[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M71C82HJ66Z2PWDMB2P30PHR":3,"skill-same:01M71C82HJ66Z2PWDMB2P30PHR":60},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":23,"publishedAt":28,"linkOnly":29,"markdownContent":30,"markdownBody":31,"frontMatter":32,"refName":33,"commitSha":34,"skillDirectory":35,"forksCount":14,"repositoryHtmlUrl":36,"repositoryHomepageUrl":6,"ownerHtmlUrl":37,"ownerBlogUrl":6,"ownerDescription":38,"updatedAt":39,"install":40,"resources":53},"01M71C82HJ66Z2PWDMB2P30PHR","cloud-kubernetes-cloudkube",null,"Cloud Kubernetes Cloudkube.","DCx7C5\u002Fai-marketplace","DCx7C5","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F42419559?v=4","01M71C01G2AZV3NTNGWAWSHJPP","DC","01M71C01GQW6G50S2BYMS7PP3E",0,"MIT","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fcloud-kubernetes-cloudkube\u002FSKILL.md",[18],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000011","运维与部署","SCENARIO","使用场景",[24,25,26,27],"kubernetes","cloud","cloud kubernetes cloudkube","cybersecurity","2026-11-10 10:12:30",false,"---\nname: cloud-kubernetes-cloudkube\ndescription: \"Cloud Kubernetes Cloudkube.\"\ndomain: cybersecurity\n---\n\n|\n| Pod Security Standards | Three profiles (Privileged, Baseline, Restricted) enforced via Pod Security Admission that control pod security context capabilities |\n| Workload Identity | Cloud-native mechanism binding Kubernetes service accounts to cloud IAM roles for credential-free cloud API access (IRSA, GKE WI, AKS MI) |\n| Network Policy | Kubernetes resource defining allowed ingress and egress traffic flows between pods, enforced by the CNI plugin |\n| Admission Controller | Kubernetes plugin that intercepts API requests before persistence to validate or mutate resources against security policies |\n| RBAC | Role-Based Access Control in Kubernetes, defining what actions (verbs) identities can perform on which resources in which namespaces |\n| Seccomp Profile | Linux kernel feature restricting the system calls a container process can make, reducing the kernel attack surface |\n| Service Mesh | Infrastructure layer (Istio, Linkerd) providing mutual TLS, traffic policies, and observability for service-to-service communication |\n\n## Tools & Systems\n\n- **Falco**: Open-source runtime security engine detecting anomalous behavior in containers using kernel-level system call monitoring\n- **Kyverno**: Kubernetes-native policy engine for admission control, mutation, and generation of resources based on security policies\n- **kube-bench**: CIS Kubernetes Benchmark assessment tool checking cluster configuration against security best practices\n- **Trivy**: Vulnerability scanner for container images, file systems, and Kubernetes resources with SBOM generation\n- **Calico\u002FCilium**: CNI plugins providing network policy enforcement and advanced network security features including eBPF-based monitoring\n\n## Common Scenarios\n\n### Scenario: Cryptominer Deployed via Compromised Container Image\n\n**Context**: GuardDuty Extended Threat Detection generates an AttackSequence:EKS\u002FCompromisedCluster finding. A developer pulled a public Docker image containing an embedded XMRig cryptominer that executes at container startup.\n\n**Approach**:\n1. Isolate the affected pod by applying a deny-all network policy targeting its labels\n2. Capture the container image digest and scan it with Trivy to identify the embedded binary\n3. Review Kubernetes audit logs to identify who deployed the compromised image and when\n4. Deploy Kyverno ClusterPolicy requiring images from approved private registries only\n5. Enable image digest pinning to prevent tag mutation attacks\n6. Deploy Falco with rules detecting crypto mining process signatures (\u002Fusr\u002Fbin\u002Fxmrig, stratum+tcp connections)\n\n**Pitfalls**: Deleting the pod before capturing the image digest and audit logs destroys forensic evidence. Blocking only the specific image tag allows the attacker to re-push with a different tag.\n\n## Output Format\n\n```\nKubernetes Security Assessment Report\n=======================================\nCluster: production-cluster (EKS 1.29)\nProvider: AWS (us-east-1)\nAssessment Date: 2025-02-23\nTool: kube-bench v0.8.0 + manual review\n\nCIS KUBERNETES BENCHMARK RESULTS:\n  Total Controls: 124\n  Passed: 98 (79%)\n  Failed: 18 (15%)\n  Warnings: 8 (6%)\n\nCRITICAL FINDINGS:\n  [K8S-001] 3 namespaces lack Pod Security Standards enforcement\n    Namespaces: monitoring, logging, default\n    Remediation: Apply restricted PSA labels\n\n  [K8S-002] Default service account tokens auto-mounted in 12 deployments\n    Risk: Credential theft if container is compromised\n    Remediation: Set automountServiceAccountToken: false\n\n  [K8S-003] No network policies in production namespace\n    Risk: Unrestricted lateral movement between all pods\n    Remediation: Deploy default-deny policy with explicit allow rules\n\nHIGH FINDINGS:\n  [K8S-004] 5 pods running as root with privileged security context\n  [K8S-005] Images deployed using mutable tags (:latest) in 8 deployments\n  [K8S-006] RBAC ClusterRoleBinding grants cluster-admin to developers group\n```\n","|\n| Pod Security Standards | Three profiles (Privileged, Baseline, Restricted) enforced via Pod Security Admission that control pod security context capabilities |\n| Workload Identity | Cloud-native mechanism binding Kubernetes service accounts to cloud IAM roles for credential-free cloud API access (IRSA, GKE WI, AKS MI) |\n| Network Policy | Kubernetes resource defining allowed ingress and egress traffic flows between pods, enforced by the CNI plugin |\n| Admission Controller | Kubernetes plugin that intercepts API requests before persistence to validate or mutate resources against security policies |\n| RBAC | Role-Based Access Control in Kubernetes, defining what actions (verbs) identities can perform on which resources in which namespaces |\n| Seccomp Profile | Linux kernel feature restricting the system calls a container process can make, reducing the kernel attack surface |\n| Service Mesh | Infrastructure layer (Istio, Linkerd) providing mutual TLS, traffic policies, and observability for service-to-service communication |\n\n## Tools & Systems\n\n- **Falco**: Open-source runtime security engine detecting anomalous behavior in containers using kernel-level system call monitoring\n- **Kyverno**: Kubernetes-native policy engine for admission control, mutation, and generation of resources based on security policies\n- **kube-bench**: CIS Kubernetes Benchmark assessment tool checking cluster configuration against security best practices\n- **Trivy**: Vulnerability scanner for container images, file systems, and Kubernetes resources with SBOM generation\n- **Calico\u002FCilium**: CNI plugins providing network policy enforcement and advanced network security features including eBPF-based monitoring\n\n## Common Scenarios\n\n### Scenario: Cryptominer Deployed via Compromised Container Image\n\n**Context**: GuardDuty Extended Threat Detection generates an AttackSequence:EKS\u002FCompromisedCluster finding. A developer pulled a public Docker image containing an embedded XMRig cryptominer that executes at container startup.\n\n**Approach**:\n1. Isolate the affected pod by applying a deny-all network policy targeting its labels\n2. Capture the container image digest and scan it with Trivy to identify the embedded binary\n3. Review Kubernetes audit logs to identify who deployed the compromised image and when\n4. Deploy Kyverno ClusterPolicy requiring images from approved private registries only\n5. Enable image digest pinning to prevent tag mutation attacks\n6. Deploy Falco with rules detecting crypto mining process signatures (\u002Fusr\u002Fbin\u002Fxmrig, stratum+tcp connections)\n\n**Pitfalls**: Deleting the pod before capturing the image digest and audit logs destroys forensic evidence. Blocking only the specific image tag allows the attacker to re-push with a different tag.\n\n## Output Format\n\n```\nKubernetes Security Assessment Report\n=======================================\nCluster: production-cluster (EKS 1.29)\nProvider: AWS (us-east-1)\nAssessment Date: 2025-02-23\nTool: kube-bench v0.8.0 + manual review\n\nCIS KUBERNETES BENCHMARK RESULTS:\n  Total Controls: 124\n  Passed: 98 (79%)\n  Failed: 18 (15%)\n  Warnings: 8 (6%)\n\nCRITICAL FINDINGS:\n  [K8S-001] 3 namespaces lack Pod Security Standards enforcement\n    Namespaces: monitoring, logging, default\n    Remediation: Apply restricted PSA labels\n\n  [K8S-002] Default service account tokens auto-mounted in 12 deployments\n    Risk: Credential theft if container is compromised\n    Remediation: Set automountServiceAccountToken: false\n\n  [K8S-003] No network policies in production namespace\n    Risk: Unrestricted lateral movement between all pods\n    Remediation: Deploy default-deny policy with explicit allow rules\n\nHIGH FINDINGS:\n  [K8S-004] 5 pods running as root with privileged security context\n  [K8S-005] Images deployed using mutable tags (:latest) in 8 deployments\n  [K8S-006] RBAC ClusterRoleBinding grants cluster-admin to developers group\n```\n",{"name":5,"domain":27,"description":7},"main","a91f1293287ffa9f4f1b8f486cd6e835a1568c84","skills\u002Fcloud-kubernetes-cloudkube","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace","https:\u002F\u002Fgithub.com\u002FDCx7C5","#Python","2026-09-01 11:21:00",{"source":8,"skillName":5,"commands":41,"prompt":51,"zipAvailable":52},[42,45,48],{"tool":43,"command":44},"npx","npx skills add DCx7C5\u002Fai-marketplace --skill cloud-kubernetes-cloudkube",{"tool":46,"command":47},"bunx","bunx skills add DCx7C5\u002Fai-marketplace --skill cloud-kubernetes-cloudkube",{"tool":49,"command":50},"pnpm","pnpm dlx skills add DCx7C5\u002Fai-marketplace --skill cloud-kubernetes-cloudkube","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fcloud-kubernetes-cloudkube\u002FSKILL.md",true,[54],{"path":55,"resourceType":56,"resourceTypeDesc":57,"sizeBytes":58,"sourceHtmlUrl":59},"index.json","REFERENCE","参考文档",504,"https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fcloud-kubernetes-cloudkube\u002Findex.json",[61,86,109,131,153,169],{"skillNo":62,"name":63,"nameZh":6,"description":64,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":65,"categories":66,"keywords":67,"publishedAt":28},"01M71HAPZ01KQ30RKTB0FFSQ05","services-wmi-persistence-detect","Detect WMI event subscription persistence by enumerating ActiveScriptEventConsumer, CommandLineEventConsumer, and permanent subscriptions in the WMI repository.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fservices\u002Fwmi\u002Fpersistence\u002Fdetect\u002FSKILL.md",[],[68,69,70,71,72,73,74,75,76,77,78,79,80,81,82,83,84,27,85],"services","detect","services wmi persistence detect","wmi","persistence","de","cm","process","activescript","event","subscriptions","commandline-consumer","repository","subscription","event-subscription","t1546.003","forensics","process-forensics",{"skillNo":87,"name":88,"nameZh":6,"description":89,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":90,"categories":91,"keywords":92,"publishedAt":28},"01M71HAK6JTTTS229T17WJMMCG","services-wmi-exec-exploit","Perform lateral movement across Windows networks using WMI-based remote execution techniques including Impacket wmiexec.py, CrackMapExec, and native WMI commands for stealthy post-exploitation during red team engagements.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fservices\u002Fwmi\u002Fexec\u002Fexploit\u002FSKILL.md",[],[93,68,94,71,95,96,97,27,98,99,100,101,102,103,73,104,105,106,107,108],"exploit","services wmi exec exploit","exec","remote","traffic","Bash","analysis","team","across","crackmapexec","native","command","lateral movement","read","lateral-movement","Impacket",{"skillNo":110,"name":111,"nameZh":6,"description":112,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":113,"categories":114,"keywords":115,"publishedAt":28},"01M71HAG6MHKNQV8KDZKMT4886","registry-artifact-extract","Extract and analyze Windows Registry hives to uncover user activity, installed software, autostart entries, and evidence of system compromise.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fregistry\u002Fartifact\u002Fextract\u002FSKILL.md",[],[116,117,118,119,120,121,27,98,122,99,123,124,73,106,125,126,127,128,129,130],"artifact","registry","registry artifact extract","extract","evidence-collection","artifact-analysis","collection","analyze","uncover","software","activity","digital-forensics","windows-registry","regripper","sonnet",{"skillNo":132,"name":133,"nameZh":6,"description":134,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":135,"categories":136,"keywords":137,"publishedAt":28},"01M71HACR4A8XTWTTSXK4124AA","processes-token-impersonate-detect","Detect Windows token impersonation and privilege abuse including SeImpersonatePrivilege exploitation via Potato attacks and token stealing techniques.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fprocesses\u002Ftoken\u002Fimpersonate\u002Fdetect\u002FSKILL.md",[],[69,138,139,140,141,142,143,74,144,27,85,145,146,147,148,149,150,151,152,73],"processes token impersonate detect","token","processes","attacks","windows","escalation","techniques","privilege-escalation","seimpersonate","token-impersonation","printspoofer","exploitation","potato","impersonation","via",{"skillNo":154,"name":155,"nameZh":6,"description":156,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":157,"categories":158,"keywords":159,"publishedAt":28},"01M71HAABSB4Z6QFSXEG00R4RK","processes-thread-injection-detect","Detect Windows thread injection techniques including CreateRemoteThread, QueueUserAPC, NtCreateThreadEx, and thread hijacking via process memory analysis.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fprocesses\u002Fthread\u002Finjection\u002Fdetect\u002FSKILL.md",[],[160,161,69,162,140,142,163,74,164,144,27,85,99,165,166,167,168,152,73,75],"thread","processes thread injection detect","injection","memory","process-injection","api","apc-injection","thread-injection","nt-api",{"skillNo":170,"name":171,"nameZh":6,"description":172,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":173,"categories":174,"keywords":175,"publishedAt":28},"01M71HA7H311V5G14WMX58HQSS","processes-hollow-technique-detect","Detect process hollowing (RunPE) by identifying processes with mismatched image paths between PEB and VAD tree, or unmapped PE headers in memory.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fprocesses\u002Fhollow\u002Ftechnique\u002Fdetect\u002FSKILL.md",[],[176,69,140,177,163,74,178,179,27,85,180,181,182,183,184,185,73,75,186,187],"processes hollow technique detect","tree","memory-forensics","process-hollow","peb","runpe","image","pe-header","in memory","with","mismatched","headers"]