Mahipal

Hunt for lateral movement, where attackers move between networked systems, using Splunk searches. Connect Windows logins with process and network activity to identify unusual host relationships, trace movement paths, and document affected accounts and systems.

中文简介正在准备中。当前显示英语简介。

• Tracing activity after credential theft
• Investigating unusual logins between hosts
• Finding new or unexpected host connections

Investigate Windows malware that runs in memory or abuses legitimate system tools. Use logs, registry entries, and memory dumps to trace persistence, identify suspicious activity, and produce detection rules and an analysis report.

中文简介正在准备中。当前显示英语简介。

• Investigating suspicious PowerShell activity
• Checking WMI persistence mechanisms
• Finding malicious code in memory dumps

Monitor local network traffic for ARP spoofing, where false address mappings can redirect traffic. Use ARPWatch, Wireshark, switch inspection settings, and Python monitoring to flag address changes, duplicate IP claims, gateway impersonation, and unusual ARP volumes.

中文简介正在准备中。当前显示英语简介。

• Investigating suspected interception on a local network
• Monitoring changes in IP-to-MAC address mappings
• Checking duplicate IP claims and gateway impersonation

Analyze endpoint, cloud storage, and email logs for signs of insider data theft. Use pandas to compare upload volumes with normal user behavior and examine data loss prevention alerts, unusual file access, and activity outside working hours.

中文简介正在准备中。当前显示英语简介。

• Investigating suspected insider data theft
• Finding users with unusually large uploads
• Reviewing file access outside working hours

Scan code, configuration files, and Git history for exposed AWS credentials with TruffleHog. Checks whether detected keys remain active and guides key replacement, incident investigation, and automated checks before commits and during CI/CD.

中文简介正在准备中。当前显示英语简介。

• Auditing Git history for exposed AWS keys
• Adding credential checks before commits and in CI/CD
• Investigating credential exposure after a GuardDuty alert

Investigate forged Kerberos authentication tickets in Active Directory by checking Windows logs for unusual encryption, excessive ticket lifetimes, and missing authentication requests. Produce a JSON report of suspicious indicators with risk ratings.

中文简介正在准备中。当前显示英语简介。

• Investigating suspected forged authentication tickets
• Checking for possible krbtgt credential theft
• Building detection rules from authentication logs

Detect unexpected changes in running containers by comparing them with their original images and monitoring execution and file activity. Use Falco or Microsoft Defender for Containers to investigate changes and guide isolation, replacement, and preventive configuration.

中文简介正在准备中。当前显示英语简介。

• Finding unexpected binaries executed inside running containers
• Investigating package installations and file changes at runtime
• Checking whether containers still match their approved images

Analyze AWS CloudTrail logs against normal activity patterns to spot unusual API calls, IP addresses, errors, and sensitive changes. Produce a JSON report with anomaly scores, suspicious users, and suggested investigation steps.

中文简介正在准备中。当前显示英语简介。

• Investigating possible misuse of AWS credentials
• Finding first-time API calls and unusual IP activity
• Reviewing IAM, KMS, and S3 policy changes

Analyze Zeek DNS logs for possible data theft hidden in domain queries. The skill examines unusual character patterns, long labels, distinct subdomains, and query volume, then ranks suspicious domains and produces a JSON evidence report.

中文简介正在准备中。当前显示英语简介。

• Investigating suspected DNS tunneling
• Finding possible data leaks hidden in DNS queries
• Ranking suspicious domains and identifying source IPs

Investigate suspicious email forwarding and hidden inbox rules that may expose messages after an account compromise. The skill guides log analysis, validation, and reporting, helping analysts document evidence, assess risk, and recommend response actions.

中文简介正在准备中。当前显示英语简介。

• Investigating external forwarding after an account compromise
• Checking rules that delete security alerts
• Hunting for rules that forward executive emails

Investigate suspected email account takeovers by examining audit logs, sign-ins, inbox rules, and app permissions. Identify suspicious forwarding, unlikely travel between sign-ins, and unusual access, then summarize findings and recommended containment actions in a severity-rated report.

中文简介正在准备中。当前显示英语简介。

• Investigating suspected business email compromise
• Checking for suspicious external forwarding rules
• Reviewing unusual sign-ins and app permissions

Examine recorded calls and voicemails for signs of AI-generated speech. Extract acoustic features, classify samples with machine learning, and prepare reports with confidence scores and sound visualizations to support voice impersonation investigations.

中文简介正在准备中。当前显示英语简介。

• Investigating calls impersonating executives
• Checking suspicious voicemails
• Comparing suspect recordings with genuine voice samples

Inspect DNP3 traffic, a communication protocol used in industrial control systems, for unauthorized sources and unexpected commands. The skill compares captured traffic with normal patterns and reports suspicious control actions, restarts, and file operations.

中文简介正在准备中。当前显示英语简介。

• Investigating suspicious DNP3 control commands
• Checking substation traffic against normal patterns
• Preparing DNP3 intrusion detection rules

Investigate Entra ID reconnaissance by searching Graph API logs for tool signatures and unusual directory queries. Use KQL, a log query language, to correlate suspicious requests with sign-ins and turn useful searches into Sentinel detection rules.

中文简介正在准备中。当前显示英语简介。

• Investigating Graph API activity after suspected credential theft
• Checking whether offensive tool activity is visible in logs
• Creating and tuning scheduled Sentinel detection rules

Build a screening pipeline for web pages, PDFs, and images before an AI agent reads them. Extract hidden text, check for malicious instructions with detection models, and record decisions to block or allow content.

中文简介正在准备中。当前显示英语简介。

• Screening external content before an agent reads it
• Checking uploaded PDFs and images for hidden instructions
• Scanning documents before adding them to a knowledge base

Investigate business email compromise, where impersonated executives or vendors request payments or sensitive data. Check sender details, unusual communication patterns, mailbox changes, and payment approval procedures to develop detection rules and verification controls.

中文简介正在准备中。当前显示英语简介。

• Investigating emails impersonating executives or vendors
• Reviewing requests to change vendor bank details
• Building detection rules for fraudulent payment requests

Set up AI email screening that compares writing style and communication habits to identify impersonation and suspicious payment requests. Connect detection policies to quarantine, warning banners, and analyst review workflows.

中文简介正在准备中。当前显示英语简介。

• Detecting executive impersonation in emails
• Reviewing vendor payment change requests
• Flagging unusual employee email behavior

Audit Azure Blob and ADLS storage accounts for public exposure, risky access tokens, encryption settings, and insecure transport configurations. Use the azure-mgmt-storage Python SDK to produce a JSON report with account findings, severity ratings, and remediation recommendations.

中文简介正在准备中。当前显示英语简介。

• Auditing storage accounts across an Azure subscription
• Investigating suspected exposure through public blob access
• Reviewing SAS token permissions and expiration

Create detection rules and investigation queries from API access logs to flag repeated identifier probing and unusual authorization responses. Helps investigate attempts to access other users’ data and review logging and rate limits.

中文简介正在准备中。当前显示英语简介。

• Investigating suspected unauthorized API data access
• Creating detection rules for repeated identifier probing
• Reviewing API logging and rate limits

Build or tune a monitoring pipeline that learns normal user behavior from activity logs. Use Elasticsearch or OpenSearch to score unusual activity, compare colleagues in similar roles, and combine warning signs into insider threat alerts.

中文简介正在准备中。当前显示英语简介。

• Building continuous monitoring for insider threats
• Scoring unusual logins and large downloads
• Comparing behavior across similar job roles

Analyze Zeek network logs to find lateral movement, when an intruder spreads between internal computers. Examine administrative file sharing, authentication across multiple hosts, and remote service operations to identify suspicious connections and reconstruct incident timelines.

中文简介正在准备中。当前显示英语简介。

• Tracing spread to other computers after an initial compromise
• Investigating unauthorized transfers to administrative shares
• Finding one account authenticating to many internal hosts

Investigate DCSync attacks, which abuse Active Directory replication to steal password hashes. Use audit events and network traffic to identify suspicious replication requests, examine their sources, and check for subsequent credential misuse.

中文简介正在准备中。当前显示英语简介。

• Hunting for credential theft in Active Directory
• Investigating suspected Mimikatz or Impacket use
• Auditing accounts with directory replication permissions

Set up and operate Amazon GuardDuty to detect threats in AWS. Configure protection features, centralize findings across accounts, investigate suspicious activity, and build automated responses with EventBridge and Lambda, including containment of potentially compromised resources.

中文简介正在准备中。当前显示英语简介。

• Setting up threat detection for AWS accounts
• Investigating credential abuse and compromised instances
• Automating responses to high-severity findings

Analyze DNS logs to find signs of hidden data transfers. Use query length, character randomness, traffic volume, and response sizes to identify suspicious domains and support monitoring rules with Python, Suricata, and Splunk examples.

中文简介正在准备中。当前显示英语简介。

• Investigating possible data theft through DNS traffic
• Ranking suspicious domains found in DNS logs
• Creating DNS tunneling detection rules