Mahipal

Analyze threat intelligence stored in MISP, a platform for sharing security threat data. Summarize event counts, indicator types, attacker groups, and trends over time to create a threat landscape report for a chosen period.

中文简介正在准备中。当前显示英语简介。

• Create a threat landscape report for the past 90 days
• Summarize attacker activity and frequently tagged attack techniques
• Track changes in submitted threat indicator types and volumes

Analyze Windows Prefetch files, which record application execution data, using Python. Reconstruct execution timelines, review run counts and accessed resources, and identify suspicious programs or signs that an executable has been renamed to disguise its identity.

中文简介正在准备中。当前显示英语简介。

• Reconstructing a program execution timeline
• Investigating potentially renamed executables
• Reviewing suspicious tools and execution frequency

Reconstruct Windows folder browsing activity from Shellbag registry records using SBECmd and ShellBags Explorer. Investigate traces of deleted directories, disconnected USB drives, and network shares while accounting for limits in what the records and timestamps show.

中文简介正在准备中。当前显示英语简介。

• Reconstructing a user's folder browsing history
• Investigating browsing traces on disconnected USB drives
• Checking access traces for deleted folders

Assess the security of RAG systems, which retrieve documents to support AI answers. Test whether stored vectors expose source text, leak documents between tenants, or allow inserted content to dominate search results, then document findings and controls.

中文简介正在准备中。当前显示英语简介。

• Assessing source-text exposure from stored vectors
• Checking data isolation between tenants
• Testing retrieval manipulation in a test collection

Investigate ransomware payment addresses using public blockchain records. Trace transfers, group addresses likely controlled by the same entity, identify links to exchanges or mixing services, and organize findings into a report for incident responders and investigators.

中文简介正在准备中。当前显示英语简介。

• Investigating a payment address found in a ransom note
• Tracing funds after a ransom payment
• Comparing related wallets across ransomware incidents

Inspect suspicious PDFs without opening them in a reader. Use PDFiD, pdf-parser, and peepdf to examine internal objects, extract scripts, embedded files, and URLs, and document how the suspected attack works.

中文简介正在准备中。当前显示英语简介。

• Triage suspicious PDF email attachments
• Investigate embedded JavaScript and automatic actions
• Extract embedded files and external URLs

Audit MCP servers, which provide external tools to AI agents, for hidden instructions, changes after approval, unsafe internal requests, and missing authentication. Use mcp-scan and manual checks to document risks and recommended fixes.

中文简介正在准备中。当前显示英语简介。

• Reviewing an MCP server before adding it to an agent
• Auditing an internally developed MCP server
• Checking approved tools for unexpected changes

Use Intel CHIPSEC to inspect firmware protections, including BIOS write locks and Secure Boot settings. Save test results, extract firmware for offline comparison, and review UEFI variables to investigate configuration weaknesses or suspicious changes.

中文简介正在准备中。当前显示英语简介。

• Establishing a firmware security baseline for new hardware
• Checking BIOS and SPI flash write protection
• Extracting firmware for comparison with a known-good image

Build an automated workflow that collects suspicious files, checks known malware records, and submits unknown samples to isolated analysis environments. Generate verdicts and indicators of compromise, then send results to security monitoring systems.

中文简介正在准备中。当前显示英语简介。

• Automating analysis of quarantined email attachments
• Batch-processing files quarantined by endpoint security
• Extracting threat indicators during incident investigations

Audit Terraform infrastructure definitions and planned changes for excessive permissions, public exposure, and missing encryption. Use security scanners and custom rules to produce actionable findings and add automated checks before cloud infrastructure is deployed.

中文简介正在准备中。当前显示英语简介。

• Reviewing Terraform modules and plans before deployment
• Adding security checks to Terraform CI/CD pipelines
• Enforcing organization-specific infrastructure rules

Set up and run kube-bench to check Kubernetes configuration against CIS security benchmarks. Select the appropriate benchmark and cluster components, then export JSON or JUnit results for automated pipelines and troubleshoot skipped checks or incorrect detection.

中文简介正在准备中。当前显示英语简介。

• Setting up kube-bench for the first time
• Selecting benchmark versions and scan targets
• Exporting JSON or JUnit results for CI

Investigate malware that survives OS reinstallation by checking UEFI firmware, boot files, and Secure Boot settings. Use chipsec and supporting tools to compare trusted baselines, identify bootkit indicators, and document findings.

中文简介正在准备中。当前显示英语简介。

• Investigating reinfection after OS reinstallation
• Checking unexpected Secure Boot changes
• Comparing firmware against a trusted vendor baseline

Audit AWS, Azure, and GCP configurations against CIS Benchmarks, security configuration guidelines. Use automated scan results to identify failed checks, prioritize fixes, report compliance by area, and establish ongoing monitoring for configuration changes.

中文简介正在准备中。当前显示英语简介。

• Running an initial cloud security configuration audit
• Preparing CIS-related evidence for SOC 2 or ISO 27001 audits
• Prioritizing fixes for failed security checks

Analyze Windows Registry files to uncover user activity, installed software, USB connections, and automatic startup entries. Organize these traces into investigation summaries and timelines to help examine suspicious activity and possible malware persistence.

中文简介正在准备中。当前显示英语简介。

• Investigating suspicious automatic startup entries
• Reconstructing user activity around an incident
• Checking USB device connection traces

Reconstruct USB device usage on Windows by comparing registry records, Event Logs, and device installation logs. Identify devices, correlate connection times and drive letters, and build a timeline for removable media investigations.

中文简介正在准备中。当前显示英语简介。

• Investigating suspected data removal through USB storage
• Checking whether unapproved USB devices were connected
• Correlating USB connections with malware execution

Audit Kubernetes access rules to find excessive permissions and service account token abuse paths. Trace which users or workloads could gain cluster administrator access, then produce prioritized findings and recommendations for reducing permissions.

中文简介正在准备中。当前显示英语简介。

• Reviewing Kubernetes privilege escalation paths
• Checking permissions after an RBAC change
• Tracing workloads with overprivileged service accounts

Simulate device-code and app-consent phishing in an explicitly authorized Microsoft Entra ID environment. Assess whether authentication and consent controls prevent token misuse, map reachable Microsoft 365 resources, and document findings with remediation recommendations.

中文简介正在准备中。当前显示英语简介。

• Run authorized Microsoft 365 phishing exercises
• Validate Conditional Access and MFA controls
• Test restrictions on app consent

Find lookalike domains with dnstwist and prioritize suspicious results using DNS records, registration age, and website similarity. The skill also covers monitoring for new findings and producing blocklists and reports to support domain takedown requests.

中文简介正在准备中。当前显示英语简介。

• Finding domains that imitate a company or brand
• Investigating suspected phishing domains
• Monitoring for newly discovered lookalike domains

Analyze Windows PowerShell event logs to reconstruct scripts split across records and identify encoded commands, suspicious downloads, and security scanning bypass attempts. Produce a report with recovered scripts, risk scores, and mappings to documented attack techniques.

中文简介正在准备中。当前显示英语简介。

• Investigating suspicious PowerShell activity
• Reconstructing scripts split across log records
• Finding encoded commands and suspicious downloads

Analyze a software bill of materials, an inventory of software components, against known vulnerability records. Trace indirect dependencies, assess risk, and produce reports that help teams prioritize fixes and review supplier software.

中文简介正在准备中。当前显示英语简介。

• Assessing vulnerabilities in vendor-provided software inventories
• Checking whether a newly disclosed CVE affects deployed software
• Adding SBOM vulnerability checks to CI/CD

Use ROADrecon and roadtx during authorized Microsoft Entra ID testing to inspect directory objects and authentication tokens, which represent access permissions. Explore collected configuration offline, test token exchanges, and assess conditional access and device controls.

中文简介正在准备中。当前显示英语简介。

• Mapping tenant users, groups, roles, and applications
• Reviewing conditional access policies
• Testing token exchanges and device-based single sign-on

Audit Kubernetes RBAC, the rules that assign access through roles, to identify excessive permissions, risky role assignments, and paths to gaining higher privileges. Review service accounts and produce findings with recommended permission changes.

中文简介正在准备中。当前显示英语简介。

• Reviewing access permissions in shared Kubernetes clusters
• Finding accounts that can read secrets or gain higher privileges
• Checking service account token mounts

Examine Windows shortcut files to recover target paths, timestamps, drive identifiers, and machine details. Organize these traces into an investigation timeline covering local documents, USB devices, network shares, and suspicious startup shortcuts.

中文简介正在准备中。当前显示英语简介。

• Reconstruct document access history from Windows shortcuts
• Trace references to files on USB devices
• Investigate access to network shares

Audit AWS S3 buckets for public exposure, excessive permissions, and gaps in encryption or versioning settings. Use AWS CLI, Prowler, and access analysis to compile findings, prioritize issues, and plan or apply configuration fixes.

中文简介正在准备中。当前显示英语简介。

• Reviewing S3 settings in a newly onboarded AWS account
• Investigating alerts about publicly exposed buckets
• Preparing periodic access control audit reports