activity.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Investigating cleared logs and altered file timestamps
• Checking suspected attempts to disable security tools
• Finding abuse of legitimate Windows utilities

Monitor local network traffic for ARP spoofing, where false address mappings can redirect traffic. Use ARPWatch, Wireshark, switch inspection settings, and Python monitoring to flag address changes, duplicate IP claims, gateway impersonation, and unusual ARP volumes.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Investigating suspected interception on a local network
• Monitoring changes in IP-to-MAC address mappings
• Checking duplicate IP claims and gateway impersonation

Connect security incidents across organizations by comparing attack indicators, techniques, and timelines. Build relationship graphs and campaign reports that document shared evidence, attribution confidence, and indicators useful for detection.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Linking incidents that share attack indicators
• Analyzing attacks across partner organizations
• Preparing reports on sustained attack campaigns

Set up repeatable security tests for LLM apps with Promptfoo and DeepTeam. Connect them to automated build pipelines, detect renewed vulnerabilities to malicious instructions or data leakage, and compare results across model or prompt changes.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Running automated attack tests on every code change
• Blocking merges when security tests fail
• Comparing security across model or prompt versions

Design and configure VLANs, logical network partitions, to separate employee devices, servers, guests, and IoT equipment. Covers traffic restrictions between zones, switch security settings, and tests to verify that the intended isolation works.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Separating guest WiFi and IoT devices from internal systems
• Planning network isolation for payment processing systems
• Restricting communication between network zones

Analyze malicious JavaScript from phishing pages, payment data theft scripts, and malware downloaders. Unwrap encoded strings and nested execution layers to reveal hidden behavior, identify stolen data fields, and document suspicious destinations for incident response.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Analyzing obfuscated scripts on phishing pages
• Investigating payment data theft on checkout pages
• Examining JavaScript that downloads further malware

Set up decoy credentials, storage, and secrets across AWS, Azure, and GCP to detect suspicious access. Connect audit logs to security alerts, verify detection, and document permissions, resource inventories, and maintenance plans.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Detecting use of leaked cloud credentials
• Monitoring suspicious access to decoy storage and secrets
• Extending on-premises deception coverage to cloud environments

Simulate man-in-the-middle attacks, where traffic is intercepted between communicating systems, in authorized environments. Use Bettercap, Ettercap, and mitmproxy to test encryption enforcement, certificate validation, and network detection, then document findings and recommendations.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Testing HTTPS enforcement and certificate validation
• Checking detection of network spoofing
• Demonstrating the risks of unencrypted traffic

Assess whether stolen Kerberos tickets, credentials used for network authentication, can enable access to other systems during authorized testing. Guide ticket extraction and reuse, review detection indicators, and document evidence for security reports.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Authorized testing of access through reused tickets
• Checking detection of Kerberos ticket theft
• Collecting evidence for lateral movement reports

Set up decoy files on endpoints and shared folders to detect possible ransomware activity. Monitor modifications, deletions, and renaming with file monitoring tools, connect events to alerts, and test whether the detection and response process works.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Adding ransomware warning files to shared folders
• Supplementing endpoint protection with decoy file monitoring
• Testing alerts triggered by decoy file changes

Deploy osquery on Windows, macOS, and Linux to inspect processes, listening ports, software, and system settings using SQL, a database query language. Configure scheduled checks and centralized management to support threat hunting and compliance monitoring.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Deploying osquery across Windows, macOS, and Linux
• Investigating suspicious processes and network connections with SQL
• Periodically checking software inventories and system settings

Deploy CrowdStrike Falcon sensors across Windows, macOS, and Linux endpoints. Configure threat prevention and response policies, verify installation and detection, troubleshoot sensor issues, and connect events to SIEM platforms, which collect security logs for analysis.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Deploying Falcon sensors across enterprise endpoints
• Configuring prevention and response policies by endpoint group
• Checking sensor connectivity and test detections

Contain an active security breach by isolating endpoints, blocking attacker communications, and revoking compromised access. Follow procedures to limit spread between systems, preserve evidence, verify containment, and report remaining risks and business impact.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Contain ransomware spreading between servers
• Revoke access through compromised accounts
• Isolate hosts communicating with attacker infrastructure

Configure TLS 1.3, a protocol for encrypted connections, on nginx, Apache, and Python applications. Select encryption settings and key exchange groups, disable outdated protocols, and use openssl s_client and testssl.sh to check connections and configuration weaknesses.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Enabling TLS 1.3 on nginx or Apache
• Configuring encrypted connections in a Python application
• Disabling outdated TLS versions and weak encryption

Plan authorized spearphishing simulations, personalized phishing tests aimed at specific people. Prepare scenarios and email infrastructure, track delivery and participant responses, and document findings to assess email security controls and improve security awareness.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Designing authorized phishing simulations for specific personnel
• Preparing test email delivery infrastructure
• Measuring delivery, opens, clicks, and reporting behavior

Set up Cloudflare Access and Tunnel to protect internal applications using user identity and device health checks. Covers application access policies, WARP device enrollment, and audit logging for teams replacing VPN access.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Replace VPN access with application-specific permissions
• Expose internal apps without opening inbound ports
• Limit contractors to approved applications