Mahipal

Deploy decoy credentials, documents, and URLs with Canarytokens to detect suspicious access. Guides token generation, placement, alert testing, and inventory tracking, with email or webhook notifications when someone interacts with a planted token.

中文简介正在准备中。当前显示英语简介。

• Add intrusion alerts to shared folders
• Detect use of decoy cloud credentials
• Monitor decoy documents for signs of data theft

Configure TLS 1.3, a protocol for encrypted connections, on nginx, Apache, and Python applications. Select encryption settings and key exchange groups, disable outdated protocols, and use openssl s_client and testssl.sh to check connections and configuration weaknesses.

中文简介正在准备中。当前显示英语简介。

• Enabling TLS 1.3 on nginx or Apache
• Configuring encrypted connections in a Python application
• Disabling outdated TLS versions and weak encryption

Build a two-tier certificate authority with OpenSSL and Python, separating the offline root from the issuing authority. Covers server and client certificates, revocation checks, and policies that define certificate usage and trust.

中文简介正在准备中。当前显示英语简介。

• Set up an internal certificate authority
• Issue server and client certificates
• Configure certificate revocation checks

Strengthen LDAP and Active Directory services by reviewing encrypted connections, signing, channel binding, access controls, and audit logging. Use the guidance to organize security settings, validate them in a test environment, and document implementation evidence.

中文简介正在准备中。当前显示英语简介。

• Reviewing LDAP or Active Directory security settings
• Organizing encrypted connections and authentication protections
• Checking audit logging and monitoring arrangements

Connect security incidents across organizations by comparing attack indicators, techniques, and timelines. Build relationship graphs and campaign reports that document shared evidence, attribution confidence, and indicators useful for detection.

中文简介正在准备中。当前显示英语简介。

• Linking incidents that share attack indicators
• Analyzing attacks across partner organizations
• Preparing reports on sustained attack campaigns

Deploy Suricata to detect suspicious network traffic or block it inline. Configure protocol inspection, detection rules, and structured EVE JSON logs, then connect logs to analysis platforms and check packet drops and alert quality during operation.

中文简介正在准备中。当前显示英语简介。

• Deploying network intrusion monitoring
• Configuring inline blocking of malicious traffic
• Adding custom detection rules and reducing noisy alerts

Simulate man-in-the-middle attacks, where traffic is intercepted between communicating systems, in authorized environments. Use Bettercap, Ettercap, and mitmproxy to test encryption enforcement, certificate validation, and network detection, then document findings and recommendations.

中文简介正在准备中。当前显示英语简介。

• Testing HTTPS enforcement and certificate validation
• Checking detection of network spoofing
• Demonstrating the risks of unencrypted traffic

Guide a structured review after a security incident, using timelines and response data to identify root causes and process gaps. Produce review notes, response metrics, and practical improvements with named owners and deadlines.

中文简介正在准备中。当前显示英语简介。

• Reviewing response after a ransomware incident
• Turning exercise findings into process improvements
• Updating incident response playbooks

Deploy CrowdStrike Falcon sensors across Windows, macOS, and Linux endpoints. Configure threat prevention and response policies, verify installation and detection, troubleshoot sensor issues, and connect events to SIEM platforms, which collect security logs for analysis.

中文简介正在准备中。当前显示英语简介。

• Deploying Falcon sensors across enterprise endpoints
• Configuring prevention and response policies by endpoint group
• Checking sensor connectivity and test detections

Deploy decoy files and monitor changes, renames, and deletions for early signs of ransomware. This skill guides Python monitoring, email, Slack, and syslog alerts, plus simulated file operations to verify that the detection and notification pipeline works.

中文简介正在准备中。当前显示英语简介。

• Monitoring shared drives and NAS for suspicious file changes
• Adding decoy file monitoring alongside endpoint protection
• Testing incident response with decoy file triggers

Configure pfSense to separate internal, guest, DMZ, and IoT networks. Set firewall rules, port forwarding, VPN connections, and bandwidth policies, then check traffic logs and test that each network can reach only its intended destinations.

中文简介正在准备中。当前显示英语简介。

• Separate staff, guest, server, and IoT networks
• Set port forwarding rules for externally accessible services
• Configure VPN access and bandwidth policies

Set up host-based intrusion detection to monitor changes on Windows and Linux endpoints. Configure Wazuh agents, file integrity checks, registry monitoring, alert rules, and automated responses, with guidance on exclusions and centralized security monitoring.

中文简介正在准备中。当前显示英语简介。

• Deploying Wazuh agents on Windows and Linux
• Monitoring critical files and registry changes
• Planning change detection for compliance requirements

Design and configure VLANs, logical network partitions, to separate employee devices, servers, guests, and IoT equipment. Covers traffic restrictions between zones, switch security settings, and tests to verify that the intended isolation works.

中文简介正在准备中。当前显示英语简介。

• Separating guest WiFi and IoT devices from internal systems
• Planning network isolation for payment processing systems
• Restricting communication between network zones

Design and validate rules that limit communication between servers and containers to necessary connections. The skill covers traffic mapping, label-based policies, staged enforcement, and checks for unauthorized movement between systems within a zero trust architecture.

中文简介正在准备中。当前显示英语简介。

• Planning communication rules for a zero trust network
• Separating production and development environments
• Restricting access to critical applications

Configure advanced Microsoft Defender protections on Windows, including rules that block risky behavior, protected folders, network filtering, and exploit defenses. Use audit modes to assess application impact, then deploy policies and monitor detections across an organization.

中文简介正在准备中。当前显示英语简介。

• Strengthening Windows endpoint protection
• Assessing ASR rules in audit mode
• Configuring ransomware protection for folders

Configure OAuth 2.0 authorization for web and mobile apps or service communication. Choose suitable flows, implement PKCE to protect authorization codes, limit permissions, and manage token storage, renewal, and revocation with security checks.

中文简介正在准备中。当前显示英语简介。

• Implement authorization with PKCE for web and mobile apps
• Configure authorization for service-to-service communication
• Review token storage, renewal, and revocation

Deploy osquery on Windows, macOS, and Linux to inspect processes, listening ports, software, and system settings using SQL, a database query language. Configure scheduled checks and centralized management to support threat hunting and compliance monitoring.

中文简介正在准备中。当前显示英语简介。

• Deploying osquery across Windows, macOS, and Linux
• Investigating suspicious processes and network connections with SQL
• Periodically checking software inventories and system settings

Set up Cloudflare Access and Tunnel to protect internal applications using user identity and device health checks. Covers application access policies, WARP device enrollment, and audit logging for teams replacing VPN access.

中文简介正在准备中。当前显示英语简介。

• Replace VPN access with application-specific permissions
• Expose internal apps without opening inbound ports
• Limit contractors to approved applications

Assess whether stolen Kerberos tickets, credentials used for network authentication, can enable access to other systems during authorized testing. Guide ticket extraction and reuse, review detection indicators, and document evidence for security reports.

中文简介正在准备中。当前显示英语简介。

• Authorized testing of access through reused tickets
• Checking detection of Kerberos ticket theft
• Collecting evidence for lateral movement reports

Set up decoy credentials, storage, and secrets across AWS, Azure, and GCP to detect suspicious access. Connect audit logs to security alerts, verify detection, and document permissions, resource inventories, and maintenance plans.

中文简介正在准备中。当前显示英语简介。

• Detecting use of leaked cloud credentials
• Monitoring suspicious access to decoy storage and secrets
• Extending on-premises deception coverage to cloud environments

Unwrap layers of obfuscated PowerShell malware to recover hidden commands, additional malicious code, and server addresses. Combines script structure analysis with execution tracing and decoding tools to support incident investigation and detection work.

中文简介正在准备中。当前显示英语简介。

• Investigating an obfuscated PowerShell script
• Recovering hidden commands and additional malicious code
• Extracting suspicious URLs, IP addresses, and file paths

Configure Google Cloud IAP to check identity before granting access to internal applications and virtual machines. Set permissions by user group, device, and network, configure reauthentication, enable service-account access, and record access decisions for monitoring.

中文简介正在准备中。当前显示英语简介。

• Replacing VPN access to internal Google Cloud applications
• Restricting sensitive tools to managed devices
• Configuring SSH and RDP access through IAP tunnels

Deploy and configure Snort 3 to detect suspicious network traffic. Create custom detection rules, tune community rules to reduce false alerts, test them against captured traffic, and forward alerts to a central security monitoring platform.

中文简介正在准备中。当前显示英语简介。

• Deploy intrusion detection at network boundaries
• Write rules for organization-specific threats
• Reduce noisy or false alerts

Configure Windows security logs for threat detection and incident investigation. Covers detailed audit policies, process command line recording, log storage sizing, and centralized forwarding so monitoring systems receive useful authentication and activity records.

中文简介正在准备中。当前显示英语简介。

• Record process launches with their command lines
• Monitor successful and failed sign-ins
• Forward Windows security events to a central monitoring system