Mahipal

Deploy a Software-Defined Perimeter that connects verified users to authorized applications. Configure single-packet authorization, mutual certificate authentication, access policies, and monitoring, then test whether unauthorized connections and access between applications are blocked.

中文简介正在准备中。当前显示英语简介。

• Building zero trust access to internal applications
• Hiding services from unauthenticated network scans
• Testing certificate authentication and access restrictions

Set up Cisco Duo multi-factor authentication for VPN, RDP, SSH, and web applications. Configure access rules based on users and device health, introduce security keys, and establish authentication monitoring and emergency access procedures.

中文简介正在准备中。当前显示英语简介。

• Adding Duo authentication to VPN and remote server access
• Strengthening authentication for privileged accounts
• Restricting access based on device health

Assess whether stolen Kerberos tickets, credentials used for network authentication, can enable access to other systems during authorized testing. Guide ticket extraction and reuse, review detection indicators, and document evidence for security reports.

中文简介正在准备中。当前显示英语简介。

• Authorized testing of access through reused tickets
• Checking detection of Kerberos ticket theft
• Collecting evidence for lateral movement reports

Set up encrypted connections between devices with Tailscale and control access by user or device. The skill covers network routing, device name resolution, and self-hosting the coordination server with Headscale.

中文简介正在准备中。当前显示英语简介。

• Replacing a traditional VPN with Tailscale
• Restricting server access by team or device
• Connecting remotely to internal networks

Set up host-based intrusion detection to monitor changes on Windows and Linux endpoints. Configure Wazuh agents, file integrity checks, registry monitoring, alert rules, and automated responses, with guidance on exclusions and centralized security monitoring.

中文简介正在准备中。当前显示英语简介。

• Deploying Wazuh agents on Windows and Linux
• Monitoring critical files and registry changes
• Planning change detection for compliance requirements

Deploy and configure Snort 3 to detect suspicious network traffic. Create custom detection rules, tune community rules to reduce false alerts, test them against captured traffic, and forward alerts to a central security monitoring platform.

中文简介正在准备中。当前显示英语简介。

• Deploy intrusion detection at network boundaries
• Write rules for organization-specific threats
• Reduce noisy or false alerts

Build a shared incident timeline in Timesketch from endpoint, server, and cloud logs. Search events, add tags and investigator notes, reconstruct the attack sequence, and organize findings into a story for incident reporting.

中文简介正在准备中。当前显示英语简介。

• Reconstructing the sequence of an incident
• Reviewing evidence with multiple analysts
• Combining Plaso output and other logs

Build Splunk pipelines that import threat intelligence and match security events against indicators such as malicious IP addresses, domains, and file hashes. Add source, confidence, and severity details so analysts have context when investigating matches.

中文简介正在准备中。当前显示英语简介。

• Importing external threat feeds into Splunk
• Matching network and endpoint logs against threat indicators
• Adding threat and asset context to alerts

Assess forced authentication and NTLM relay, the forwarding of authentication to another service, in authorized Windows environments. Use Coercer and PetitPotam to document exposed methods and check detection coverage, signing requirements, and Extended Protection for Authentication safeguards.

中文简介正在准备中。当前显示英语简介。

• Assessing exposed forced authentication methods
• Validating NTLM relay risks in authorized environments
• Generating activity to tune security detections

Turn threat intelligence and detection gaps into testable investigation hypotheses. Use endpoint monitoring and security log queries to examine evidence, validate findings, connect related activity, and document risks and recommended actions in a consistent hunt report.

中文简介正在准备中。当前显示英语简介。

• Planning a hunt based on threat intelligence
• Investigating gaps in ATT&CK coverage
• Testing hypotheses prompted by unusual activity

Build a ransomware response playbook for security monitoring teams, covering detection, containment, eradication, and recovery. Include log queries, decision trees, evidence collection, backup restoration, and incident reviews to prepare consistent procedures before an attack occurs.

中文简介正在准备中。当前显示英语简介。

• Creating a standardized ransomware response playbook
• Documenting host isolation and recovery procedures
• Addressing coordination gaps found in tabletop exercises

Build automated pipelines that collect threat indicators, such as malicious IP addresses and file hashes, from multiple feeds. Standardize formats, remove duplicates, assess confidence, and distribute indicators to security monitoring systems for matching and alerts.

中文简介正在准备中。当前显示英语简介。

• Automating threat feed ingestion
• Standardizing and deduplicating threat indicators
• Distributing indicators to multiple monitoring systems

Plan and run authorized security exercises that simulate an attacker's actions, from reconnaissance to activities after entry. Map techniques to MITRE ATT&CK, a framework of attack behaviors, and report detection gaps and response performance.

中文简介正在准备中。当前显示英语简介。

• Planning the scope and objectives of a red team exercise
• Designing scenarios based on a specific threat actor
• Measuring detection and response during an exercise

Set up Havoc infrastructure for authorized attack simulations, including its command server, traffic listeners, Nginx relay servers, and Windows agents. The skill also covers communication profiles and operational precautions for running the infrastructure.

中文简介正在准备中。当前显示英语简介。

• Preparing Havoc infrastructure for an authorized exercise
• Reviewing server and traffic relay separation
• Configuring communication profiles for an exercise

Set up an email reporting button and an automated security response workflow. Classify reported messages, extract attack indicators, remove confirmed phishing emails, and send feedback to the people who reported them.

中文简介正在准备中。当前显示英语简介。

• Deploying a phishing reporting button in Outlook
• Automating triage of a dedicated reporting mailbox
• Retracting confirmed phishing emails across inboxes

Analyze existing user permissions to propose roles for role-based access control, which assigns permissions by job role. Compare candidate role sets, identify overlap and excess access, and validate definitions against business responsibilities.

中文简介正在准备中。当前显示英语简介。

• Consolidating overlapping access roles
• Redesigning roles from existing permission data
• Reviewing excess and unusual permissions

Build a central platform for collecting, analyzing, and sharing cyber threat information. Connect MISP, OpenCTI, TheHive, and Cortex to import feeds, add context to suspicious indicators, manage cases, and track platform activity.

中文简介正在准备中。当前显示英语简介。

• Build a central threat intelligence platform
• Automate threat feed ingestion
• Add context to suspicious IP addresses and domains

Build a GitLab CI/CD pipeline with automated checks for vulnerable code, dependencies, container images, running applications, and exposed secrets. Covers scanner configuration, consolidated findings, and approval policies for serious vulnerabilities before production deployment.

中文简介正在准备中。当前显示英语简介。

• Add automated security scans to .gitlab-ci.yml
• Check dependencies and container images for known vulnerabilities
• Detect credentials and API keys committed to source control

Build dashboards and reports for security operations teams using incident and alert data. Track detection and resolution times, false alarms, analyst workload, and detection coverage to assess operational trends and the effects of improvement initiatives.

中文简介正在准备中。当前显示英语简介。

• Preparing monthly or quarterly security operations reports
• Reviewing analyst workload and shift staffing
• Comparing performance before and after tool adoption

Plan and conduct authorized security tests of AWS, Azure, and GCP environments. Check access permissions, credential exposure, cross-account access, and monitoring, then organize findings into a report with severity, business impact, and remediation guidance.

中文简介正在准备中。当前显示英语简介。

• Assessing cloud security before production deployment
• Checking access controls after a cloud migration
• Testing monitoring and incident response readiness

Map Active Directory permissions, group memberships, and user sessions with BloodHound CE. Reveal paths from ordinary accounts to administrator privileges, prioritize findings, and document evidence for authorized assessments or checks after security hardening.

中文简介正在准备中。当前显示英语简介。

• Find paths from ordinary accounts to Domain Admin
• Review access permissions and group relationships
• Verify that hardening closed known attack paths

Configure SAML identity federation, a way to share authentication between systems, linking on-premises Active Directory with Microsoft Entra ID. Cover single sign-on for cloud applications, user attribute mapping, authentication model choices, and signing certificate management.

中文简介正在准备中。当前显示英语简介。

• Extending on-premises authentication to cloud resources
• Comparing authentication models for hybrid identity
• Setting up SAML single sign-on for SaaS applications

Build incident response dashboards that bring affected systems, containment progress, indicators of compromise, and response timelines into one view. Help security teams coordinate active incidents and prepare operational reports and executive briefings.

中文简介正在准备中。当前显示英语简介。

• Coordinating an active security incident
• Tracking affected systems and containment
• Reviewing response timelines after an incident

Respond to security incidents across AWS, Azure, and GCP by investigating audit logs, containing compromised identities, isolating resources, and preserving evidence. Organize recovery and follow-up security measures for credential leaks, unauthorized permission changes, and attacks spanning cloud services.

中文简介正在准备中。当前显示英语简介。

• Responding to leaked cloud credentials
• Investigating unauthorized permission or resource changes
• Preserving audit logs and disk snapshots