[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M71C5FPCYQVTP1M2X5AJZN1C":3,"skill-same:01M71C5FPCYQVTP1M2X5AJZN1C":62},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":23,"publishedAt":30,"linkOnly":31,"markdownContent":32,"markdownBody":33,"frontMatter":34,"refName":35,"commitSha":36,"skillDirectory":37,"forksCount":14,"repositoryHtmlUrl":38,"repositoryHomepageUrl":6,"ownerHtmlUrl":39,"ownerBlogUrl":6,"ownerDescription":40,"updatedAt":41,"install":42,"resources":55},"01M71C5FPCYQVTP1M2X5AJZN1C","cloud-containers-docker-dockertrivy",null,"Cloud Containers Docker Dockertrivy.","DCx7C5\u002Fai-marketplace","DCx7C5","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F42419559?v=4","01M71C01G2AZV3NTNGWAWSHJPP","DC","01M71C01GQW6G50S2BYMS7PP3E",0,"MIT","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fcloud-containers-docker-dockertrivy\u002FSKILL.md",[18],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000011","运维与部署","SCENARIO","使用场景",[24,25,26,27,28,29],"containers","docker","cloud containers docker dockertrivy","cloud","cloud containers","cybersecurity","2026-11-10 10:12:30",false,"---\nname: cloud-containers-docker-dockertrivy\ndescription: \"Cloud Containers Docker Dockertrivy.\"\ndomain: cybersecurity\n---\n\n|\n| Vulnerability | `--scanners vuln` | CVEs in OS packages and libraries |\n| Misconfiguration | `--scanners misconfig` | Dockerfile\u002FK8s manifest misconfigs |\n| Secret | `--scanners secret` | Hardcoded passwords, API keys, tokens |\n| License | `--scanners license` | Software license compliance issues |\n\n### Severity Levels\n\n- **CRITICAL**: CVSS 9.0-10.0 - Immediate action required\n- **HIGH**: CVSS 7.0-8.9 - Fix before production deployment\n- **MEDIUM**: CVSS 4.0-6.9 - Plan remediation\n- **LOW**: CVSS 0.1-3.9 - Accept or fix opportunistically\n- **UNKNOWN**: Unscored - Evaluate manually\n\n### Vulnerability Database\n\nTrivy uses multiple vulnerability databases:\n- NVD (National Vulnerability Database)\n- Red Hat Security Data\n- Alpine SecDB\n- Debian Security Tracker\n- Ubuntu CVE Tracker\n- Amazon Linux Security Center\n- GitHub Advisory Database\n\n## Workflow\n\n### Step 1: Install Trivy\n\n```bash\n# Linux (apt)\nsudo apt-get install wget apt-transport-https gnupg lsb-release\nwget -qO - https:\u002F\u002Faquasecurity.github.io\u002Ftrivy-repo\u002Fdeb\u002Fpublic.key | gpg --dearmor | sudo tee \u002Fusr\u002Fshare\u002Fkeyrings\u002Ftrivy.gpg > \u002Fdev\u002Fnull\necho \"deb [signed-by=\u002Fusr\u002Fshare\u002Fkeyrings\u002Ftrivy.gpg] https:\u002F\u002Faquasecurity.github.io\u002Ftrivy-repo\u002Fdeb $(lsb_release -sc) main\" | sudo tee -a \u002Fetc\u002Fapt\u002Fsources.list.d\u002Ftrivy.list\nsudo apt-get update && sudo apt-get install trivy\n\n# macOS\nbrew install trivy\n\n# Docker\ndocker pull aquasecurity\u002Ftrivy:latest\n```\n\n### Step 2: Basic Image Scanning\n\n```bash\n# Scan a public image\ntrivy image python:3.12-slim\n\n# Scan with severity filter\ntrivy image --severity CRITICAL,HIGH nginx:latest\n\n# Ignore unfixed vulnerabilities\ntrivy image --ignore-unfixed alpine:3.19\n\n# Scan local image\ndocker build -t myapp:latest .\ntrivy image myapp:latest\n\n# Scan from tar archive\ndocker save myapp:latest -o myapp.tar\ntrivy image --input myapp.tar\n```\n\n### Step 3: Advanced Scanning Options\n\n```bash\n# All scanners (vuln + misconfig + secret + license)\ntrivy image --scanners vuln,misconfig,secret,license myapp:latest\n\n# Generate SBOM in CycloneDX format\ntrivy image --format cyclonedx --output sbom.cdx.json myapp:latest\n\n# Generate SBOM in SPDX format\ntrivy image --format spdx-json --output sbom.spdx.json myapp:latest\n\n# JSON output for programmatic processing\ntrivy image --format json --output results.json myapp:latest\n\n# SARIF output for GitHub Security tab\ntrivy image --format sarif --output results.sarif myapp:latest\n\n# Template-based output\ntrivy image --format template --template \"@contrib\u002Fhtml.tpl\" --output report.html myapp:latest\n\n# Scan specific layers only\ntrivy image --list-all-pkgs myapp:latest\n```\n\n### Step 4: Scanning Kubernetes Manifests\n\n```bash\n# Scan Dockerfile for misconfigurations\ntrivy config Dockerfile\n\n# Scan Kubernetes manifests\ntrivy config k8s-deployment.yaml\n\n# Scan Helm charts\ntrivy config .\u002Fhelm-chart\u002F\n\n# Scan Terraform files\ntrivy config .\u002Fterraform\u002F\n```\n\n### Step 5: CI\u002FCD Integration\n\n```yaml\n# GitHub Actions\non: push\n\njobs:\n  scan:\n    runs-on: ubuntu-latest\n    steps:\n      - uses: actions\u002Fcheckout@v4\n\n      - name: Build image\n        run: docker build -t myapp:${{ github.sha }} .\n\n      - name: Run Trivy vulnerability scanner\n        uses: aquasecurity\u002Ftrivy-action@master\n        with:\n          image-ref: myapp:${{ github.sha }}\n          format: sarif\n          output: trivy-results.sarif\n          severity: CRITICAL,HIGH\n          exit-code: 1\n\n      - name: Upload Trivy scan results\n        uses: github\u002Fcodeql-action\u002Fupload-sarif@v3\n        if: always()\n        with:\n          sarif_file: trivy-results.sarif\n\n      - name: Generate SBOM\n        uses: aquasecurity\u002Ftrivy-action@master\n        with:\n          image-ref: myapp:${{ github.sha }}\n          format: cyclonedx\n          output: sbom.cdx.json\n```\n\n```yaml\n# GitLab CI\ntrivy-scan:\n  stage: security\n  image:\n    name: aquasecurity\u002Ftrivy:latest\n    entrypoint: [\"\"]\n  script:\n    - trivy image --exit-code 1 --severity CRITICAL,HIGH\n        --format json --output gl-container-scanning-report.json\n        $CI_REGISTRY_IMAGE:$CI_COMMIT_SHA\n  artifacts:\n    reports:\n      container_scanning: gl-container-scanning-report.json\n```\n\n### Step 6: Policy Enforcement with .trivyignore\n\n```bash\n# .trivyignore - Ignore specific CVEs with expiry\n# Accepted risk: low-impact vulnerability in dev dependency\nCVE-2023-12345 exp:2025-06-01\n\n# False positive: not exploitable in our configuration\nCVE-2024-67890\n\n# Vendor will not fix\nCVE-2023-11111\n```\n\n### Step 7: Scan Private Registry Images\n\n```bash\n# Docker Hub (uses ~\u002F.docker\u002Fconfig.json)\ntrivy image myregistry.azurecr.io\u002Fmyapp:latest\n\n# ECR\naws ecr get-login-password --region us-east-1 | docker login --username AWS --password-stdin \u003Caccount>.dkr.ecr.us-east-1.amazonaws.com\ntrivy image \u003Caccount>.dkr.ecr.us-east-1.amazonaws.com\u002Fmyapp:latest\n\n# GCR\ntrivy image gcr.io\u002Fmy-project\u002Fmyapp:latest\n\n# With explicit credentials\nTRIVY_USERNAME=user TRIVY_PASSWORD=pass trivy image registry.example.com\u002Fmyapp:latest\n```\n\n## Validation Commands\n\n```bash\n# Verify Trivy installation\ntrivy version\n\n# Update vulnerability database\ntrivy image --download-db-only\n\n# Quick scan with table output\ntrivy image --severity CRITICAL python:3.12\n\n# Verify no CRITICAL vulnerabilities\ntrivy image --exit-code 1 --severity CRITICAL myapp:latest\necho \"Exit code: $?\"  # 0 = no vulns, 1 = vulns found\n```\n\n## References\n\n- [Trivy Documentation](https:\u002F\u002Ftrivy.dev\u002Fdocs\u002F)\n- [Trivy GitHub Repository](https:\u002F\u002Fgithub.com\u002Faquasecurity\u002Ftrivy)\n- [Trivy GitHub Action](https:\u002F\u002Fgithub.com\u002Faquasecurity\u002Ftrivy-action)\n- [Aqua Security - Trivy Scanner Guide](https:\u002F\u002Fwww.aquasec.com\u002Fproducts\u002Ftrivy\u002F)\n","|\n| Vulnerability | `--scanners vuln` | CVEs in OS packages and libraries |\n| Misconfiguration | `--scanners misconfig` | Dockerfile\u002FK8s manifest misconfigs |\n| Secret | `--scanners secret` | Hardcoded passwords, API keys, tokens |\n| License | `--scanners license` | Software license compliance issues |\n\n### Severity Levels\n\n- **CRITICAL**: CVSS 9.0-10.0 - Immediate action required\n- **HIGH**: CVSS 7.0-8.9 - Fix before production deployment\n- **MEDIUM**: CVSS 4.0-6.9 - Plan remediation\n- **LOW**: CVSS 0.1-3.9 - Accept or fix opportunistically\n- **UNKNOWN**: Unscored - Evaluate manually\n\n### Vulnerability Database\n\nTrivy uses multiple vulnerability databases:\n- NVD (National Vulnerability Database)\n- Red Hat Security Data\n- Alpine SecDB\n- Debian Security Tracker\n- Ubuntu CVE Tracker\n- Amazon Linux Security Center\n- GitHub Advisory Database\n\n## Workflow\n\n### Step 1: Install Trivy\n\n```bash\n# Linux (apt)\nsudo apt-get install wget apt-transport-https gnupg lsb-release\nwget -qO - https:\u002F\u002Faquasecurity.github.io\u002Ftrivy-repo\u002Fdeb\u002Fpublic.key | gpg --dearmor | sudo tee \u002Fusr\u002Fshare\u002Fkeyrings\u002Ftrivy.gpg > \u002Fdev\u002Fnull\necho \"deb [signed-by=\u002Fusr\u002Fshare\u002Fkeyrings\u002Ftrivy.gpg] https:\u002F\u002Faquasecurity.github.io\u002Ftrivy-repo\u002Fdeb $(lsb_release -sc) main\" | sudo tee -a \u002Fetc\u002Fapt\u002Fsources.list.d\u002Ftrivy.list\nsudo apt-get update && sudo apt-get install trivy\n\n# macOS\nbrew install trivy\n\n# Docker\ndocker pull aquasecurity\u002Ftrivy:latest\n```\n\n### Step 2: Basic Image Scanning\n\n```bash\n# Scan a public image\ntrivy image python:3.12-slim\n\n# Scan with severity filter\ntrivy image --severity CRITICAL,HIGH nginx:latest\n\n# Ignore unfixed vulnerabilities\ntrivy image --ignore-unfixed alpine:3.19\n\n# Scan local image\ndocker build -t myapp:latest .\ntrivy image myapp:latest\n\n# Scan from tar archive\ndocker save myapp:latest -o myapp.tar\ntrivy image --input myapp.tar\n```\n\n### Step 3: Advanced Scanning Options\n\n```bash\n# All scanners (vuln + misconfig + secret + license)\ntrivy image --scanners vuln,misconfig,secret,license myapp:latest\n\n# Generate SBOM in CycloneDX format\ntrivy image --format cyclonedx --output sbom.cdx.json myapp:latest\n\n# Generate SBOM in SPDX format\ntrivy image --format spdx-json --output sbom.spdx.json myapp:latest\n\n# JSON output for programmatic processing\ntrivy image --format json --output results.json myapp:latest\n\n# SARIF output for GitHub Security tab\ntrivy image --format sarif --output results.sarif myapp:latest\n\n# Template-based output\ntrivy image --format template --template \"@contrib\u002Fhtml.tpl\" --output report.html myapp:latest\n\n# Scan specific layers only\ntrivy image --list-all-pkgs myapp:latest\n```\n\n### Step 4: Scanning Kubernetes Manifests\n\n```bash\n# Scan Dockerfile for misconfigurations\ntrivy config Dockerfile\n\n# Scan Kubernetes manifests\ntrivy config k8s-deployment.yaml\n\n# Scan Helm charts\ntrivy config .\u002Fhelm-chart\u002F\n\n# Scan Terraform files\ntrivy config .\u002Fterraform\u002F\n```\n\n### Step 5: CI\u002FCD Integration\n\n```yaml\n# GitHub Actions\non: push\n\njobs:\n  scan:\n    runs-on: ubuntu-latest\n    steps:\n      - uses: actions\u002Fcheckout@v4\n\n      - name: Build image\n        run: docker build -t myapp:${{ github.sha }} .\n\n      - name: Run Trivy vulnerability scanner\n        uses: aquasecurity\u002Ftrivy-action@master\n        with:\n          image-ref: myapp:${{ github.sha }}\n          format: sarif\n          output: trivy-results.sarif\n          severity: CRITICAL,HIGH\n          exit-code: 1\n\n      - name: Upload Trivy scan results\n        uses: github\u002Fcodeql-action\u002Fupload-sarif@v3\n        if: always()\n        with:\n          sarif_file: trivy-results.sarif\n\n      - name: Generate SBOM\n        uses: aquasecurity\u002Ftrivy-action@master\n        with:\n          image-ref: myapp:${{ github.sha }}\n          format: cyclonedx\n          output: sbom.cdx.json\n```\n\n```yaml\n# GitLab CI\ntrivy-scan:\n  stage: security\n  image:\n    name: aquasecurity\u002Ftrivy:latest\n    entrypoint: [\"\"]\n  script:\n    - trivy image --exit-code 1 --severity CRITICAL,HIGH\n        --format json --output gl-container-scanning-report.json\n        $CI_REGISTRY_IMAGE:$CI_COMMIT_SHA\n  artifacts:\n    reports:\n      container_scanning: gl-container-scanning-report.json\n```\n\n### Step 6: Policy Enforcement with .trivyignore\n\n```bash\n# .trivyignore - Ignore specific CVEs with expiry\n# Accepted risk: low-impact vulnerability in dev dependency\nCVE-2023-12345 exp:2025-06-01\n\n# False positive: not exploitable in our configuration\nCVE-2024-67890\n\n# Vendor will not fix\nCVE-2023-11111\n```\n\n### Step 7: Scan Private Registry Images\n\n```bash\n# Docker Hub (uses ~\u002F.docker\u002Fconfig.json)\ntrivy image myregistry.azurecr.io\u002Fmyapp:latest\n\n# ECR\naws ecr get-login-password --region us-east-1 | docker login --username AWS --password-stdin \u003Caccount>.dkr.ecr.us-east-1.amazonaws.com\ntrivy image \u003Caccount>.dkr.ecr.us-east-1.amazonaws.com\u002Fmyapp:latest\n\n# GCR\ntrivy image gcr.io\u002Fmy-project\u002Fmyapp:latest\n\n# With explicit credentials\nTRIVY_USERNAME=user TRIVY_PASSWORD=pass trivy image registry.example.com\u002Fmyapp:latest\n```\n\n## Validation Commands\n\n```bash\n# Verify Trivy installation\ntrivy version\n\n# Update vulnerability database\ntrivy image --download-db-only\n\n# Quick scan with table output\ntrivy image --severity CRITICAL python:3.12\n\n# Verify no CRITICAL vulnerabilities\ntrivy image --exit-code 1 --severity CRITICAL myapp:latest\necho \"Exit code: $?\"  # 0 = no vulns, 1 = vulns found\n```\n\n## References\n\n- [Trivy Documentation](https:\u002F\u002Ftrivy.dev\u002Fdocs\u002F)\n- [Trivy GitHub Repository](https:\u002F\u002Fgithub.com\u002Faquasecurity\u002Ftrivy)\n- [Trivy GitHub Action](https:\u002F\u002Fgithub.com\u002Faquasecurity\u002Ftrivy-action)\n- [Aqua Security - Trivy Scanner Guide](https:\u002F\u002Fwww.aquasec.com\u002Fproducts\u002Ftrivy\u002F)\n",{"name":5,"domain":29,"description":7},"main","a91f1293287ffa9f4f1b8f486cd6e835a1568c84","skills\u002Fcloud-containers-docker-dockertrivy","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace","https:\u002F\u002Fgithub.com\u002FDCx7C5","#Python","2026-09-01 11:21:00",{"source":8,"skillName":5,"commands":43,"prompt":53,"zipAvailable":54},[44,47,50],{"tool":45,"command":46},"npx","npx skills add DCx7C5\u002Fai-marketplace --skill cloud-containers-docker-dockertrivy",{"tool":48,"command":49},"bunx","bunx skills add DCx7C5\u002Fai-marketplace --skill cloud-containers-docker-dockertrivy",{"tool":51,"command":52},"pnpm","pnpm dlx skills add DCx7C5\u002Fai-marketplace --skill cloud-containers-docker-dockertrivy","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fcloud-containers-docker-dockertrivy\u002FSKILL.md",true,[56],{"path":57,"resourceType":58,"resourceTypeDesc":59,"sizeBytes":60,"sourceHtmlUrl":61},"index.json","REFERENCE","参考文档",540,"https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fcloud-containers-docker-dockertrivy\u002Findex.json",[63,88,111,133,155,171],{"skillNo":64,"name":65,"nameZh":6,"description":66,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":67,"categories":68,"keywords":69,"publishedAt":30},"01M71HAPZ01KQ30RKTB0FFSQ05","services-wmi-persistence-detect","Detect WMI event subscription persistence by enumerating ActiveScriptEventConsumer, CommandLineEventConsumer, and permanent subscriptions in the WMI repository.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fservices\u002Fwmi\u002Fpersistence\u002Fdetect\u002FSKILL.md",[],[70,71,72,73,74,75,76,77,78,79,80,81,82,83,84,85,86,29,87],"services","detect","services wmi persistence detect","wmi","persistence","de","cm","process","activescript","event","subscriptions","commandline-consumer","repository","subscription","event-subscription","t1546.003","forensics","process-forensics",{"skillNo":89,"name":90,"nameZh":6,"description":91,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":92,"categories":93,"keywords":94,"publishedAt":30},"01M71HAK6JTTTS229T17WJMMCG","services-wmi-exec-exploit","Perform lateral movement across Windows networks using WMI-based remote execution techniques including Impacket wmiexec.py, CrackMapExec, and native WMI commands for stealthy post-exploitation during red team engagements.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fservices\u002Fwmi\u002Fexec\u002Fexploit\u002FSKILL.md",[],[95,70,96,73,97,98,99,29,100,101,102,103,104,105,75,106,107,108,109,110],"exploit","services wmi exec exploit","exec","remote","traffic","Bash","analysis","team","across","crackmapexec","native","command","lateral movement","read","lateral-movement","Impacket",{"skillNo":112,"name":113,"nameZh":6,"description":114,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":115,"categories":116,"keywords":117,"publishedAt":30},"01M71HAG6MHKNQV8KDZKMT4886","registry-artifact-extract","Extract and analyze Windows Registry hives to uncover user activity, installed software, autostart entries, and evidence of system compromise.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fregistry\u002Fartifact\u002Fextract\u002FSKILL.md",[],[118,119,120,121,122,123,29,100,124,101,125,126,75,108,127,128,129,130,131,132],"artifact","registry","registry artifact extract","extract","evidence-collection","artifact-analysis","collection","analyze","uncover","software","activity","digital-forensics","windows-registry","regripper","sonnet",{"skillNo":134,"name":135,"nameZh":6,"description":136,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":137,"categories":138,"keywords":139,"publishedAt":30},"01M71HACR4A8XTWTTSXK4124AA","processes-token-impersonate-detect","Detect Windows token impersonation and privilege abuse including SeImpersonatePrivilege exploitation via Potato attacks and token stealing techniques.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fprocesses\u002Ftoken\u002Fimpersonate\u002Fdetect\u002FSKILL.md",[],[71,140,141,142,143,144,145,76,146,29,87,147,148,149,150,151,152,153,154,75],"processes token impersonate detect","token","processes","attacks","windows","escalation","techniques","privilege-escalation","seimpersonate","token-impersonation","printspoofer","exploitation","potato","impersonation","via",{"skillNo":156,"name":157,"nameZh":6,"description":158,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":159,"categories":160,"keywords":161,"publishedAt":30},"01M71HAABSB4Z6QFSXEG00R4RK","processes-thread-injection-detect","Detect Windows thread injection techniques including CreateRemoteThread, QueueUserAPC, NtCreateThreadEx, and thread hijacking via process memory analysis.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fprocesses\u002Fthread\u002Finjection\u002Fdetect\u002FSKILL.md",[],[162,163,71,164,142,144,165,76,166,146,29,87,101,167,168,169,170,154,75,77],"thread","processes thread injection detect","injection","memory","process-injection","api","apc-injection","thread-injection","nt-api",{"skillNo":172,"name":173,"nameZh":6,"description":174,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":175,"categories":176,"keywords":177,"publishedAt":30},"01M71HA7H311V5G14WMX58HQSS","processes-hollow-technique-detect","Detect process hollowing (RunPE) by identifying processes with mismatched image paths between PEB and VAD tree, or unmapped PE headers in memory.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fprocesses\u002Fhollow\u002Ftechnique\u002Fdetect\u002FSKILL.md",[],[178,71,142,179,165,76,180,181,29,87,182,183,184,185,186,187,75,77,188,189],"processes hollow technique detect","tree","memory-forensics","process-hollow","peb","runpe","image","pe-header","in memory","with","mismatched","headers"]