[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M71C4SRC3PATN73JMQQD9E5S":3,"skill-same:01M71C4SRC3PATN73JMQQD9E5S":56},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":18,"publishedAt":24,"linkOnly":25,"markdownContent":26,"markdownBody":27,"frontMatter":28,"refName":29,"commitSha":30,"skillDirectory":31,"forksCount":14,"repositoryHtmlUrl":32,"repositoryHomepageUrl":6,"ownerHtmlUrl":33,"ownerBlogUrl":6,"ownerDescription":34,"updatedAt":35,"install":36,"resources":49},"01M71C4SRC3PATN73JMQQD9E5S","cloud-azure-defender",null,"Cloud Azure Defender.","DCx7C5\u002Fai-marketplace","DCx7C5","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F42419559?v=4","01M71C01G2AZV3NTNGWAWSHJPP","DC","01M71C01GQW6G50S2BYMS7PP3E",0,"MIT","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fcloud-azure-defender\u002FSKILL.md",[],[19,20,21,22,23],"defender","azure","cloud","cloud azure defender","cybersecurity","2026-11-10 10:12:30",false,"---\nname: cloud-azure-defender\ndescription: \"Cloud Azure Defender.\"\ndomain: cybersecurity\n---\n\n|\n| Microsoft Defender for Cloud | Azure-native security platform providing CSPM and cloud workload protection (CWP) across Azure, hybrid, and multi-cloud environments |\n| Secure Score | Numerical measure of an organization's security posture based on the percentage of security recommendations that have been implemented |\n| Security Recommendation | Actionable guidance from Defender for Cloud to improve security posture, prioritized by severity and secure score impact |\n| Defender Plan | Workload-specific protection tier (Servers, Containers, SQL, Storage, etc.) that enables advanced threat detection for specific resource types |\n| Just-In-Time VM Access | Feature that reduces attack surface by blocking management ports (SSH\u002FRDP) by default and granting time-limited access on request |\n| Adaptive Application Controls | Machine-learning-based allowlisting that recommends which applications should be allowed to run on VMs |\n\n## Tools & Systems\n\n- **Microsoft Defender for Cloud**: Central security platform with CSPM, CWP, and regulatory compliance capabilities\n- **Azure Policy**: Governance service used by Defender for Cloud to evaluate and enforce security configurations\n- **Log Analytics Workspace**: Backend data store for security telemetry collected by Defender agents\n- **Azure Logic Apps**: Workflow automation for incident response triggered by Defender alerts\n- **Azure Arc**: Extends Defender for Cloud protection to hybrid and multi-cloud servers and Kubernetes clusters\n\n## Common Scenarios\n\n### Scenario: Rolling Out Defender for Cloud Across a Multi-Subscription Enterprise\n\n**Context**: An enterprise with 20 Azure subscriptions needs to enable Defender for Cloud with server, container, and SQL protection while establishing a compliance baseline against CIS Azure 2.0.\n\n**Approach**:\n1. Enable the CSPM plan (CloudPosture) across all subscriptions using Azure Policy initiative\n2. Enable Defender for Servers P2, Containers, and SQL on production subscriptions\n3. Configure auto-provisioning to deploy Log Analytics agents to all VMs\n4. Enable CIS Azure 2.0 and PCI DSS 4.0 compliance standards\n5. Create security contacts and configure alert notifications to the SOC team\n6. Set up workflow automation for High severity alerts via Logic Apps\n7. Enable JIT VM access for all production servers to eliminate persistent SSH\u002FRDP exposure\n8. Create a weekly Secure Score report for executive stakeholders\n\n**Pitfalls**: Defender for Servers P2 costs per server per hour. For environments with many VMs, costs can escalate quickly. Use Defender for Servers P1 for development subscriptions and P2 only for production. Auto-provisioning of agents may conflict with existing agent deployments managed by SCCM or other tools.\n\n## Output Format\n\n```\nMicrosoft Defender for Cloud Deployment Report\n=================================================\nOrganization: Acme Corp\nSubscriptions: 20 (12 production, 8 non-production)\nDeployment Date: 2026-02-23\n\nDEFENDER PLANS ENABLED:\n  CloudPosture (CSPM):     20 \u002F 20 subscriptions\n  Servers P2:              12 \u002F 20 (production only)\n  Containers:              12 \u002F 20 (production only)\n  SQL:                     12 \u002F 20 (production only)\n  Storage:                 20 \u002F 20 all subscriptions\n  Key Vault:               20 \u002F 20 all subscriptions\n\nSECURE SCORE:\n  Current: 62% (baseline)\n  Target: 80% within 90 days\n\nCOMPLIANCE STATUS (CIS Azure 2.0):\n  Compliant controls:        78 \u002F 142 (55%)\n  Non-compliant controls:    52 \u002F 142\n  Not applicable:            12 \u002F 142\n\nRECOMMENDATIONS:\n  Critical:    8 recommendations affecting 34 resources\n  High:       24 recommendations affecting 89 resources\n  Medium:     56 recommendations affecting 234 resources\n  Low:        34 recommendations affecting 112 resources\n\nSECURITY ALERTS (Last 7 Days):\n  High severity:    3\n  Medium severity:  12\n  Low severity:     28\n```\n","|\n| Microsoft Defender for Cloud | Azure-native security platform providing CSPM and cloud workload protection (CWP) across Azure, hybrid, and multi-cloud environments |\n| Secure Score | Numerical measure of an organization's security posture based on the percentage of security recommendations that have been implemented |\n| Security Recommendation | Actionable guidance from Defender for Cloud to improve security posture, prioritized by severity and secure score impact |\n| Defender Plan | Workload-specific protection tier (Servers, Containers, SQL, Storage, etc.) that enables advanced threat detection for specific resource types |\n| Just-In-Time VM Access | Feature that reduces attack surface by blocking management ports (SSH\u002FRDP) by default and granting time-limited access on request |\n| Adaptive Application Controls | Machine-learning-based allowlisting that recommends which applications should be allowed to run on VMs |\n\n## Tools & Systems\n\n- **Microsoft Defender for Cloud**: Central security platform with CSPM, CWP, and regulatory compliance capabilities\n- **Azure Policy**: Governance service used by Defender for Cloud to evaluate and enforce security configurations\n- **Log Analytics Workspace**: Backend data store for security telemetry collected by Defender agents\n- **Azure Logic Apps**: Workflow automation for incident response triggered by Defender alerts\n- **Azure Arc**: Extends Defender for Cloud protection to hybrid and multi-cloud servers and Kubernetes clusters\n\n## Common Scenarios\n\n### Scenario: Rolling Out Defender for Cloud Across a Multi-Subscription Enterprise\n\n**Context**: An enterprise with 20 Azure subscriptions needs to enable Defender for Cloud with server, container, and SQL protection while establishing a compliance baseline against CIS Azure 2.0.\n\n**Approach**:\n1. Enable the CSPM plan (CloudPosture) across all subscriptions using Azure Policy initiative\n2. Enable Defender for Servers P2, Containers, and SQL on production subscriptions\n3. Configure auto-provisioning to deploy Log Analytics agents to all VMs\n4. Enable CIS Azure 2.0 and PCI DSS 4.0 compliance standards\n5. Create security contacts and configure alert notifications to the SOC team\n6. Set up workflow automation for High severity alerts via Logic Apps\n7. Enable JIT VM access for all production servers to eliminate persistent SSH\u002FRDP exposure\n8. Create a weekly Secure Score report for executive stakeholders\n\n**Pitfalls**: Defender for Servers P2 costs per server per hour. For environments with many VMs, costs can escalate quickly. Use Defender for Servers P1 for development subscriptions and P2 only for production. Auto-provisioning of agents may conflict with existing agent deployments managed by SCCM or other tools.\n\n## Output Format\n\n```\nMicrosoft Defender for Cloud Deployment Report\n=================================================\nOrganization: Acme Corp\nSubscriptions: 20 (12 production, 8 non-production)\nDeployment Date: 2026-02-23\n\nDEFENDER PLANS ENABLED:\n  CloudPosture (CSPM):     20 \u002F 20 subscriptions\n  Servers P2:              12 \u002F 20 (production only)\n  Containers:              12 \u002F 20 (production only)\n  SQL:                     12 \u002F 20 (production only)\n  Storage:                 20 \u002F 20 all subscriptions\n  Key Vault:               20 \u002F 20 all subscriptions\n\nSECURE SCORE:\n  Current: 62% (baseline)\n  Target: 80% within 90 days\n\nCOMPLIANCE STATUS (CIS Azure 2.0):\n  Compliant controls:        78 \u002F 142 (55%)\n  Non-compliant controls:    52 \u002F 142\n  Not applicable:            12 \u002F 142\n\nRECOMMENDATIONS:\n  Critical:    8 recommendations affecting 34 resources\n  High:       24 recommendations affecting 89 resources\n  Medium:     56 recommendations affecting 234 resources\n  Low:        34 recommendations affecting 112 resources\n\nSECURITY ALERTS (Last 7 Days):\n  High severity:    3\n  Medium severity:  12\n  Low severity:     28\n```\n",{"name":5,"domain":23,"description":7},"main","a91f1293287ffa9f4f1b8f486cd6e835a1568c84","skills\u002Fcloud-azure-defender","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace","https:\u002F\u002Fgithub.com\u002FDCx7C5","#Python","2026-09-01 11:21:00",{"source":8,"skillName":5,"commands":37,"prompt":47,"zipAvailable":48},[38,41,44],{"tool":39,"command":40},"npx","npx skills add DCx7C5\u002Fai-marketplace --skill cloud-azure-defender",{"tool":42,"command":43},"bunx","bunx skills add DCx7C5\u002Fai-marketplace --skill cloud-azure-defender",{"tool":45,"command":46},"pnpm","pnpm dlx skills add DCx7C5\u002Fai-marketplace --skill cloud-azure-defender","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fcloud-azure-defender\u002FSKILL.md",true,[50],{"path":51,"resourceType":52,"resourceTypeDesc":53,"sizeBytes":54,"sourceHtmlUrl":55},"index.json","REFERENCE","参考文档",480,"https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fcloud-azure-defender\u002Findex.json",[57,82,105,127,149,165],{"skillNo":58,"name":59,"nameZh":6,"description":60,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":61,"categories":62,"keywords":63,"publishedAt":24},"01M71HAPZ01KQ30RKTB0FFSQ05","services-wmi-persistence-detect","Detect WMI event subscription persistence by enumerating ActiveScriptEventConsumer, CommandLineEventConsumer, and permanent subscriptions in the WMI repository.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fservices\u002Fwmi\u002Fpersistence\u002Fdetect\u002FSKILL.md",[],[64,65,66,67,68,69,70,71,72,73,74,75,76,77,78,79,80,23,81],"services","detect","services wmi persistence detect","wmi","persistence","de","cm","process","activescript","event","subscriptions","commandline-consumer","repository","subscription","event-subscription","t1546.003","forensics","process-forensics",{"skillNo":83,"name":84,"nameZh":6,"description":85,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":86,"categories":87,"keywords":88,"publishedAt":24},"01M71HAK6JTTTS229T17WJMMCG","services-wmi-exec-exploit","Perform lateral movement across Windows networks using WMI-based remote execution techniques including Impacket wmiexec.py, CrackMapExec, and native WMI commands for stealthy post-exploitation during red team engagements.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fservices\u002Fwmi\u002Fexec\u002Fexploit\u002FSKILL.md",[],[89,64,90,67,91,92,93,23,94,95,96,97,98,99,69,100,101,102,103,104],"exploit","services wmi exec exploit","exec","remote","traffic","Bash","analysis","team","across","crackmapexec","native","command","lateral movement","read","lateral-movement","Impacket",{"skillNo":106,"name":107,"nameZh":6,"description":108,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":109,"categories":110,"keywords":111,"publishedAt":24},"01M71HAG6MHKNQV8KDZKMT4886","registry-artifact-extract","Extract and analyze Windows Registry hives to uncover user activity, installed software, autostart entries, and evidence of system compromise.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fregistry\u002Fartifact\u002Fextract\u002FSKILL.md",[],[112,113,114,115,116,117,23,94,118,95,119,120,69,102,121,122,123,124,125,126],"artifact","registry","registry artifact extract","extract","evidence-collection","artifact-analysis","collection","analyze","uncover","software","activity","digital-forensics","windows-registry","regripper","sonnet",{"skillNo":128,"name":129,"nameZh":6,"description":130,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":131,"categories":132,"keywords":133,"publishedAt":24},"01M71HACR4A8XTWTTSXK4124AA","processes-token-impersonate-detect","Detect Windows token impersonation and privilege abuse including SeImpersonatePrivilege exploitation via Potato attacks and token stealing techniques.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fprocesses\u002Ftoken\u002Fimpersonate\u002Fdetect\u002FSKILL.md",[],[65,134,135,136,137,138,139,70,140,23,81,141,142,143,144,145,146,147,148,69],"processes token impersonate detect","token","processes","attacks","windows","escalation","techniques","privilege-escalation","seimpersonate","token-impersonation","printspoofer","exploitation","potato","impersonation","via",{"skillNo":150,"name":151,"nameZh":6,"description":152,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":153,"categories":154,"keywords":155,"publishedAt":24},"01M71HAABSB4Z6QFSXEG00R4RK","processes-thread-injection-detect","Detect Windows thread injection techniques including CreateRemoteThread, QueueUserAPC, NtCreateThreadEx, and thread hijacking via process memory analysis.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fprocesses\u002Fthread\u002Finjection\u002Fdetect\u002FSKILL.md",[],[156,157,65,158,136,138,159,70,160,140,23,81,95,161,162,163,164,148,69,71],"thread","processes thread injection detect","injection","memory","process-injection","api","apc-injection","thread-injection","nt-api",{"skillNo":166,"name":167,"nameZh":6,"description":168,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":169,"categories":170,"keywords":171,"publishedAt":24},"01M71HA7H311V5G14WMX58HQSS","processes-hollow-technique-detect","Detect process hollowing (RunPE) by identifying processes with mismatched image paths between PEB and VAD tree, or unmapped PE headers in memory.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fprocesses\u002Fhollow\u002Ftechnique\u002Fdetect\u002FSKILL.md",[],[172,65,136,173,159,70,174,175,23,81,176,177,178,179,180,181,69,71,182,183],"processes hollow technique detect","tree","memory-forensics","process-hollow","peb","runpe","image","pe-header","in memory","with","mismatched","headers"]