测试与安全技能

Find undocumented API endpoints, the addresses applications send requests to, by comparing traffic with OpenAPI specifications and examining cloud settings and source code. Build an inventory with activity and risk details to review forgotten or outdated APIs.

中文简介正在准备中。当前显示英语简介。

• Finding API endpoints missing from documentation
• Auditing forgotten test APIs and outdated versions
• Prioritizing undocumented APIs for security review

Configure email security gateways to detect targeted phishing messages. Set up sender impersonation protection, link checks, isolated attachment analysis, and custom rules, then validate quarantine actions and alerts for suspected attacks.

中文简介正在准备中。当前显示英语简介。

• Strengthening protection against targeted phishing
• Detecting executive or vendor impersonation
• Reviewing link and attachment protection

Investigate service account misuse by examining unexpected interactive logons, privilege changes, and movement between systems. Correlate endpoint and security logs, distinguish suspicious activity from legitimate operations, and document evidence, risk, and recommended responses.

中文简介正在准备中。当前显示英语简介。

• Investigating unexpected interactive logons by service accounts
• Checking service account access outside its assigned scope
• Tracing suspicious movement between systems after hours

Assess serverless functions, primarily AWS Lambda, for unsafe execution of external input and unauthorized changes to code or added libraries. Combine source inspection, activity logs, and permission reviews to identify injection risks and recommend detection and prevention measures.

中文简介正在准备中。当前显示英语简介。

• Reviewing Lambda event handlers for injection vulnerabilities
• Investigating unauthorized function or layer changes
• Checking privilege escalation through Lambda execution roles

Configure Fail2ban to detect port scans, repeated SSH login attempts, and suspicious web requests from server logs. Create custom detection patterns, automatically block source IP addresses, and set up notifications and longer bans for repeat offenders.

中文简介正在准备中。当前显示英语简介。

• Automatically blocking port scans against public servers
• Defending SSH against repeated login attempts
• Detecting suspicious paths in Nginx access logs

Investigate process hollowing, where malicious code replaces a legitimate process in memory. Compare memory with disk files, examine process relationships, and correlate network activity to document suspicious processes and guide containment.

中文简介正在准备中。当前显示英语简介。

• Investigating process injection alerts from EDR
• Examining suspicious behavior in legitimate Windows processes
• Finding threats that run in memory

Develop network monitoring for signs that may precede ransomware encryption. Uses detection rules, linked log events, and threat intelligence to identify suspicious activity and define how alerts should be investigated, prioritized, and escalated.

中文简介正在准备中。当前显示英语简介。

• Creating detection rules for activity before ransomware encryption
• Linking suspicious logins, scans, and file share access
• Investigating unusual internal network communications

Build real-time detection for ransomware encryption by combining changes in data randomness with file modification rates, renames, and process activity. Define behavioral scores and response thresholds, then check detection accuracy and monitoring overhead.

中文简介正在准备中。当前显示英语简介。

• Building ransomware monitoring for endpoints and file servers
• Tuning detection thresholds to reduce false positives
• Investigating processes suspected of encrypting files

Investigate signs of Mimikatz credential theft using command lines, access to Windows authentication memory, file indicators, and known modules in memory. Correlate endpoint and security logs to assess suspicious alerts, document evidence, and recommend response actions.

中文简介正在准备中。当前显示英语简介。

• Investigating alerts about Windows authentication memory access
• Hunting for signs of credential theft
• Assessing compromise scope during incident response

Analyze AWS CloudTrail logs against normal activity patterns to spot unusual API calls, IP addresses, errors, and sensitive changes. Produce a JSON report with anomaly scores, suspicious users, and suggested investigation steps.

中文简介正在准备中。当前显示英语简介。

• Investigating possible misuse of AWS credentials
• Finding first-time API calls and unusual IP activity
• Reviewing IAM, KMS, and S3 policy changes

Scan code, configuration files, and Git history for exposed AWS credentials with TruffleHog. Checks whether detected keys remain active and guides key replacement, incident investigation, and automated checks before commits and during CI/CD.

中文简介正在准备中。当前显示英语简介。

• Auditing Git history for exposed AWS keys
• Adding credential checks before commits and in CI/CD
• Investigating credential exposure after a GuardDuty alert

Investigate misuse of application identities in Microsoft Entra ID using audit and sign-in logs. Provides detection queries and investigation steps for suspicious credential additions, privileged role assignments, consent grants, and service principal enumeration.

中文简介正在准备中。当前显示英语简介。

• Investigating suspicious additions of application credentials
• Reviewing privileged roles assigned to application identities
• Building detection rules for Entra ID identity abuse

Set up AI email screening that compares writing style and communication habits to identify impersonation and suspicious payment requests. Connect detection policies to quarantine, warning banners, and analyst review workflows.

中文简介正在准备中。当前显示英语简介。

• Detecting executive impersonation in emails
• Reviewing vendor payment change requests
• Flagging unusual employee email behavior

Detect unauthorized cryptocurrency mining in cloud workloads by combining billing changes, CPU usage, mining pool connections, and process alerts. Follow workflows to preserve evidence, isolate affected resources, and trace how attackers gained access.

中文简介正在准备中。当前显示英语简介。

• Investigating sudden cloud billing increases
• Responding to GuardDuty cryptocurrency alerts
• Checking containers for unauthorized mining processes

Check training data and machine learning models for malicious changes, including backdoors that cause unexpected behavior on specific inputs. Combine data quality checks, model analysis, and file integrity verification, then document findings and retest after remediation.

中文简介正在准备中。当前显示英语简介。

• Screening third-party data before training
• Checking downloaded model weights before deployment
• Investigating unexpected behavior on specific inputs

Investigate suspected email account takeovers by examining audit logs, sign-ins, inbox rules, and app permissions. Identify suspicious forwarding, unlikely travel between sign-ins, and unusual access, then summarize findings and recommended containment actions in a severity-rated report.

中文简介正在准备中。当前显示英语简介。

• Investigating suspected business email compromise
• Checking for suspicious external forwarding rules
• Reviewing unusual sign-ins and app permissions

Build automated responses to AWS GuardDuty security findings using EventBridge and Lambda. Configure severity filters, isolate EC2 instances, disable compromised access keys, preserve disk snapshots for investigation, and send notifications to security teams.

中文简介正在准备中。当前显示英语简介。

• Triggering responses to high-severity GuardDuty findings
• Isolating EC2 instances and preserving investigation data
• Disabling compromised IAM access keys

Investigate attacks that make legitimate Windows applications load malicious DLL files. This skill examines loading events, digital signatures, file hashes, and unusual locations, then checks process behavior to document suspicious cases and guide remediation.

中文简介正在准备中。当前显示英语简介。

• Investigating alerts about unsigned DLL files
• Hunting for persistent threats using legitimate applications
• Checking suspicious DLL loading paths

Investigate lateral movement, where attackers expand access across Azure identities and tenants. Correlate audit logs and unusual sign-ins, build Microsoft Sentinel detection queries, and report affected identities with recommended containment actions.

中文简介正在准备中。当前显示英语简介。

• Investigating suspicious Azure sign-ins
• Building Microsoft Sentinel detection rules
• Reviewing suspicious OAuth app consent

Investigate attackers moving between internal systems by correlating login records with network traffic. Supports detection rules, suspicious SMB and RDP activity analysis, and reports showing attack timelines, affected hosts, and monitoring gaps.

中文简介正在准备中。当前显示英语简介。

• Investigating attacker movement across internal systems
• Creating rules for suspicious authentication patterns
• Tracing affected hosts after a PsExec alert

Hunt for lateral movement, where attackers move between networked systems, using Splunk searches. Connect Windows logins with process and network activity to identify unusual host relationships, trace movement paths, and document affected accounts and systems.

中文简介正在准备中。当前显示英语简介。

• Tracing activity after credential theft
• Investigating unusual logins between hosts
• Finding new or unexpected host connections

Identify runtime signs of attackers breaking out of Docker or Kubernetes containers. Review namespace changes, privilege abuse, sensitive host access, and unusual system calls to guide incident investigations and compare monitoring coverage across security tools.

中文简介正在准备中。当前显示英语简介。

• Investigating a suspected Docker or Kubernetes container escape
• Choosing runtime behaviors to monitor for escape attempts
• Comparing escape detection coverage across security sensors

Investigate suspicious email forwarding and hidden inbox rules that may expose messages after an account compromise. The skill guides log analysis, validation, and reporting, helping analysts document evidence, assess risk, and recommend response actions.

中文简介正在准备中。当前显示英语简介。

• Investigating external forwarding after an account compromise
• Checking rules that delete security alerts
• Hunting for rules that forward executive emails

Examine recorded calls and voicemails for signs of AI-generated speech. Extract acoustic features, classify samples with machine learning, and prepare reports with confidence scores and sound visualizations to support voice impersonation investigations.

中文简介正在准备中。当前显示英语简介。

• Investigating calls impersonating executives
• Checking suspicious voicemails
• Comparing suspect recordings with genuine voice samples