测试与安全技能

Create a ransomware response playbook aligned with CISA guidance and NIST CSF, a cybersecurity framework. Organize preparation, detection, containment, recovery, and lessons learned into actionable checklists for readiness reviews and simulated incident exercises.

中文简介正在准备中。当前显示英语简介。

• Creating or updating a ransomware response playbook
• Assessing readiness against CISA guidance
• Validating response steps in a tabletop exercise

Support authorized Active Directory assessments of DCSync, which abuses directory replication rights to obtain credential data. Cover replication permission review, Golden Ticket persistence testing, detection validation, and documentation of evidence and remediation recommendations.

中文简介正在准备中。当前显示英语简介。

• Reviewing accounts with directory replication rights
• Testing DCSync risks in an authorized lab
• Validating detection of replication abuse and forged tickets

Build a central platform for collecting, analyzing, and sharing cyber threat information. Connect MISP, OpenCTI, TheHive, and Cortex to import feeds, add context to suspicious indicators, manage cases, and track platform activity.

中文简介正在准备中。当前显示英语简介。

• Build a central threat intelligence platform
• Automate threat feed ingestion
• Add context to suspicious IP addresses and domains

Assess an internal network from the position of an intruder or malicious insider. Covers discovering systems, testing paths to other machines and higher privileges, demonstrating sensitive data access, and documenting findings with remediation recommendations.

中文简介正在准备中。当前显示英语简介。

• Assessing damage possible after a workstation compromise
• Reviewing Active Directory paths to higher privileges
• Testing internal network security controls

Build incident response dashboards that bring affected systems, containment progress, indicators of compromise, and response timelines into one view. Help security teams coordinate active incidents and prepare operational reports and executive briefings.

中文简介正在准备中。当前显示英语简介。

• Coordinating an active security incident
• Tracking affected systems and containment
• Reviewing response timelines after an incident

Collect indicators of compromise, technical clues such as suspicious domains and file hashes, from incident evidence. Add context and confidence scores, then prepare them for detection, blocking, and structured sharing with partners.

中文简介正在准备中。当前显示英语简介。

• Extracting threat indicators from incident evidence
• Adding threat context and confidence scores to indicators
• Preparing indicator lists for detection and blocking

Set up MISP to collect threat feeds and centrally manage indicators such as suspicious IP addresses and domains. Configure automated synchronization, connect related findings, and export indicators to security monitoring platforms or blocklists.

中文简介正在准备中。当前显示英语简介。

• Centralizing threat indicators from multiple feeds
• Deploying MISP with Docker
• Automating threat feed synchronization

Design employee access management across multiple systems using HR records. This skill covers account changes when people join, move roles, or leave, along with role definitions, approval workflows, periodic access reviews, and cleanup of accounts left behind.

中文简介正在准备中。当前显示英语简介。

• Automating account changes for hires, transfers, and departures
• Finding accounts that remain after employees leave
• Reviewing overlapping roles and unnecessary permissions

Plan and conduct authorized security tests of AWS, Azure, and GCP environments. Check access permissions, credential exposure, cross-account access, and monitoring, then organize findings into a report with severity, business impact, and remediation guidance.

中文简介正在准备中。当前显示英语简介。

• Assessing cloud security before production deployment
• Checking access controls after a cloud migration
• Testing monitoring and incident response readiness

Reconstruct activity on a compromised computer by combining file timestamps, event logs, browser history, and other evidence into one timeline. Extract and filter events with Plaso, then review and annotate them collaboratively in Timesketch.

中文简介正在准备中。当前显示英语简介。

• Reconstructing the sequence of a computer compromise
• Comparing events across logs and file records
• Investigating timestamp changes and cleared logs

Set up MISP to collect, store, and correlate threat intelligence from multiple feeds. Use PyMISP to automate searches and imports of indicators of compromise, such as suspicious IP addresses and file hashes, and export data for security monitoring tools.

中文简介正在准备中。当前显示英语简介。

• Collecting threat indicators from multiple feeds
• Automating MISP imports and searches
• Exporting indicators for security monitoring tools

Guide response to suspected or confirmed malware infections across enterprise endpoints. Identify the malware and entry route, assess affected systems, coordinate containment and removal, and document recovery checks, infection timelines, and observable signs of compromise.

中文简介正在准备中。当前显示英语简介。

• Investigating malware alerts from endpoint security tools
• Assessing infection spread across multiple endpoints
• Planning containment, removal, and endpoint recovery

Collect evidence from a compromised computer before shutdown or remediation erases it. Preserve memory, network connections, processes, and system state, then record integrity hashes and handling history to support incident investigation and evidence tracking.

中文简介正在准备中。当前显示英语简介。

• Preserving evidence before shutting down a compromised computer
• Collecting memory evidence for suspected fileless malware
• Recording active connections and processes during an intrusion

Plan and run authorized security exercises that simulate an attacker's actions, from reconnaissance to activities after entry. Map techniques to MITRE ATT&CK, a framework of attack behaviors, and report detection gaps and response performance.

中文简介正在准备中。当前显示英语简介。

• Planning the scope and objectives of a red team exercise
• Designing scenarios based on a specific threat actor
• Measuring detection and response during an exercise

Analyze existing user permissions to propose roles for role-based access control, which assigns permissions by job role. Compare candidate role sets, identify overlap and excess access, and validate definitions against business responsibilities.

中文简介正在准备中。当前显示英语简介。

• Consolidating overlapping access roles
• Redesigning roles from existing permission data
• Reviewing excess and unusual permissions

Build a recurring vulnerability scanning process with Nessus, Qualys, or OpenVAS. Prioritize findings using asset importance and known exploitation, then organize remediation deadlines, monitoring dashboards, and automatic tickets for urgent issues.

中文简介正在准备中。当前显示英语简介。

• Establish recurring infrastructure vulnerability scans
• Prioritize fixes using asset importance and exploitation data
• Track remediation deadlines and overdue findings

Set up Microsoft Sentinel to collect security logs from AWS, Azure, and GCP. Build detection queries, investigate historical activity, and create automated response workflows for a centralized security operations team.

中文简介正在准备中。当前显示英语简介。

• Centralizing security monitoring across multiple clouds
• Migrating from an existing SIEM platform
• Automating responses to suspicious cloud activity

Build intermediary servers for authorized security exercises, separating public traffic from the command server used by the test team. It covers simple forwarding, request filtering with nginx or Apache, TLS certificates, and validation against the exercise’s traffic profile.

中文简介正在准备中。当前显示英语简介。

• Separating public infrastructure from an exercise command server
• Filtering exercise traffic against a defined profile
• Adding TLS certificates to a redirector

Build an OpenCTI pipeline that adds external context to indicators of compromise, such as suspicious IP addresses. Connect intelligence services, relate indicators to known attackers and campaigns, and score confidence to help analysts prioritize investigations.

中文简介正在准备中。当前显示英语简介。

• Deploying OpenCTI and configuring enrichment connectors
• Automatically adding context to suspicious IP addresses and domains
• Relating indicators to known attackers and campaigns

Assess REST, GraphQL, and gRPC APIs for authentication, access control, input validation, and business logic weaknesses. Use OWASP API Security Top 10, a framework of common API risks, to organize testing and document findings with reproduction steps and remediation.

中文简介正在准备中。当前显示英语简介。

• Comparing API access across user roles
• Checking token handling and request rate limits
• Assessing GraphQL access control and data exposure

Build a ransomware response playbook for security monitoring teams, covering detection, containment, eradication, and recovery. Include log queries, decision trees, evidence collection, backup restoration, and incident reviews to prepare consistent procedures before an attack occurs.

中文简介正在准备中。当前显示英语简介。

• Creating a standardized ransomware response playbook
• Documenting host isolation and recovery procedures
• Addressing coordination gaps found in tabletop exercises

Assess cybersecurity risks using NIST SP 800-30 Rev 1 by examining threats, weaknesses, likelihood, and business impact. Produce a ranked risk register, a structured record of risks and recommended responses, with a summary for leadership.

中文简介正在准备中。当前显示英语简介。

• Preparing documented risk analysis for compliance frameworks
• Assessing a new system before launch
• Reporting the highest risks to leadership

Respond to security incidents across AWS, Azure, and GCP by investigating audit logs, containing compromised identities, isolating resources, and preserving evidence. Organize recovery and follow-up security measures for credential leaks, unauthorized permission changes, and attacks spanning cloud services.

中文简介正在准备中。当前显示英语简介。

• Responding to leaked cloud credentials
• Investigating unauthorized permission or resource changes
• Preserving audit logs and disk snapshots

Investigate domains, IP addresses, and certificates linked to suspected attackers using public sources. This skill guides passive research and relationship mapping to support phishing investigations, external exposure reviews, and threat intelligence reports.

中文简介正在准备中。当前显示英语简介。

• Investigating infrastructure linked to a phishing campaign
• Adding public evidence to threat actor profiles
• Reviewing an organization's external exposure