Mahipal

Investigate Windows credential theft by correlating endpoint monitoring data, Sysmon events, and security logs. The skill provides detection queries and a reporting format to identify suspicious access and assess which credentials may be compromised.

中文简介正在准备中。当前显示英语简介。

• Investigating alerts about suspicious LSASS access
• Hunting for credential theft across Windows systems
• Assessing the scope of potentially compromised credentials

Analyze Sysmon logs to investigate process injection, where malicious code hides inside legitimate processes. Correlate remote thread creation, cross-process access, and unusual DLL loading, then organize findings by injection type, risk level, and ATT&CK technique.

中文简介正在准备中。当前显示英语简介。

• Investigating EDR alerts about suspicious cross-process access
• Hunting for malicious code hidden inside legitimate processes
• Checking Sysmon coverage for process injection detection

Screen dependency names on npm, PyPI, and crates.io before installation to find lookalikes of legitimate packages. This skill compares spelling patterns and registry metadata, helping review AI-generated lists, lockfile changes, and new dependencies in CI/CD.

中文简介正在准备中。当前显示英语简介。

• Screening a new dependency before installation
• Reviewing dependency lists generated by AI
• Checking lockfile changes for swapped packages

Find WMI event subscriptions that let attackers retain access to Windows systems. Correlate Sysmon events with stored subscriptions and Autoruns results, inspect execution triggers and commands, and document risks and recommended remediation.

中文简介正在准备中。当前显示英语简介。

• Triaging Sysmon alerts for events 19, 20, and 21
• Finding WMI persistence during incident response
• Distinguishing suspicious subscriptions from legitimate settings

Analyze Windows authentication logs for repeated password guesses against Remote Desktop services. Group failures by source IP and account, check for later successful logins, and produce a JSON report highlighting attack patterns and possible compromise.

中文简介正在准备中。当前显示英语简介。

• Investigate repeated login failures on exposed RDP services
• Identify accounts targeted by password guessing
• Check for successful logins after repeated failures

Use CloudFox to inspect AWS and Azure resources through read-only queries. Identify exposed endpoints, secrets, permissions, and role trust relationships, then organize findings into files for reviewing configuration weaknesses and potential paths to broader access.

中文简介正在准备中。当前显示英语简介。

• Inventorying an unfamiliar AWS or Azure account
• Finding internet-facing resources
• Mapping role trust relationships and permissions

Detect attacks that misuse legitimate Windows tools by examining command arguments, parent and child processes, and network connections. Create Sysmon logging configurations and Sigma detection rules, analyze endpoint logs, and review application controls while accounting for legitimate usage.

中文简介正在准备中。当前显示英语简介。

• Creating detection rules for misuse of Windows tools
• Investigating unusual process chains in alerts
• Hunting for fileless attacks in endpoint logs

Detect attacks that misuse legitimate Windows utilities such as certutil and mshta. Analyze process logs, command arguments, and parent-child relationships with Sigma detection rules, then report suspicious events with severity scores and supporting event details.

中文简介正在准备中。当前显示英语简介。

• Investigating suspicious use of built-in Windows utilities
• Creating Sigma rules for unusual command arguments
• Finding Office apps that launch unexpected system utilities

Evaluate threat intelligence platforms, which collect and organize cyber threat information. Define requirements, compare integrations and operating costs, plan practical trials, and use weighted scoring to select a platform and outline its rollout.

中文简介正在准备中。当前显示英语简介。

• Preparing requirements for TIP procurement
• Comparing platforms before a TIP migration
• Checking whether an existing TIP meets team needs

Build detection rules for suspicious Windows scheduled tasks by correlating Sysmon and Windows Security logs. Examine parent processes, file paths, encoded commands, and remote task creation to uncover persistent access and movement between systems.

中文简介正在准备中。当前显示英语简介。

• Investigating suspicious scheduled task creation
• Hunting for tasks that run encoded commands
• Detecting remote task creation across systems

Investigate malicious code placed inside legitimate Windows processes using memory analysis, event logs, and API monitoring. Identify injection methods, examine extracted code, and produce evidence reports and detection rules for suspicious process behavior.

中文简介正在准备中。当前显示英语简介。

• Investigating unexpected connections from legitimate processes
• Finding injected code in memory dumps
• Classifying process hollowing and other injection methods

Investigate suspected rootkits, malware that hides its presence, by comparing process lists, inspecting memory, and checking system integrity. Use Volatility and Windows or Linux scanners to identify hidden processes, suspicious drivers, altered system calls, and concealed connections.

中文简介正在准备中。当前显示英语简介。

• Investigating compromise when standard tools show no anomalies
• Comparing process lists to find hidden activity
• Examining suspicious drivers and concealed connections

Monitor requests to an AI prediction API for signs of model copying or training-data exposure. Test an authorized model with simulated attacks, measure the risk, and evaluate defenses such as request limits and reduced prediction detail.

中文简介正在准备中。当前显示英语简介。

• Monitoring a public or partner prediction API
• Measuring model copying risk before deployment
• Testing request limits and reduced prediction detail

Set up Zeek to observe network traffic and produce structured logs for security analysis. Create custom detection scripts, investigate suspicious DNS activity and repeated external connections, and forward logs to a central security monitoring system.

中文简介正在准备中。当前显示英语简介。

• Set up passive monitoring at key network points
• Create detection scripts for suspicious DNS and repeated connections
• Forward Zeek logs to a central security monitoring system

Investigate Pass-the-Hash attacks, where stolen password hashes are reused for authentication. Examine unusual NTLM logins alongside credential theft indicators, validate suspicious findings across security logs, and document evidence, affected hosts, confidence, and recommended responses.

中文简介正在准备中。当前显示英语简介。

• Hunting for movement using stolen password hashes
• Triaging suspicious NTLM login alerts
• Assessing the scope of a compromise

Investigate stolen Kerberos tickets, authentication credentials that can be reused without a password, by correlating Windows security events. Build Splunk or Elastic detection rules for cross-host reuse, weaker encryption, and unusual request volumes, and report risk-scored findings.

中文简介正在准备中。当前显示英语简介。

• Investigating suspected reuse of stolen Kerberos tickets
• Building Splunk or Elastic detection rules
• Finding unusual ticket request volumes

Investigate process hollowing, where malicious code replaces a legitimate process in memory. Compare memory with disk files, examine process relationships, and correlate network activity to document suspicious processes and guide containment.

中文简介正在准备中。当前显示英语简介。

• Investigating process injection alerts from EDR
• Examining suspicious behavior in legitimate Windows processes
• Finding threats that run in memory

Investigate phishing emails that hide malicious links in QR codes. Decode destinations, analyze suspicious URLs, configure email detection rules, and plan mobile protections and awareness training for people who scan codes on their phones.

中文简介正在准备中。当前显示英语简介。

• Investigating suspicious emails containing QR codes
• Configuring QR detection for email images and PDF attachments
• Protecting phones from malicious QR destinations

Configure Fail2ban to detect port scans, repeated SSH login attempts, and suspicious web requests from server logs. Create custom detection patterns, automatically block source IP addresses, and set up notifications and longer bans for repeat offenders.

中文简介正在准备中。当前显示英语简介。

• Automatically blocking port scans against public servers
• Defending SSH against repeated login attempts
• Detecting suspicious paths in Nginx access logs

Investigate suspected data theft from AWS S3 by comparing access logs, GuardDuty findings, and Macie classifications. Identify unusual bulk downloads and transfers across accounts, assess sensitive data exposure, and build automated detection rules.

中文简介正在准备中。当前显示英语简介。

• Investigating unusual bulk downloads from S3
• Checking transfers to external AWS accounts
• Assessing exposure of sensitive data

Assess serverless functions, primarily AWS Lambda, for unsafe execution of external input and unauthorized changes to code or added libraries. Combine source inspection, activity logs, and permission reviews to identify injection risks and recommend detection and prevention measures.

中文简介正在准备中。当前显示英语简介。

• Reviewing Lambda event handlers for injection vulnerabilities
• Investigating unauthorized function or layer changes
• Checking privilege escalation through Lambda execution roles

Investigate attempts to gain higher privileges on Windows and Linux using endpoint and security logs. Guide hypothesis testing, evidence analysis, false-positive checks, and reporting to help assess suspicious privilege changes and the scope of a compromise.

中文简介正在准备中。当前显示英语简介。

• Hunting for signs of privilege escalation
• Investigating alerts about suspicious privilege changes
• Assessing compromise scope during incident response

Design monitoring for industrial attacks that alter controller programs while hiding changes with false sensor readings. Compare PLC program blocks against known-good copies and check physical measurements against process models to identify suspicious inconsistencies.

中文简介正在准备中。当前显示英语简介。

• Monitoring industrial controller programs for unauthorized changes
• Investigating discrepancies between sensor readings and equipment behavior
• Planning detection across IT and industrial control systems

Analyze Modbus industrial network traffic to identify unauthorized commands, write operations, and unusual polling intervals. Compare activity with normal traffic patterns and allowed operations, then report anomalies by type and severity.

中文简介正在准备中。当前显示英语简介。

• Investigating suspicious Modbus traffic
• Establishing normal polling patterns
• Defining allowed Modbus function codes