测试与安全技能

Analyze how ransomware encrypts files and manages keys to assess whether decryption is feasible. Examine implementation weaknesses, check existing decryptors, and document recovery options with technical reasons for the assessment.

中文简介正在准备中。当前显示英语简介。

• Assessing whether ransomware-encrypted files can be decrypted
• Examining encryption routines and key management
• Investigating key recovery from memory dumps

Search public TLS certificate records through crt.sh and pycrtsh to investigate lookalike domains, unexpected certificate issuers, and untracked IT assets. Compare domain spellings and review certificate details to support phishing detection and certificate monitoring.

中文简介正在准备中。当前显示英语简介。

• Finding domains that imitate a brand
• Reviewing unexpected certificate issuers
• Investigating untracked domains and IT assets

Inspect Linux scheduled tasks, services, shell profiles, shared library settings, and SSH keys for mechanisms that maintain attacker access. Correlate findings with audit logs to produce a timeline, risk scores, and remediation commands.

中文简介正在准备中。当前显示英语简介。

• Investigating how attackers maintained access to a Linux host
• Hunting for suspicious scheduled tasks and services
• Building a timeline from persistence-related audit events

Analyze threat intelligence stored in MISP, a platform for sharing security threat data. Summarize event counts, indicator types, attacker groups, and trends over time to create a threat landscape report for a chosen period.

中文简介正在准备中。当前显示英语简介。

• Create a threat landscape report for the past 90 days
• Summarize attacker activity and frequently tagged attack techniques
• Track changes in submitted threat indicator types and volumes

Analyze Windows Prefetch files, which record application execution data, using Python. Reconstruct execution timelines, review run counts and accessed resources, and identify suspicious programs or signs that an executable has been renamed to disguise its identity.

中文简介正在准备中。当前显示英语简介。

• Reconstructing a program execution timeline
• Investigating potentially renamed executables
• Reviewing suspicious tools and execution frequency

Investigate malicious software delivered through trusted updates or dependencies. Compare suspect files with legitimate versions, examine signing anomalies and injected code, and organize evidence to assess the infection path and downstream impact.

中文简介正在准备中。当前显示英语简介。

• Comparing suspicious updates with legitimate versions
• Investigating software signatures and injected code
• Tracing infection through build artifacts

Reconstruct USB device usage on Windows by comparing registry records, Event Logs, and device installation logs. Identify devices, correlate connection times and drive letters, and build a timeline for removable media investigations.

中文简介正在准备中。当前显示英语简介。

• Investigating suspected data removal through USB storage
• Checking whether unapproved USB devices were connected
• Correlating USB connections with malware execution

Inspect suspicious PDFs without opening them in a reader. Use PDFiD, pdf-parser, and peepdf to examine internal objects, extract scripts, embedded files, and URLs, and document how the suspected attack works.

中文简介正在准备中。当前显示英语简介。

• Triage suspicious PDF email attachments
• Investigate embedded JavaScript and automatic actions
• Extract embedded files and external URLs

Audit AWS S3 buckets for public exposure, excessive permissions, and gaps in encryption or versioning settings. Use AWS CLI, Prowler, and access analysis to compile findings, prioritize issues, and plan or apply configuration fixes.

中文简介正在准备中。当前显示英语简介。

• Reviewing S3 settings in a newly onboarded AWS account
• Investigating alerts about publicly exposed buckets
• Preparing periodic access control audit reports

Analyze Windows event logs in Splunk to investigate suspicious logins, privilege changes, persistence, and movement between computers. Build detection searches and organize endpoint activity into timelines, with findings linked to MITRE ATT&CK attack techniques.

中文简介正在准备中。当前显示英语简介。

• Investigating suspicious Windows logins
• Building detection searches in Splunk
• Creating incident timelines

Simulate device-code and app-consent phishing in an explicitly authorized Microsoft Entra ID environment. Assess whether authentication and consent controls prevent token misuse, map reachable Microsoft 365 resources, and document findings with remediation recommendations.

中文简介正在准备中。当前显示英语简介。

• Run authorized Microsoft 365 phishing exercises
• Validate Conditional Access and MFA controls
• Test restrictions on app consent

Audit Kubernetes RBAC, the rules that assign access through roles, to identify excessive permissions, risky role assignments, and paths to gaining higher privileges. Review service accounts and produce findings with recommended permission changes.

中文简介正在准备中。当前显示英语简介。

• Reviewing access permissions in shared Kubernetes clusters
• Finding accounts that can read secrets or gain higher privileges
• Checking service account token mounts

Investigate malware that survives OS reinstallation by checking UEFI firmware, boot files, and Secure Boot settings. Use chipsec and supporting tools to compare trusted baselines, identify bootkit indicators, and document findings.

中文简介正在准备中。当前显示英语简介。

• Investigating reinfection after OS reinstallation
• Checking unexpected Secure Boot changes
• Comparing firmware against a trusted vendor baseline

Turn cyber threat intelligence reports into a searchable library of attacker behaviors linked to MITRE ATT&CK techniques. Export structured STIX 2.1 data, a threat information exchange format, and create detection rule templates from documented activity.

中文简介正在准备中。当前显示英语简介。

• Cataloging attacker behaviors from threat intelligence reports
• Organizing attack patterns by tactic, technique, and threat actor
• Creating detection rule templates from documented behaviors

Audit MCP servers, which provide external tools to AI agents, for hidden instructions, changes after approval, unsafe internal requests, and missing authentication. Use mcp-scan and manual checks to document risks and recommended fixes.

中文简介正在准备中。当前显示英语简介。

• Reviewing an MCP server before adding it to an agent
• Auditing an internally developed MCP server
• Checking approved tools for unexpected changes

Analyze Windows Amcache records to investigate applications, deleted executable traces, and drivers. Extract file details, compare SHA-1 hashes with malware databases, and combine records into a timeline to support incident investigations.

中文简介正在准备中。当前显示英语简介。

• Investigating traces of deleted executables
• Checking software installed during an incident
• Comparing file hashes with malware databases

Analyze a software bill of materials, an inventory of software components, against known vulnerability records. Trace indirect dependencies, assess risk, and produce reports that help teams prioritize fixes and review supplier software.

中文简介正在准备中。当前显示英语简介。

• Assessing vulnerabilities in vendor-provided software inventories
• Checking whether a newly disclosed CVE affects deployed software
• Adding SBOM vulnerability checks to CI/CD

Audit Kubernetes access rules to find excessive permissions and service account token abuse paths. Trace which users or workloads could gain cluster administrator access, then produce prioritized findings and recommendations for reducing permissions.

中文简介正在准备中。当前显示英语简介。

• Reviewing Kubernetes privilege escalation paths
• Checking permissions after an RBAC change
• Tracing workloads with overprivileged service accounts

Map attacker behaviors and indicators of compromise, or traces of an intrusion, to MITRE ATT&CK techniques. Build coverage heatmaps, compare threat groups, and identify monitoring gaps to guide detection improvements and threat intelligence reporting.

中文简介正在准备中。当前显示英语简介。

• Mapping attacker behaviors and intrusion traces to ATT&CK techniques
• Visualizing detection coverage with ATT&CK Navigator
• Identifying attack techniques missing from monitoring

Collect and organize victim postings from ransomware data leak sites through tracking feeds. Analyze group activity over time, compare sector and country patterns, and produce threat reports with risk assessments and defensive recommendations.

中文简介正在准备中。当前显示英语简介。

• Track monthly activity across ransomware groups
• Assess ransomware exposure by sector or country
• Identify newly observed ransomware groups

Investigate ransomware payment addresses using public blockchain records. Trace transfers, group addresses likely controlled by the same entity, identify links to exchanges or mixing services, and organize findings into a report for incident responders and investigators.

中文简介正在准备中。当前显示英语简介。

• Investigating a payment address found in a ransom note
• Tracing funds after a ransom payment
• Comparing related wallets across ransomware incidents

Search Windows PowerShell logs for traces of Empire, a framework used after a system is compromised. Identify characteristic launch commands, encoded code, module calls, and communication paths, then report suspicious events with timelines and severity scores.

中文简介正在准备中。当前显示英语简介。

• Investigating suspected Empire activity
• Checking encoded commands and communication paths
• Building detection rules from Empire indicators

Reconstruct Windows folder browsing activity from Shellbag registry records using SBECmd and ShellBags Explorer. Investigate traces of deleted directories, disconnected USB drives, and network shares while accounting for limits in what the records and timestamps show.

中文简介正在准备中。当前显示英语简介。

• Reconstructing a user's folder browsing history
• Investigating browsing traces on disconnected USB drives
• Checking access traces for deleted folders

Analyze Windows PowerShell event logs to reconstruct scripts split across records and identify encoded commands, suspicious downloads, and security scanning bypass attempts. Produce a report with recovered scripts, risk scores, and mappings to documented attack techniques.

中文简介正在准备中。当前显示英语简介。

• Investigating suspicious PowerShell activity
• Reconstructing scripts split across log records
• Finding encoded commands and suspicious downloads