“detection”的搜索结果

Investigate phishing emails that hide malicious links in QR codes. Decode destinations, analyze suspicious URLs, configure email detection rules, and plan mobile protections and awareness training for people who scan codes on their phones.

中文简介正在准备中。当前显示英语简介。

• Investigating suspicious emails containing QR codes
• Configuring QR detection for email images and PDF attachments
• Protecting phones from malicious QR destinations

Build detection rules for suspicious Windows scheduled tasks by correlating Sysmon and Windows Security logs. Examine parent processes, file paths, encoded commands, and remote task creation to uncover persistent access and movement between systems.

中文简介正在准备中。当前显示英语简介。

• Investigating suspicious scheduled task creation
• Hunting for tasks that run encoded commands
• Detecting remote task creation across systems

Set up Zeek to observe network traffic and produce structured logs for security analysis. Create custom detection scripts, investigate suspicious DNS activity and repeated external connections, and forward logs to a central security monitoring system.

中文简介正在准备中。当前显示英语简介。

• Set up passive monitoring at key network points
• Create detection scripts for suspicious DNS and repeated connections
• Forward Zeek logs to a central security monitoring system

Monitor Modbus traffic in industrial control networks to identify unauthorized writes, unusual commands, and departures from normal communication. Use packet analysis and intrusion detection rules to investigate suspected controller changes and produce reports with recommended actions.

中文简介正在准备中。当前显示英语简介。

• Investigating unauthorized changes to PLC registers
• Setting up Modbus intrusion detection rules
• Checking communication patterns after a suspected compromise

Assess serverless functions, primarily AWS Lambda, for unsafe execution of external input and unauthorized changes to code or added libraries. Combine source inspection, activity logs, and permission reviews to identify injection risks and recommend detection and prevention measures.

中文简介正在准备中。当前显示英语简介。

• Reviewing Lambda event handlers for injection vulnerabilities
• Investigating unauthorized function or layer changes
• Checking privilege escalation through Lambda execution roles

Investigate attempts to gain higher privileges on Windows and Linux using endpoint and security logs. Guide hypothesis testing, evidence analysis, false-positive checks, and reporting to help assess suspicious privilege changes and the scope of a compromise.

中文简介正在准备中。当前显示英语简介。

• Hunting for signs of privilege escalation
• Investigating alerts about suspicious privilege changes
• Assessing compromise scope during incident response

Investigate Pass-the-Hash attacks, where stolen password hashes are reused for authentication. Examine unusual NTLM logins alongside credential theft indicators, validate suspicious findings across security logs, and document evidence, affected hosts, confidence, and recommended responses.

中文简介正在准备中。当前显示英语简介。

• Hunting for movement using stolen password hashes
• Triaging suspicious NTLM login alerts
• Assessing the scope of a compromise

Create rules for Suricata and Snort, systems that detect suspicious network traffic, to flag port scans and reconnaissance. Combine packet patterns with connection counts, tune alert volume, and summarize scanning sources, targets, and activity.

中文简介正在准备中。当前显示英语简介。

• Create rules to detect Nmap and Masscan activity
• Monitor scanning within an internal network
• Tune alerts for authorized vulnerability scanners

Analyze Sysmon logs to investigate process injection, where malicious code hides inside legitimate processes. Correlate remote thread creation, cross-process access, and unusual DLL loading, then organize findings by injection type, risk level, and ATT&CK technique.

中文简介正在准备中。当前显示英语简介。

• Investigating EDR alerts about suspicious cross-process access
• Hunting for malicious code hidden inside legitimate processes
• Checking Sysmon coverage for process injection detection

Identify runtime signs of attackers breaking out of Docker or Kubernetes containers. Review namespace changes, privilege abuse, sensitive host access, and unusual system calls to guide incident investigations and compare monitoring coverage across security tools.

中文简介正在准备中。当前显示英语简介。

• Investigating a suspected Docker or Kubernetes container escape
• Choosing runtime behaviors to monitor for escape attempts
• Comparing escape detection coverage across security sensors

Investigate Windows malware that runs in memory or abuses legitimate system tools. Use logs, registry entries, and memory dumps to trace persistence, identify suspicious activity, and produce detection rules and an analysis report.

中文简介正在准备中。当前显示英语简介。

• Investigating suspicious PowerShell activity
• Checking WMI persistence mechanisms
• Finding malicious code in memory dumps

Create detection rules and investigation queries from API access logs to flag repeated identifier probing and unusual authorization responses. Helps investigate attempts to access other users’ data and review logging and rate limits.

中文简介正在准备中。当前显示英语简介。

• Investigating suspected unauthorized API data access
• Creating detection rules for repeated identifier probing
• Reviewing API logging and rate limits

Investigate Entra ID reconnaissance by searching Graph API logs for tool signatures and unusual directory queries. Use KQL, a log query language, to correlate suspicious requests with sign-ins and turn useful searches into Sentinel detection rules.

中文简介正在准备中。当前显示英语简介。

• Investigating Graph API activity after suspected credential theft
• Checking whether offensive tool activity is visible in logs
• Creating and tuning scheduled Sentinel detection rules

Examine recorded calls and voicemails for signs of AI-generated speech. Extract acoustic features, classify samples with machine learning, and prepare reports with confidence scores and sound visualizations to support voice impersonation investigations.

中文简介正在准备中。当前显示英语简介。

• Investigating calls impersonating executives
• Checking suspicious voicemails
• Comparing suspect recordings with genuine voice samples

Analyze AWS CloudTrail logs against normal activity patterns to spot unusual API calls, IP addresses, errors, and sensitive changes. Produce a JSON report with anomaly scores, suspicious users, and suggested investigation steps.

中文简介正在准备中。当前显示英语简介。

• Investigating possible misuse of AWS credentials
• Finding first-time API calls and unusual IP activity
• Reviewing IAM, KMS, and S3 policy changes

Deploy and operate Falco to monitor running containers in Kubernetes or Docker. Choose a driver, validate detection rules, confirm alerts for suspicious activity, and forward those alerts to a central security monitoring system.

中文简介正在准备中。当前显示英语简介。

• Installing Falco on a Kubernetes cluster
• Choosing a driver for the Linux environment
• Checking alerts for suspicious container activity

Investigate business email compromise, where impersonated executives or vendors request payments or sensitive data. Check sender details, unusual communication patterns, mailbox changes, and payment approval procedures to develop detection rules and verification controls.

中文简介正在准备中。当前显示英语简介。

• Investigating emails impersonating executives or vendors
• Reviewing requests to change vendor bank details
• Building detection rules for fraudulent payment requests

Set up AI email screening that compares writing style and communication habits to identify impersonation and suspicious payment requests. Connect detection policies to quarantine, warning banners, and analyst review workflows.

中文简介正在准备中。当前显示英语简介。

• Detecting executive impersonation in emails
• Reviewing vendor payment change requests
• Flagging unusual employee email behavior

Set up and operate Amazon GuardDuty to detect threats in AWS. Configure protection features, centralize findings across accounts, investigate suspicious activity, and build automated responses with EventBridge and Lambda, including containment of potentially compromised resources.

中文简介正在准备中。当前显示英语简介。

• Setting up threat detection for AWS accounts
• Investigating credential abuse and compromised instances
• Automating responses to high-severity findings

Deploy decoy files and monitor changes, renames, and deletions for early signs of ransomware. This skill guides Python monitoring, email, Slack, and syslog alerts, plus simulated file operations to verify that the detection and notification pipeline works.

中文简介正在准备中。当前显示英语简介。

• Monitoring shared drives and NAS for suspicious file changes
• Adding decoy file monitoring alongside endpoint protection
• Testing incident response with decoy file triggers

Simulate man-in-the-middle attacks, where traffic is intercepted between communicating systems, in authorized environments. Use Bettercap, Ettercap, and mitmproxy to test encryption enforcement, certificate validation, and network detection, then document findings and recommendations.

中文简介正在准备中。当前显示英语简介。

• Testing HTTPS enforcement and certificate validation
• Checking detection of network spoofing
• Demonstrating the risks of unencrypted traffic

Deploy Suricata to detect suspicious network traffic or block it inline. Configure protocol inspection, detection rules, and structured EVE JSON logs, then connect logs to analysis platforms and check packet drops and alert quality during operation.

中文简介正在准备中。当前显示英语简介。

• Deploying network intrusion monitoring
• Configuring inline blocking of malicious traffic
• Adding custom detection rules and reducing noisy alerts

Assess whether stolen Kerberos tickets, credentials used for network authentication, can enable access to other systems during authorized testing. Guide ticket extraction and reuse, review detection indicators, and document evidence for security reports.

中文简介正在准备中。当前显示英语简介。

• Authorized testing of access through reused tickets
• Checking detection of Kerberos ticket theft
• Collecting evidence for lateral movement reports

Support authorized Active Directory assessments of DCSync, which abuses directory replication rights to obtain credential data. Cover replication permission review, Golden Ticket persistence testing, detection validation, and documentation of evidence and remediation recommendations.

中文简介正在准备中。当前显示英语简介。

• Reviewing accounts with directory replication rights
• Testing DCSync risks in an authorized lab
• Validating detection of replication abuse and forged tickets