Mahipal

Design monitoring for industrial attacks that alter controller programs while hiding changes with false sensor readings. Compare PLC program blocks against known-good copies and check physical measurements against process models to identify suspicious inconsistencies.

中文简介正在准备中。当前显示英语简介。

• Monitoring industrial controller programs for unauthorized changes
• Investigating discrepancies between sensor readings and equipment behavior
• Planning detection across IT and industrial control systems

Assess whether a container can escape its isolation and reach the host during an authorized security test. Review privileges, shared mounts, Docker socket exposure, and runC vulnerabilities, then document demonstrated impact and remediation.

中文简介正在准备中。当前显示英语简介。

• Testing container escape within an approved scope
• Assessing the impact of privileged or hostPath workloads
• Validating controls that block container escape

Build or tune a monitoring pipeline that learns normal user behavior from activity logs. Use Elasticsearch or OpenSearch to score unusual activity, compare colleagues in similar roles, and combine warning signs into insider threat alerts.

中文简介正在准备中。当前显示英语简介。

• Building continuous monitoring for insider threats
• Scoring unusual logins and large downloads
• Comparing behavior across similar job roles

Investigate compromised credentials across AWS, Azure, and GCP by correlating security alerts and audit logs. Examines unusual API activity and suspicious sign-ins, helps assess the affected scope, and guides containment actions such as disabling keys and revoking sessions.

中文简介正在准备中。当前显示英语简介。

• Investigate cloud API activity from unfamiliar locations
• Assess exposure after a credential leak notification
• Correlate suspicious sign-ins across cloud providers

Build a screening pipeline for web pages, PDFs, and images before an AI agent reads them. Extract hidden text, check for malicious instructions with detection models, and record decisions to block or allow content.

中文简介正在准备中。当前显示英语简介。

• Screening external content before an agent reads it
• Checking uploaded PDFs and images for hidden instructions
• Scanning documents before adding them to a knowledge base

Investigate Windows malware that runs in memory or abuses legitimate system tools. Use logs, registry entries, and memory dumps to trace persistence, identify suspicious activity, and produce detection rules and an analysis report.

中文简介正在准备中。当前显示英语简介。

• Investigating suspicious PowerShell activity
• Checking WMI persistence mechanisms
• Finding malicious code in memory dumps

Investigate Entra ID reconnaissance by searching Graph API logs for tool signatures and unusual directory queries. Use KQL, a log query language, to correlate suspicious requests with sign-ins and turn useful searches into Sentinel detection rules.

中文简介正在准备中。当前显示英语简介。

• Investigating Graph API activity after suspected credential theft
• Checking whether offensive tool activity is visible in logs
• Creating and tuning scheduled Sentinel detection rules

Audit Azure Blob and ADLS storage accounts for public exposure, risky access tokens, encryption settings, and insecure transport configurations. Use the azure-mgmt-storage Python SDK to produce a JSON report with account findings, severity ratings, and remediation recommendations.

中文简介正在准备中。当前显示英语简介。

• Auditing storage accounts across an Azure subscription
• Investigating suspected exposure through public blob access
• Reviewing SAS token permissions and expiration

Inspect DNP3 traffic, a communication protocol used in industrial control systems, for unauthorized sources and unexpected commands. The skill compares captured traffic with normal patterns and reports suspicious control actions, restarts, and file operations.

中文简介正在准备中。当前显示英语简介。

• Investigating suspicious DNP3 control commands
• Checking substation traffic against normal patterns
• Preparing DNP3 intrusion detection rules

Examine Zeek connection logs for regular callbacks that may indicate communication with an attacker’s control server. Use ZAT and Pandas to group connections, measure timing variation, and identify source and destination pairs for further investigation.

中文简介正在准备中。当前显示英语简介。

• Hunting for periodic callbacks in Zeek connection logs
• Comparing connection timing across source and destination pairs
• Developing beaconing detection rules and hunting queries

Investigate DCSync attacks, which abuse Active Directory replication to steal password hashes. Use audit events and network traffic to identify suspicious replication requests, examine their sources, and check for subsequent credential misuse.

中文简介正在准备中。当前显示英语简介。

• Hunting for credential theft in Active Directory
• Investigating suspected Mimikatz or Impacket use
• Auditing accounts with directory replication permissions

Scan code, configuration files, and Git history for exposed AWS credentials with TruffleHog. Checks whether detected keys remain active and guides key replacement, incident investigation, and automated checks before commits and during CI/CD.

中文简介正在准备中。当前显示英语简介。

• Auditing Git history for exposed AWS keys
• Adding credential checks before commits and in CI/CD
• Investigating credential exposure after a GuardDuty alert

Build detections for fileless attacks on Windows using process activity, script logs, and endpoint monitoring. Investigate suspicious PowerShell, code injected into running processes, WMI persistence, and registry-based execution with logging guidance and detection query examples.

中文简介正在准备中。当前显示英语简介。

• Building detections for suspicious PowerShell activity
• Hunting for code injection into running processes
• Monitoring WMI persistence and registry-based execution

Detect unexpected changes in running containers by comparing them with their original images and monitoring execution and file activity. Use Falco or Microsoft Defender for Containers to investigate changes and guide isolation, replacement, and preventive configuration.

中文简介正在准备中。当前显示英语简介。

• Finding unexpected binaries executed inside running containers
• Investigating package installations and file changes at runtime
• Checking whether containers still match their approved images

Analyze endpoint, cloud storage, and email logs for signs of insider data theft. Use pandas to compare upload volumes with normal user behavior and examine data loss prevention alerts, unusual file access, and activity outside working hours.

中文简介正在准备中。当前显示英语简介。

• Investigating suspected insider data theft
• Finding users with unusually large uploads
• Reviewing file access outside working hours

Analyze Zeek network logs to find lateral movement, when an intruder spreads between internal computers. Examine administrative file sharing, authentication across multiple hosts, and remote service operations to identify suspicious connections and reconstruct incident timelines.

中文简介正在准备中。当前显示英语简介。

• Tracing spread to other computers after an initial compromise
• Investigating unauthorized transfers to administrative shares
• Finding one account authenticating to many internal hosts

Build automated responses to AWS GuardDuty security findings using EventBridge and Lambda. Configure severity filters, isolate EC2 instances, disable compromised access keys, preserve disk snapshots for investigation, and send notifications to security teams.

中文简介正在准备中。当前显示英语简介。

• Triggering responses to high-severity GuardDuty findings
• Isolating EC2 instances and preserving investigation data
• Disabling compromised IAM access keys

Analyze DNS logs to find signs of hidden data transfers. Use query length, character randomness, traffic volume, and response sizes to identify suspicious domains and support monitoring rules with Python, Suricata, and Splunk examples.

中文简介正在准备中。当前显示英语简介。

• Investigating possible data theft through DNS traffic
• Ranking suspicious domains found in DNS logs
• Creating DNS tunneling detection rules

Assess Bluetooth Low Energy devices by capturing wireless traffic, inspecting available data services, and checking pairing security. Identify signs of interception, reused commands, and data access that lacks authentication.

中文简介正在准备中。当前显示英语简介。

• Assess BLE security on IoT devices
• Check whether devices accept replayed commands
• Investigate suspicious pairing and device impersonation

Set up and operate Amazon GuardDuty to detect threats in AWS. Configure protection features, centralize findings across accounts, investigate suspicious activity, and build automated responses with EventBridge and Lambda, including containment of potentially compromised resources.

中文简介正在准备中。当前显示英语简介。

• Setting up threat detection for AWS accounts
• Investigating credential abuse and compromised instances
• Automating responses to high-severity findings

Investigate possible insider threats by correlating endpoint and security logs. Examine unusual data access, off-hours activity, bulk downloads, and privilege abuse, then document supporting evidence, risk, confidence, and recommended actions after checking the context for false positives.

中文简介正在准备中。当前显示英语简介。

• Investigating bulk downloads before an employee leaves
• Reviewing data access outside an employee's duties
• Examining unauthorized queries by service accounts

Investigate misuse of application identities in Microsoft Entra ID using audit and sign-in logs. Provides detection queries and investigation steps for suspicious credential additions, privileged role assignments, consent grants, and service principal enumeration.

中文简介正在准备中。当前显示英语简介。

• Investigating suspicious additions of application credentials
• Reviewing privileged roles assigned to application identities
• Building detection rules for Entra ID identity abuse

Investigate attackers moving between internal systems by correlating login records with network traffic. Supports detection rules, suspicious SMB and RDP activity analysis, and reports showing attack timelines, affected hosts, and monitoring gaps.

中文简介正在准备中。当前显示英语简介。

• Investigating attacker movement across internal systems
• Creating rules for suspicious authentication patterns
• Tracing affected hosts after a PsExec alert

Examine Windows endpoint logs for attempts to avoid security detection, including log clearing, altered file timestamps, injected code, and disabled protection. Correlate events to investigate suspicious behavior and develop detection rules with context for legitimate activity.

中文简介正在准备中。当前显示英语简介。

• Investigating cleared logs and altered file timestamps
• Checking suspected attempts to disable security tools
• Finding abuse of legitimate Windows utilities