测试与安全技能

Analyze threat intelligence stored in MISP, a platform for sharing security threat data. Summarize event counts, indicator types, attacker groups, and trends over time to create a threat landscape report for a chosen period.

中文简介正在准备中。当前显示英语简介。

• Create a threat landscape report for the past 90 days
• Summarize attacker activity and frequently tagged attack techniques
• Track changes in submitted threat indicator types and volumes

Analyze Windows Registry files to uncover user activity, installed software, USB connections, and automatic startup entries. Organize these traces into investigation summaries and timelines to help examine suspicious activity and possible malware persistence.

中文简介正在准备中。当前显示英语简介。

• Investigating suspicious automatic startup entries
• Reconstructing user activity around an incident
• Checking USB device connection traces

Audit AWS S3 buckets for public exposure, excessive permissions, and gaps in encryption or versioning settings. Use AWS CLI, Prowler, and access analysis to compile findings, prioritize issues, and plan or apply configuration fixes.

中文简介正在准备中。当前显示英语简介。

• Reviewing S3 settings in a newly onboarded AWS account
• Investigating alerts about publicly exposed buckets
• Preparing periodic access control audit reports

Use Intel CHIPSEC to inspect firmware protections, including BIOS write locks and Secure Boot settings. Save test results, extract firmware for offline comparison, and review UEFI variables to investigate configuration weaknesses or suspicious changes.

中文简介正在准备中。当前显示英语简介。

• Establishing a firmware security baseline for new hardware
• Checking BIOS and SPI flash write protection
• Extracting firmware for comparison with a known-good image

Audit Google Cloud access permissions to find overly broad roles, unnecessary service account keys, public access, and impersonation risks. Use gcloud CLI, Policy Analyzer, and IAM Recommender to document findings and plan more limited permissions.

中文简介正在准备中。当前显示英语简介。

• Reviewing access permissions across a GCP organization
• Replacing broad Owner and Editor roles with narrower roles
• Auditing unused service accounts and user-managed keys

Map threat groups and their attack techniques to MITRE ATT&CK, a catalog of adversary behavior. Generate Navigator visualization files, compare groups, and overlay detection coverage to identify gaps that can guide defensive planning.

中文简介正在准备中。当前显示英语简介。

• Profiling the attack techniques used by a specific threat group
• Comparing techniques across multiple threat groups
• Finding detection gaps against a target adversary

Turn cyber threat intelligence reports into a searchable library of attacker behaviors linked to MITRE ATT&CK techniques. Export structured STIX 2.1 data, a threat information exchange format, and create detection rule templates from documented activity.

中文简介正在准备中。当前显示英语简介。

• Cataloging attacker behaviors from threat intelligence reports
• Organizing attack patterns by tactic, technique, and threat actor
• Creating detection rule templates from documented behaviors

Analyze captured RAM with Volatility to investigate suspicious processes, injected code, network connections, and other evidence of compromise. The skill guides memory investigations and organizes findings into timelines and reports, including malware traces absent from disk.

中文简介正在准备中。当前显示英语简介。

• Investigating fileless malware after an endpoint alert
• Finding hidden processes and injected code
• Linking suspicious processes to network connections

Analyze suspicious email headers to trace delivery routes and assess sender spoofing. Review SPF, DKIM, and DMARC sender authentication results, compare sender and reply addresses, and examine links and attachment hashes for phishing indicators.

中文简介正在准备中。当前显示英语简介。

• Triaging a suspicious email reported by a user
• Checking whether a sender domain was spoofed
• Tracing the delivery route of a phishing email

Use Scapy, a Python library for working with network packets, to inspect saved captures or authorized live traffic. Summarize protocols and connections, identify suspicious patterns, craft test packets, and export findings as structured JSON reports.

中文简介正在准备中。当前显示英语简介。

• Investigating saved network captures
• Summarizing traffic volumes, protocols, and connection endpoints
• Checking for SYN floods and DNS data leakage indicators

Analyze Solidity smart contracts with Slither and Mythril before Ethereum deployment. Combine code inspection with execution path analysis, review potential vulnerabilities, remove duplicate findings, and produce an audit report with severity ratings and suggested fixes.

中文简介正在准备中。当前显示英语简介。

• Checking Solidity contracts before deployment
• Investigating reentrancy and access control weaknesses
• Consolidating findings from Slither and Mythril

Analyze DNS query logs for signs of hidden data transfers and attacker command channels. This skill uses unusual name lengths, randomness, and traffic volumes, then correlates findings with endpoint processes and estimates possible data loss.

中文简介正在准备中。当前显示英语简介。

• Investigating suspected data theft through DNS
• Finding algorithmically generated domains used by malware
• Reviewing hosts with unusually high DNS query volumes

Assess Shadow Credentials account takeover during authorized Active Directory testing. Examine permissions that allow public key registration, validate authentication without a password reset, and document credential cleanup, detection opportunities, and access control changes needed for remediation.

中文简介正在准备中。当前显示英语简介。

• Assessing risky permissions identified in BloodHound
• Validating account takeover without resetting a password
• Generating directory change records during security exercises

Compare evidence from cyber operations to assess which attacker may be responsible. Weigh shared infrastructure, attack methods, malware similarities, timing, and language clues against competing explanations, then report attribution findings with justified confidence levels.

中文简介正在准备中。当前显示英语简介。

• Assessing possible attackers during an incident investigation
• Comparing infrastructure and attack methods across campaigns
• Evaluating conflicting evidence against multiple hypotheses

Investigate suspicious IP addresses, domains, URLs, file hashes, and email artifacts using multiple threat intelligence sources. Assess confidence that each indicator is malicious, check links to known campaigns, and document evidence for blocking, monitoring, or allowing it.

中文简介正在准备中。当前显示英语简介。

• Triaging indicators from phishing emails
• Investigating suspicious IP addresses and URLs in alerts
• Assessing bulk indicators before adding them to blocklists

Investigate suspicious URLs with URLScan.io by reviewing screenshots, redirects, page content, and network requests. Extract domains, IP addresses, and file hashes as indicators of compromise, then compare findings with threat intelligence sources.

中文简介正在准备中。当前显示英语简介。

• Investigating suspicious links in emails
• Checking pages for brand impersonation and credential forms
• Tracing redirects and extracting domains, IPs, and hashes

Investigate suspicious Azure activity by querying administrative and sign-in logs. Create KQL queries, Azure's log search language, to examine role assignments, resource changes, unusual access, and other signals for cloud security monitoring.

中文简介正在准备中。当前显示英语简介。

• Investigate suspicious administrative activity in Azure
• Check newly added administrator roles
• Review resource and network security rule changes

Analyze Cobalt Strike communication profiles and Beacon payload configurations to extract request paths, headers, timing, and process injection settings. Turn these indicators into a JSON report and network detection rules for Suricata or Snort.

中文简介正在准备中。当前显示英语简介。

• Analyzing a captured Malleable C2 profile
• Extracting communication settings from a Beacon payload
• Creating Suricata or Snort detection rules

Analyze malware communication with command servers to understand periodic check-ins, message formats, encoded data, and backup destinations. Produces a structured analysis report and network detection rules based on captured traffic and malware code.

中文简介正在准备中。当前显示英语简介。

• Investigating malware communication in captured traffic
• Measuring periodic check-in intervals and timing variation
• Mapping command servers and backup destinations

Examine suspicious Word, Excel, and PowerPoint documents by extracting macros and untangling code designed to hide its purpose. Identify download addresses, execution triggers, and attack steps, then document findings and indicators for detecting related threats.

中文简介正在准备中。当前显示英语简介。

• Investigating suspicious email attachments
• Finding download addresses hidden in VBA code
• Examining legacy Excel 4.0 macros

Analyze Go malware binaries in Ghidra by extracting build metadata, function names, dependencies, and relevant strings. Use GoResolver to help recover obscured names and organize functions so analysts can focus their reverse engineering work.

中文简介正在准备中。当前显示英语简介。

• Investigating the structure of a Go malware sample
• Recovering function names from stripped or obfuscated binaries
• Identifying embedded Go modules and dependencies

Analyze malware network captures to investigate command-and-control traffic, data theft, and downloaded files. Use packet analysis tools to identify suspicious destinations and recurring connections, extract artifacts, and create detection rules from observed patterns.

中文简介正在准备中。当前显示英语简介。

• Analyzing malware sandbox network captures
• Investigating command-and-control traffic
• Tracing data theft and file downloads

Analyze disk images with Autopsy and The Sleuth Kit to recover deleted files, search content, and examine recorded activity. Build investigation timelines and visual reports that help stakeholders understand evidence from one or multiple disk images.

中文简介正在准备中。当前显示英语简介。

• Recovering deleted files from a disk image
• Searching evidence for confidential files and keywords
• Reconstructing activity around a malware infection

Review Active Directory permissions with ldap3, a Python library for directory queries. Identify excessive access granted to non-administrative accounts, explain potential privilege escalation paths, and produce a JSON report with affected objects and remediation recommendations.

中文简介正在准备中。当前显示英语简介。

• Auditing excessive Active Directory permissions
• Investigating privilege escalation paths from ordinary accounts
• Reporting affected objects and permission remediation recommendations