“cybersecurity”的搜索结果

Analyze Windows authentication logs for repeated password guesses against Remote Desktop services. Group failures by source IP and account, check for later successful logins, and produce a JSON report highlighting attack patterns and possible compromise.

中文简介正在准备中。当前显示英语简介。

• Investigate repeated login failures on exposed RDP services
• Identify accounts targeted by password guessing
• Check for successful logins after repeated failures

Investigate suspicious mobile apps by examining permissions, network traffic, and runtime behavior. Use observed evidence to identify signs of data theft, SMS interception, credential stealing, or communication with attacker control servers, then classify the suspected malware.

中文简介正在准备中。当前显示英语简介。

• Triaging suspicious APK or IPA samples
• Investigating possible data leaks from mobile apps
• Checking for SMS interception and credential theft

Investigate signs of Mimikatz credential theft using command lines, access to Windows authentication memory, file indicators, and known modules in memory. Correlate endpoint and security logs to assess suspicious alerts, document evidence, and recommend response actions.

中文简介正在准备中。当前显示英语简介。

• Investigating alerts about Windows authentication memory access
• Hunting for signs of credential theft
• Assessing compromise scope during incident response

Inspect npm packages and dependency files for malicious installation scripts, credential theft, and self-spreading behavior. Use GuardDog scanning, source inspection, known-malicious version checks, and isolated execution to produce an evidence-based assessment.

中文简介正在准备中。当前显示英语简介。

• Vetting a new npm dependency before adoption
• Reviewing dependency files during code review
• Checking lockfiles against known-malicious versions

Build real-time detection for ransomware encryption by combining changes in data randomness with file modification rates, renames, and process activity. Define behavioral scores and response thresholds, then check detection accuracy and monitoring overhead.

中文简介正在准备中。当前显示英语简介。

• Building ransomware monitoring for endpoints and file servers
• Tuning detection thresholds to reduce false positives
• Investigating processes suspected of encrypting files

Monitor requests to an AI prediction API for signs of model copying or training-data exposure. Test an authorized model with simulated attacks, measure the risk, and evaluate defenses such as request limits and reduced prediction detail.

中文简介正在准备中。当前显示英语简介。

• Monitoring a public or partner prediction API
• Measuring model copying risk before deployment
• Testing request limits and reduced prediction detail

Investigate Pass-the-Hash attacks, where stolen password hashes are reused for authentication. Examine unusual NTLM logins alongside credential theft indicators, validate suspicious findings across security logs, and document evidence, affected hosts, confidence, and recommended responses.

中文简介正在准备中。当前显示英语简介。

• Hunting for movement using stolen password hashes
• Triaging suspicious NTLM login alerts
• Assessing the scope of a compromise

Detect attacks that misuse legitimate Windows utilities such as certutil and mshta. Analyze process logs, command arguments, and parent-child relationships with Sigma detection rules, then report suspicious events with severity scores and supporting event details.

中文简介正在准备中。当前显示英语简介。

• Investigating suspicious use of built-in Windows utilities
• Creating Sigma rules for unusual command arguments
• Finding Office apps that launch unexpected system utilities

Set up Zeek to observe network traffic and produce structured logs for security analysis. Create custom detection scripts, investigate suspicious DNS activity and repeated external connections, and forward logs to a central security monitoring system.

中文简介正在准备中。当前显示英语简介。

• Set up passive monitoring at key network points
• Create detection scripts for suspicious DNS and repeated connections
• Forward Zeek logs to a central security monitoring system

Find WMI event subscriptions that let attackers retain access to Windows systems. Correlate Sysmon events with stored subscriptions and Autoruns results, inspect execution triggers and commands, and document risks and recommended remediation.

中文简介正在准备中。当前显示英语简介。

• Triaging Sysmon alerts for events 19, 20, and 21
• Finding WMI persistence during incident response
• Distinguishing suspicious subscriptions from legitimate settings

Audit GitHub Actions workflows and CI/CD configurations for supply chain risks. Use Python and YAML parsing to identify unpinned actions, unsafe event expressions, excessive permissions, dependency confusion, and potential exposure of secrets in build pipelines.

中文简介正在准备中。当前显示英语简介。

• Reviewing GitHub Actions workflow security
• Checking action version pinning
• Finding unsafe event expressions in scripts

Investigate suspicious privilege increases, including Windows UAC approval bypasses and Linux sudo or setuid abuse. Use registry changes, process relationships, and permission changes to identify possible abuse and document affected hosts, methods, and risk levels.

中文简介正在准备中。当前显示英语简介。

• Investigating Windows UAC bypass activity
• Tracing how administrative access was obtained
• Monitoring Linux sudo and setuid abuse

Assess an authorized Active Directory environment by simulating attacks against credentials, permissions, and trust relationships. Use BloodHound and related testing tools to identify paths to administrator access, evaluate detection capabilities, and document findings with remediation recommendations.

中文简介正在准备中。当前显示英语简介。

• Assessing Active Directory security with written authorization
• Finding paths from ordinary users to administrator access
• Reviewing Kerberos and delegation settings

Analyze proxy, DNS, and firewall traffic logs to uncover unapproved SaaS and cloud services. Group usage by domain, compare it with approved applications, and produce a report with traffic volumes, user counts, risk scores, and remediation recommendations.

中文简介正在准备中。当前显示英语简介。

• Finding unapproved SaaS and cloud services
• Measuring traffic volumes and users by service
• Prioritizing services by potential data leakage risk

Detect attacks that misuse legitimate Windows tools by examining command arguments, parent and child processes, and network connections. Create Sysmon logging configurations and Sigma detection rules, analyze endpoint logs, and review application controls while accounting for legitimate usage.

中文简介正在准备中。当前显示英语简介。

• Creating detection rules for misuse of Windows tools
• Investigating unusual process chains in alerts
• Hunting for fileless attacks in endpoint logs

Investigate NTLM relay, an attack that forwards authentication messages to another service, by comparing Windows login events with host inventories. Use the supplied queries and audits to identify suspicious sources, weaker authentication, and gaps in signing enforcement.

中文简介正在准备中。当前显示英语简介。

• Investigating mismatched login source addresses and hostnames
• Building SIEM rules to detect NTLM relay
• Auditing SMB and LDAP signing requirements

Develop network monitoring for signs that may precede ransomware encryption. Uses detection rules, linked log events, and threat intelligence to identify suspicious activity and define how alerts should be investigated, prioritized, and escalated.

中文简介正在准备中。当前显示英语简介。

• Creating detection rules for activity before ransomware encryption
• Linking suspicious logins, scans, and file share access
• Investigating unusual internal network communications

Find undocumented API endpoints, the addresses applications send requests to, by comparing traffic with OpenAPI specifications and examining cloud settings and source code. Build an inventory with activity and risk details to review forgotten or outdated APIs.

中文简介正在准备中。当前显示英语简介。

• Finding API endpoints missing from documentation
• Auditing forgotten test APIs and outdated versions
• Prioritizing undocumented APIs for security review

Create rules for Suricata and Snort, systems that detect suspicious network traffic, to flag port scans and reconnaissance. Combine packet patterns with connection counts, tune alert volume, and summarize scanning sources, targets, and activity.

中文简介正在准备中。当前显示英语简介。

• Create rules to detect Nmap and Masscan activity
• Monitor scanning within an internal network
• Tune alerts for authorized vulnerability scanners

Investigate phishing emails that hide malicious links in QR codes. Decode destinations, analyze suspicious URLs, configure email detection rules, and plan mobile protections and awareness training for people who scan codes on their phones.

中文简介正在准备中。当前显示英语简介。

• Investigating suspicious emails containing QR codes
• Configuring QR detection for email images and PDF attachments
• Protecting phones from malicious QR destinations

Find npm and PyPI packages that imitate trusted package names to exploit typing mistakes. Compare spelling similarity, publication dates, downloads, and maintainer details, then rank suspicious candidates and produce reports or blocklists for further review.

中文简介正在准备中。当前显示英语简介。

• Auditing project dependencies for misleading package names
• Monitoring names similar to important packages
• Investigating a suspected misspelled package installation

Configure Fail2ban to detect port scans, repeated SSH login attempts, and suspicious web requests from server logs. Create custom detection patterns, automatically block source IP addresses, and set up notifications and longer bans for repeat offenders.

中文简介正在准备中。当前显示英语简介。

• Automatically blocking port scans against public servers
• Defending SSH against repeated login attempts
• Detecting suspicious paths in Nginx access logs

Investigate excessive privileges inside Kubernetes pods by reviewing security settings, runtime events, and audit logs. Use admission policies to restrict risky configurations and Falco monitoring to detect suspicious privilege changes and container activity.

中文简介正在准备中。当前显示英语简介。

• Finding pods running as root or in privileged mode
• Reviewing host filesystem access and dangerous Linux permissions
• Detecting privilege changes while containers are running

Analyze Sysmon logs to investigate process injection, where malicious code hides inside legitimate processes. Correlate remote thread creation, cross-process access, and unusual DLL loading, then organize findings by injection type, risk level, and ATT&CK technique.

中文简介正在准备中。当前显示英语简介。

• Investigating EDR alerts about suspicious cross-process access
• Hunting for malicious code hidden inside legitimate processes
• Checking Sysmon coverage for process injection detection