Mahipal

Analyze AWS CloudTrail logs against normal activity patterns to spot unusual API calls, IP addresses, errors, and sensitive changes. Produce a JSON report with anomaly scores, suspicious users, and suggested investigation steps.

中文简介正在准备中。当前显示英语简介。

• Investigating possible misuse of AWS credentials
• Finding first-time API calls and unusual IP activity
• Reviewing IAM, KMS, and S3 policy changes

Investigate Windows malware that runs in memory or abuses legitimate system tools. Use logs, registry entries, and memory dumps to trace persistence, identify suspicious activity, and produce detection rules and an analysis report.

中文简介正在准备中。当前显示英语简介。

• Investigating suspicious PowerShell activity
• Checking WMI persistence mechanisms
• Finding malicious code in memory dumps

Investigate suspicious email forwarding and hidden inbox rules that may expose messages after an account compromise. The skill guides log analysis, validation, and reporting, helping analysts document evidence, assess risk, and recommend response actions.

中文简介正在准备中。当前显示英语简介。

• Investigating external forwarding after an account compromise
• Checking rules that delete security alerts
• Hunting for rules that forward executive emails

Build automated responses to AWS GuardDuty security findings using EventBridge and Lambda. Configure severity filters, isolate EC2 instances, disable compromised access keys, preserve disk snapshots for investigation, and send notifications to security teams.

中文简介正在准备中。当前显示英语简介。

• Triggering responses to high-severity GuardDuty findings
• Isolating EC2 instances and preserving investigation data
• Disabling compromised IAM access keys

Investigate security incidents in IBM QRadar SIEM by connecting events across network, endpoint, and application logs. Build search queries and correlation rules, adjust false positive filters, and create dashboards to track investigation activity.

中文简介正在准备中。当前显示英语简介。

• Investigating events grouped into QRadar offenses
• Detecting successful logins after repeated failures
• Tuning rules that generate false positives

Connect security incidents across organizations by comparing attack indicators, techniques, and timelines. Build relationship graphs and campaign reports that document shared evidence, attribution confidence, and indicators useful for detection.

中文简介正在准备中。当前显示英语简介。

• Linking incidents that share attack indicators
• Analyzing attacks across partner organizations
• Preparing reports on sustained attack campaigns

Configure advanced Microsoft Defender protections on Windows, including rules that block risky behavior, protected folders, network filtering, and exploit defenses. Use audit modes to assess application impact, then deploy policies and monitor detections across an organization.

中文简介正在准备中。当前显示英语简介。

• Strengthening Windows endpoint protection
• Assessing ASR rules in audit mode
• Configuring ransomware protection for folders

Plan and run authorized security tests that simulate deceptive emails, calls, text messages, and in-person approaches. Measure employee responses, compare results across test methods, and report gaps in security awareness training and access controls.

中文简介正在准备中。当前显示英语简介。

• Planning an authorized social engineering assessment
• Measuring responses to simulated phishing
• Evaluating phone and physical access checks

Plan tiered administration for Active Directory by separating administrative accounts and systems into three levels. Cover dedicated administration workstations, authentication restrictions, and verification checks to help limit credential theft and the spread of compromise.

中文简介正在准备中。当前显示英语简介。

• Designing tiered Active Directory administration
• Separating privileged accounts by administrative tier
• Planning dedicated administration workstations

Design and configure VLANs, logical network partitions, to separate employee devices, servers, guests, and IoT equipment. Covers traffic restrictions between zones, switch security settings, and tests to verify that the intended isolation works.

中文简介正在准备中。当前显示英语简介。

• Separating guest WiFi and IoT devices from internal systems
• Planning network isolation for payment processing systems
• Restricting communication between network zones

Unwrap layers of obfuscated PowerShell malware to recover hidden commands, additional malicious code, and server addresses. Combines script structure analysis with execution tracing and decoding tools to support incident investigation and detection work.

中文简介正在准备中。当前显示英语简介。

• Investigating an obfuscated PowerShell script
• Recovering hidden commands and additional malicious code
• Extracting suspicious URLs, IP addresses, and file paths

Deploy Suricata to detect suspicious network traffic or block it inline. Configure protocol inspection, detection rules, and structured EVE JSON logs, then connect logs to analysis platforms and check packet drops and alert quality during operation.

中文简介正在准备中。当前显示英语简介。

• Deploying network intrusion monitoring
• Configuring inline blocking of malicious traffic
• Adding custom detection rules and reducing noisy alerts

Deploy decoy credentials, documents, and URLs with Canarytokens to detect suspicious access. Guides token generation, placement, alert testing, and inventory tracking, with email or webhook notifications when someone interacts with a planted token.

中文简介正在准备中。当前显示英语简介。

• Add intrusion alerts to shared folders
• Detect use of decoy cloud credentials
• Monitor decoy documents for signs of data theft

Assess authorized networks through host discovery, service checks, vulnerability identification, and controlled exploitation. Follow a structured testing process to document attack paths, demonstrate business impact, clean up test artifacts, and prioritize remediation.

中文简介正在准备中。当前显示英语简介。

• Assessing internal or external network security
• Validating firewall rules and network segmentation
• Verifying whether service vulnerabilities are exploitable

Configure Windows security logs for threat detection and incident investigation. Covers detailed audit policies, process command line recording, log storage sizing, and centralized forwarding so monitoring systems receive useful authentication and activity records.

中文简介正在准备中。当前显示英语简介。

• Record process launches with their command lines
• Monitor successful and failed sign-ins
• Forward Windows security events to a central monitoring system

Deploy decoy accounts, service entries, and policy objects in Active Directory to detect suspicious activity. Configure monitoring rules for Windows security events and validate alerts for credential misuse, reconnaissance, and movement between systems.

中文简介正在准备中。当前显示英语简介。

• Detecting Kerberoasting with decoy service entries
• Monitoring attempts to use decoy credentials
• Placing credential traps in decoy Group Policy objects

Deploy decoy files and monitor changes, renames, and deletions for early signs of ransomware. This skill guides Python monitoring, email, Slack, and syslog alerts, plus simulated file operations to verify that the detection and notification pipeline works.

中文简介正在准备中。当前显示英语简介。

• Monitoring shared drives and NAS for suspicious file changes
• Adding decoy file monitoring alongside endpoint protection
• Testing incident response with decoy file triggers

Assess iOS and Android app security using OWASP MASTG, a mobile security testing guide. Examine app files, runtime behavior, stored data, authentication, and API traffic, then document vulnerabilities, their impact, and suggested fixes.

中文简介正在准备中。当前显示英语简介。

• Assess mobile app security before release
• Check sensitive data storage and network traffic
• Test authentication and resistance to runtime manipulation

Guide a structured review after a security incident, using timelines and response data to identify root causes and process gaps. Produce review notes, response metrics, and practical improvements with named owners and deadlines.

中文简介正在准备中。当前显示英语简介。

• Reviewing response after a ransomware incident
• Turning exercise findings into process improvements
• Updating incident response playbooks

Configure Google Cloud IAP to check identity before granting access to internal applications and virtual machines. Set permissions by user group, device, and network, configure reauthentication, enable service-account access, and record access decisions for monitoring.

中文简介正在准备中。当前显示英语简介。

• Replacing VPN access to internal Google Cloud applications
• Restricting sensitive tools to managed devices
• Configuring SSH and RDP access through IAP tunnels

Conduct authorized WiFi security assessments covering authentication, encryption, rogue access points, and network separation. Test WPA2/WPA3 configurations and client behavior, then document weaknesses, evidence, business impact, and recommended fixes.

中文简介正在准备中。当前显示英语简介。

• Assessing corporate, guest, and IoT WiFi security
• Evaluating WPA3 migration and transition mode
• Testing rogue access point detection

Set up decoy credentials, storage, and secrets across AWS, Azure, and GCP to detect suspicious access. Connect audit logs to security alerts, verify detection, and document permissions, resource inventories, and maintenance plans.

中文简介正在准备中。当前显示英语简介。

• Detecting use of leaked cloud credentials
• Monitoring suspicious access to decoy storage and secrets
• Extending on-premises deception coverage to cloud environments

Contain an active security breach by isolating endpoints, blocking attacker communications, and revoking compromised access. Follow procedures to limit spread between systems, preserve evidence, verify containment, and report remaining risks and business impact.

中文简介正在准备中。当前显示英语简介。

• Contain ransomware spreading between servers
• Revoke access through compromised accounts
• Isolate hosts communicating with attacker infrastructure

Add checks to LLM prompts and responses using Llama Guard 3, NeMo Guardrails, and LLM Guard. Configure content screening, conversation boundaries, and sensitive-data filtering, then measure blocking and false-positive rates with labeled test prompts.

中文简介正在准备中。当前显示英语简介。

• Adding runtime safety checks to LLM, RAG, or agent apps
• Screening prompts for injection and jailbreak attempts
• Filtering sensitive or toxic model responses