[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M71C965AY38P4ZZPBS7FT5FF":3,"skill-same:01M71C965AY38P4ZZPBS7FT5FF":61},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":18,"publishedAt":29,"linkOnly":30,"markdownContent":31,"markdownBody":32,"frontMatter":33,"refName":34,"commitSha":35,"skillDirectory":36,"forksCount":14,"repositoryHtmlUrl":37,"repositoryHomepageUrl":6,"ownerHtmlUrl":38,"ownerBlogUrl":6,"ownerDescription":39,"updatedAt":40,"install":41,"resources":54},"01M71C965AY38P4ZZPBS7FT5FF","cloud-logs-athena",null,"# Create all forensic tables from scratch python agent.","DCx7C5\u002Fai-marketplace","DCx7C5","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F42419559?v=4","01M71C01G2AZV3NTNGWAWSHJPP","DC","01M71C01GQW6G50S2BYMS7PP3E",0,"MIT","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fcloud-logs-athena\u002FSKILL.md",[],[19,20,21,22,23,24,25,26,27,28],"logs","athena","cloud","cloud logs athena","python","scratch","cybersecurity","From Scratch","create","tables","2026-11-10 10:12:30",false,"---\nname: cloud-logs-athena\ndescription: \"# Create all forensic tables from scratch python agent.\"\ndomain: cybersecurity\n---\n\n# Performing Cloud Log Forensics with AWS Athena\n\n## When to Use\n\n- When investigating AWS security incidents that require querying massive volumes of cloud logs\n- When performing forensic analysis across CloudTrail, VPC Flow Logs, S3 access logs, and ALB logs\n- When building reusable Athena tables with partition projection for ongoing incident response\n- When hunting for indicators of compromise across multiple AWS log sources simultaneously\n- When creating evidence-grade SQL queries for compliance audits or legal proceedings\n\n## Prerequisites\n\n- AWS account with Athena, S3, and Glue permissions\n- CloudTrail configured to deliver logs to an S3 bucket\n- VPC Flow Logs enabled and publishing to S3\n- S3 server access logging enabled on target buckets\n- ALB access logging enabled and publishing to S3\n- Python 3.8+ with boto3 installed\n- Appropriate IAM permissions for Athena queries and S3 access\n\n## Instructions\n\n### Phase 1: Create Athena Database and CloudTrail Table\n\nCreate a dedicated forensics database and CloudTrail table using partition projection\nto automatically discover partitions without manual ALTER TABLE statements.\n\n```sql\nCREATE DATABASE IF NOT EXISTS cloud_forensics;\n\nCREATE EXTERNAL TABLE cloud_forensics.cloudtrail_logs (\n    eventVersion STRING,\n    userIdentity STRUCT\u003C\n        type: STRING,\n        principalId: STRING,\n        arn: STRING,\n        accountId: STRING,\n        invokedBy: STRING,\n        accessKeyId: STRING,\n        userName: STRING,\n        sessionContext: STRUCT\u003C\n            attributes: STRUCT\u003C\n                mfaAuthenticated: STRING,\n                creationDate: STRING>,\n            sessionIssuer: STRUCT\u003C\n                type: STRING,\n                principalId: STRING,\n                arn: STRING,\n                accountId: STRING,\n                userName: STRING>,\n            ec2RoleDelivery: STRING,\n            webIdFederationData: STRUCT\u003C\n                federatedProvider: STRING,\n                attributes: MAP\u003CSTRING, STRING>>>>,\n    eventTime STRING,\n    eventSource STRING,\n    eventName STRING,\n    awsRegion STRING,\n    sourceIPAddress STRING,\n    userAgent STRING,\n    errorCode STRING,\n    errorMessage STRING,\n    requestParameters STRING,\n    responseElements STRING,\n    additionalEventData STRING,\n    requestId STRING,\n    eventId STRING,\n    readOnly STRING,\n    resources ARRAY\u003CSTRUCT\u003C\n        arn: STRING,\n        accountId: STRING,\n        type: STRING>>,\n    eventType STRING,\n    apiVersion STRING,\n    recipientAccountId STRING,\n    serviceEventDetails STRING,\n    sharedEventID STRING,\n    vpcEndpointId STRING,\n    tlsDetails STRUCT\u003C\n        tlsVersion: STRING,\n        cipherSuite: STRING,\n        clientProvidedHostHeader: STRING>\n)\nCOMMENT 'CloudTrail logs with partition projection for forensic analysis'\nPARTITIONED BY (\n    `account` STRING,\n    `region` STRING,\n    `timestamp` STRING\n)\nROW FORMAT SERDE 'org.apache.hive.hcatalog.data.JsonSerDe'\nSTORED AS INPUTFORMAT 'com.amazon.emr.cloudtrail.CloudTrailInputFormat'\nOUTPUTFORMAT 'org.apache.hadoop.hive.ql.io.HiveIgnoreKeyTextOutputFormat'\nLOCATION 's3:\u002F\u002FYOUR-CLOUDTRAIL-BUCKET\u002FAWSLogs\u002F'\nTBLPROPERTIES (\n    'projection.enabled' = 'true',\n    'projection.account.type' = 'enum',\n    'projection.account.values' = 'YOUR_ACCOUNT_ID',\n    'projection.region.type' = 'enum',\n    'projection.region.values' = 'us-east-1,us-west-2,eu-west-1',\n    'projection.timestamp.type' = 'date',\n    'projection.timestamp.format' = 'yyyy\u002FMM\u002Fdd',\n    'projection.timestamp.range' = '2023\u002F01\u002F01,NOW',\n    'projection.timestamp.interval' = '1',\n    'projection.timestamp.interval.unit' = 'DAYS',\n    'storage.location.template' = 's3:\u002F\u002FYOUR-CLOUDTRAIL-BUCKET\u002FAWSLogs\u002F${account}\u002FCloudTrail\u002F${region}\u002F${timestamp}'\n);\n```\n\n### Phase 2: Create VPC Flow Logs Table\n\n```sql\nCREATE EXTERNAL TABLE cloud_forensics.vpc_flow_logs (\n    version INT,\n    account_id STRING,\n    interface_id STRING,\n    srcaddr STRING,\n    dstaddr STRING,\n    srcport INT,\n    dstport INT,\n    protocol BIGINT,\n    packets BIGINT,\n    bytes BIGINT,\n    start BIGINT,\n    `end` BIGINT,\n    action STRING,\n    log_status STRING,\n    vpc_id STRING,\n    subnet_id STRING,\n    az_id STRING,\n    sublocation_type STRING,\n    sublocation_id STRING,\n    pkt_srcaddr STRING,\n    pkt_dstaddr STRING,\n    region STRING,\n    pkt_src_aws_service STRING,\n    pkt_dst_aws_service STRING,\n    flow_direction STRING,\n    traffic_path INT\n)\nPARTITIONED BY (\n    `date` STRING\n)\nROW FORMAT DELIMITED\nFIELDS TERMINATED BY ' '\nLOCATION 's3:\u002F\u002FYOUR-VPC-FLOW-LOGS-BUCKET\u002FAWSLogs\u002FYOUR_ACCOUNT_ID\u002Fvpcflowlogs\u002F'\nTBLPROPERTIES (\n    'skip.header.line.count' = '1',\n    'projection.enabled' = 'true',\n    'projection.date.type' = 'date',\n    'projection.date.format' = 'yyyy\u002FMM\u002Fdd',\n    'projection.date.range' = '2023\u002F01\u002F01,NOW',\n    'projection.date.interval' = '1',\n    'projection.date.interval.unit' = 'DAYS',\n    'storage.location.template' = 's3:\u002F\u002FYOUR-VPC-FLOW-LOGS-BUCKET\u002FAWSLogs\u002FYOUR_ACCOUNT_ID\u002Fvpcflowlogs\u002Fus-east-1\u002F${date}'\n);\n```\n\n### Phase 3: Create S3 Access Logs Table\n\n```sql\nCREATE EXTERNAL TABLE cloud_forensics.s3_access_logs (\n    bucket_owner STRING,\n    bucket_name STRING,\n    request_datetime STRING,\n    remote_ip STRING,\n    requester STRING,\n    request_id STRING,\n    operation STRING,\n    key STRING,\n    request_uri STRING,\n    http_status INT,\n    error_code STRING,\n    bytes_sent BIGINT,\n    object_size BIGINT,\n    total_time INT,\n    turn_around_time INT,\n    referrer STRING,\n    user_agent STRING,\n    version_id STRING,\n    host_id STRING,\n    signature_version STRING,\n    cipher_suite STRING,\n    authentication_type STRING,\n    host_header STRING,\n    tls_version STRING,\n    access_point_arn STRING,\n    acl_required STRING\n)\nROW FORMAT SERDE 'org.apache.hadoop.hive.serde2.RegexSerDe'\nWITH SERDEPROPERTIES (\n    'serialization.format' = '1',\n    'input.regex' = '([^ ]*) ([^ ]*) \\\\[(.*?)\\\\] ([^ ]*) ([^ ]*) ([^ ]*) ([^ ]*) ([^ ]*) (\\\"[^\\\"]*\\\"|-) (-|[0-9]*) ([^ ]*) ([^ ]*) ([^ ]*) ([^ ]*) ([^ ]*) ([^ ]*) (\\\"[^\\\"]*\\\"|-) ([^ ]*) ([^ ]*) ([^ ]*) ([^ ]*) ([^ ]*) ([^ ]*) ([^ ]*) ([^ ]*) ([^ ]*)'\n)\nSTORED AS INPUTFORMAT 'org.apache.hadoop.mapred.TextInputFormat'\nOUTPUTFORMAT 'org.apache.hadoop.hive.ql.io.HiveIgnoreKeyTextOutputFormat'\nLOCATION 's3:\u002F\u002FYOUR-S3-ACCESS-LOGS-BUCKET\u002Flogs\u002F';\n```\n\n### Phase 4: Create ALB Access Logs Table\n\n```sql\nCREATE EXTERNAL TABLE cloud_forensics.alb_access_logs (\n    type STRING,\n    time STRING,\n    elb STRING,\n    client_ip STRING,\n    client_port INT,\n    target_ip STRING,\n    target_port INT,\n    request_processing_time DOUBLE,\n    target_processing_time DOUBLE,\n    response_processing_time DOUBLE,\n    elb_status_code INT,\n    target_status_code STRING,\n    received_bytes BIGINT,\n    sent_bytes BIGINT,\n    request_verb STRING,\n    request_url STRING,\n    request_proto STRING,\n    user_agent STRING,\n    ssl_cipher STRING,\n    ssl_protocol STRING,\n    target_group_arn STRING,\n    trace_id STRING,\n    domain_name STRING,\n    chosen_cert_arn STRING,\n    matched_rule_priority STRING,\n    request_creation_time STRING,\n    actions_executed STRING,\n    redirect_url STRING,\n    lambda_error_reason STRING,\n    target_port_list STRING,\n    target_status_code_list STRING,\n    classification STRING,\n    classification_reason STRING,\n    conn_trace_id STRING\n)\nPARTITIONED BY (\n    `day` STRING\n)\nROW FORMAT SERDE 'org.apache.hadoop.hive.serde2.RegexSerDe'\nWITH SERDEPROPERTIES (\n    'serialization.format' = '1',\n    'input.regex' = '([^ ]*) ([^ ]*) ([^ ]*) ([^ ]*):([0-9]*) ([^ ]*)[:-]([0-9]*) ([-.0-9]*) ([-.0-9]*) ([-.0-9]*) (|[0-9]*) (-|[0-9]*) ([-0-9]*) ([-0-9]*) \\\"([^ ]*) (.*) (- |[^ ]*)\\\" \\\"([^\\\"]*)\\\" ([A-Z0-9-_]+) ([A-Za-z0-9.-]*) ([^ ]*) \\\"([^\\\"]*)\\\" \\\"([^\\\"]*)\\\" \\\"([^\\\"]*)\\\" ([-.0-9]*) ([^ ]*) \\\"([^\\\"]*)\\\" \\\"([^\\\"]*)\\\" \\\"([^ ]*)\\\" \\\"([^\\\"]*)\\\" \\\"([^ ]*)\\\" \\\"([^ ]*)\\\" \\\"([^ ]*)\\\"'\n)\nSTORED AS INPUTFORMAT 'org.apache.hadoop.mapred.TextInputFormat'\nOUTPUTFORMAT 'org.apache.hadoop.hive.ql.io.HiveIgnoreKeyTextOutputFormat'\nLOCATION 's3:\u002F\u002FYOUR-ALB-LOGS-BUCKET\u002FAWSLogs\u002FYOUR_ACCOUNT_ID\u002Felasticloadbalancing\u002Fus-east-1\u002F'\nTBLPROPERTIES (\n    'projection.enabled' = 'true',\n    'projection.day.type' = 'date',\n    'projection.day.format' = 'yyyy\u002FMM\u002Fdd',\n    'projection.day.range' = '2023\u002F01\u002F01,NOW',\n    'projection.day.interval' = '1',\n    'projection.day.interval.unit' = 'DAYS',\n    'storage.location.template' = 's3:\u002F\u002FYOUR-ALB-LOGS-BUCKET\u002FAWSLogs\u002FYOUR_ACCOUNT_ID\u002Felasticloadbalancing\u002Fus-east-1\u002F${day}'\n);\n```\n\n### Phase 5: Forensic Investigation Queries\n\n#### Detect Unauthorized API Calls\n\n```sql\nSELECT\n    eventtime,\n    useridentity.arn AS caller_arn,\n    useridentity.accountid AS account,\n    eventsource,\n    eventname,\n    errorcode,\n    errormessage,\n    sourceipaddress,\n    useragent\nFROM cloud_forensics.cloudtrail_logs\nWHERE errorcode IN ('AccessDenied', 'UnauthorizedAccess', 'Client.UnauthorizedAccess')\n    AND timestamp BETWEEN '2024\u002F01\u002F01' AND '2024\u002F12\u002F31'\nORDER BY eventtime DESC\nLIMIT 1000;\n```\n\n#### Detect Privilege Escalation Attempts\n\n```sql\nSELECT\n    eventtime,\n    useridentity.arn AS actor,\n    eventname,\n    eventsource,\n    json_extract_scalar(requestparameters, '$.policyArn') AS policy_arn,\n    json_extract_scalar(requestparameters, '$.roleName') AS role_name,\n    json_extract_scalar(requestparameters, '$.userName') AS target_user,\n    sourceipaddress\nFROM cloud_forensics.cloudtrail_logs\nWHERE eventname IN (\n    'AttachUserPolicy', 'AttachRolePolicy', 'AttachGroupPolicy',\n    'PutUserPolicy', 'PutRolePolicy', 'PutGroupPolicy',\n    'CreatePolicyVersion', 'SetDefaultPolicyVersion',\n    'AddUserToGroup', 'UpdateAssumeRolePolicy',\n    'CreateAccessKey', 'CreateLoginProfile',\n    'UpdateLoginProfile', 'AssumeRole'\n)\n    AND timestamp BETWEEN '2024\u002F01\u002F01' AND '2024\u002F12\u002F31'\nORDER BY eventtime DESC;\n```\n\n#### Detect Data Exfiltration via S3\n\n```sql\nSELECT\n    eventtime,\n    useridentity.arn AS actor,\n    eventname,\n    json_extract_scalar(requestparameters, '$.bucketName') AS bucket,\n    json_extract_scalar(requestparameters, '$.key') AS object_key,\n    sourceipaddress,\n    useragent\nFROM cloud_forensics.cloudtrail_logs\nWHERE eventsource = 's3.amazonaws.com'\n    AND eventname IN ('GetObject', 'CopyObject', 'PutBucketPolicy',\n                      'PutBucketAcl', 'PutObjectAcl', 'SelectObjectContent')\n    AND sourceipaddress NOT LIKE '10.%'\n    AND sourceipaddress NOT LIKE '172.%'\n    AND sourceipaddress NOT LIKE '192.168.%'\n    AND timestamp BETWEEN '2024\u002F01\u002F01' AND '2024\u002F12\u002F31'\nORDER BY eventtime DESC;\n```\n\n#### Detect Lateral Movement via VPC Flow Logs\n\n```sql\nSELECT\n    srcaddr,\n    dstaddr,\n    dstport,\n    protocol,\n    SUM(packets) AS total_packets,\n    SUM(bytes) AS total_bytes,\n    COUNT(*) AS connection_count,\n    MIN(from_unixtime(start)) AS first_seen,\n    MAX(from_unixtime(\"end\")) AS last_seen\nFROM cloud_forensics.vpc_flow_logs\nWHERE action = 'ACCEPT'\n    AND srcaddr LIKE '10.%'\n    AND dstport IN (22, 3389, 5985, 5986, 445, 135, 139)\n    AND date BETWEEN '2024\u002F06\u002F01' AND '2024\u002F06\u002F30'\nGROUP BY srcaddr, dstaddr, dstport, protocol\nHAVING COUNT(*) > 100\nORDER BY connection_count DESC;\n```\n\n#### Detect Port Scanning Activity\n\n```sql\nSELECT\n    srcaddr,\n    COUNT(DISTINCT dstport) AS unique_ports_scanned,\n    COUNT(DISTINCT dstaddr) AS unique_targets,\n    SUM(packets) AS total_packets,\n    MIN(from_unixtime(start)) AS first_seen,\n    MAX(from_unixtime(\"end\")) AS last_seen\nFROM cloud_forensics.vpc_flow_logs\nWHERE action = 'REJECT'\n    AND date BETWEEN '2024\u002F06\u002F01' AND '2024\u002F06\u002F30'\nGROUP BY srcaddr\nHAVING COUNT(DISTINCT dstport) > 25\nORDER BY unique_ports_scanned DESC;\n```\n\n#### Detect Suspicious S3 Bulk Downloads\n\n```sql\nSELECT\n    remote_ip,\n    requester,\n    bucket_name,\n    COUNT(*) AS request_count,\n    SUM(bytes_sent) AS total_bytes_downloaded,\n    COUNT(DISTINCT key) AS unique_objects,\n    MIN(request_datetime) AS first_request,\n    MAX(request_datetime) AS last_request\nFROM cloud_forensics.s3_access_logs\nWHERE operation LIKE '%GET%'\n    AND http_status = 200\nGROUP BY remote_ip, requester, bucket_name\nHAVING COUNT(*) > 500\nORDER BY total_bytes_downloaded DESC;\n```\n\n#### Detect ALB-Level Injection Attempts\n\n```sql\nSELECT\n    time,\n    client_ip,\n    request_verb,\n    request_url,\n    elb_status_code,\n    target_status_code,\n    user_agent\nFROM cloud_forensics.alb_access_logs\nWHERE (\n    request_url LIKE '%UNION%SELECT%'\n    OR request_url LIKE '%\u003Cscript%'\n    OR request_url LIKE '%..\u002F..\u002F..\u002F%'\n    OR request_url LIKE '%\u002Fetc\u002Fpasswd%'\n    OR request_url LIKE '%cmd.exe%'\n    OR request_url LIKE '%\u002Fproc\u002Fself%'\n    OR request_url LIKE '%SLEEP(%'\n    OR request_url LIKE '%WAITFOR%'\n)\n    AND day BETWEEN '2024\u002F06\u002F01' AND '2024\u002F06\u002F30'\nORDER BY time DESC;\n```\n\n### Phase 6: Cross-Log Correlation\n\nCorrelate findings across log sources for comprehensive incident timelines.\n\n```sql\n-- Correlate suspicious CloudTrail actor with VPC Flow Logs\nWITH suspicious_ips AS (\n    SELECT DISTINCT sourceipaddress AS ip\n    FROM cloud_forensics.cloudtrail_logs\n    WHERE errorcode = 'AccessDenied'\n        AND timestamp BETWEEN '2024\u002F06\u002F01' AND '2024\u002F06\u002F30'\n)\nSELECT\n    v.srcaddr,\n    v.dstaddr,\n    v.dstport,\n    v.protocol,\n    SUM(v.bytes) AS total_bytes,\n    COUNT(*) AS flow_count\nFROM cloud_forensics.vpc_flow_logs v\nJOIN suspicious_ips s ON v.srcaddr = s.ip\nWHERE v.date BETWEEN '2024\u002F06\u002F01' AND '2024\u002F06\u002F30'\nGROUP BY v.srcaddr, v.dstaddr, v.dstport, v.protocol\nORDER BY total_bytes DESC;\n```\n\n## Examples\n\n```python\n# Quick-start: run the forensics agent for a full investigation\npython agent.py \\\n    --action full_investigation \\\n    --database cloud_forensics \\\n    --start-date 2024-06-01 \\\n    --end-date 2024-06-30 \\\n    --output forensics_report.json\n\n# Run specific queries only\npython agent.py \\\n    --action privilege_escalation \\\n    --database cloud_forensics \\\n    --start-date 2024-06-15 \\\n    --end-date 2024-06-16\n\n# Create all forensic tables from scratch\npython agent.py \\\n    --action setup_tables \\\n    --cloudtrail-bucket my-cloudtrail-logs \\\n    --vpc-flow-bucket my-vpc-flow-logs \\\n    --s3-access-bucket my-s3-access-logs \\\n    --alb-bucket my-alb-logs \\\n    --account-id 123456789012 \\\n    --regions us-east-1,us-west-2\n```\n","# Performing Cloud Log Forensics with AWS Athena\n\n## When to Use\n\n- When investigating AWS security incidents that require querying massive volumes of cloud logs\n- When performing forensic analysis across CloudTrail, VPC Flow Logs, S3 access logs, and ALB logs\n- When building reusable Athena tables with partition projection for ongoing incident response\n- When hunting for indicators of compromise across multiple AWS log sources simultaneously\n- When creating evidence-grade SQL queries for compliance audits or legal proceedings\n\n## Prerequisites\n\n- AWS account with Athena, S3, and Glue permissions\n- CloudTrail configured to deliver logs to an S3 bucket\n- VPC Flow Logs enabled and publishing to S3\n- S3 server access logging enabled on target buckets\n- ALB access logging enabled and publishing to S3\n- Python 3.8+ with boto3 installed\n- Appropriate IAM permissions for Athena queries and S3 access\n\n## Instructions\n\n### Phase 1: Create Athena Database and CloudTrail Table\n\nCreate a dedicated forensics database and CloudTrail table using partition projection\nto automatically discover partitions without manual ALTER TABLE statements.\n\n```sql\nCREATE DATABASE IF NOT EXISTS cloud_forensics;\n\nCREATE EXTERNAL TABLE cloud_forensics.cloudtrail_logs (\n    eventVersion STRING,\n    userIdentity STRUCT\u003C\n        type: STRING,\n        principalId: STRING,\n        arn: STRING,\n        accountId: STRING,\n        invokedBy: STRING,\n        accessKeyId: STRING,\n        userName: STRING,\n        sessionContext: STRUCT\u003C\n            attributes: STRUCT\u003C\n                mfaAuthenticated: STRING,\n                creationDate: STRING>,\n            sessionIssuer: STRUCT\u003C\n                type: STRING,\n                principalId: STRING,\n                arn: STRING,\n                accountId: STRING,\n                userName: STRING>,\n            ec2RoleDelivery: STRING,\n            webIdFederationData: STRUCT\u003C\n                federatedProvider: STRING,\n                attributes: MAP\u003CSTRING, STRING>>>>,\n    eventTime STRING,\n    eventSource STRING,\n    eventName STRING,\n    awsRegion STRING,\n    sourceIPAddress STRING,\n    userAgent STRING,\n    errorCode STRING,\n    errorMessage STRING,\n    requestParameters STRING,\n    responseElements STRING,\n    additionalEventData STRING,\n    requestId STRING,\n    eventId STRING,\n    readOnly STRING,\n    resources ARRAY\u003CSTRUCT\u003C\n        arn: STRING,\n        accountId: STRING,\n        type: STRING>>,\n    eventType STRING,\n    apiVersion STRING,\n    recipientAccountId STRING,\n    serviceEventDetails STRING,\n    sharedEventID STRING,\n    vpcEndpointId STRING,\n    tlsDetails STRUCT\u003C\n        tlsVersion: STRING,\n        cipherSuite: STRING,\n        clientProvidedHostHeader: STRING>\n)\nCOMMENT 'CloudTrail logs with partition projection for forensic analysis'\nPARTITIONED BY (\n    `account` STRING,\n    `region` STRING,\n    `timestamp` STRING\n)\nROW FORMAT SERDE 'org.apache.hive.hcatalog.data.JsonSerDe'\nSTORED AS INPUTFORMAT 'com.amazon.emr.cloudtrail.CloudTrailInputFormat'\nOUTPUTFORMAT 'org.apache.hadoop.hive.ql.io.HiveIgnoreKeyTextOutputFormat'\nLOCATION 's3:\u002F\u002FYOUR-CLOUDTRAIL-BUCKET\u002FAWSLogs\u002F'\nTBLPROPERTIES (\n    'projection.enabled' = 'true',\n    'projection.account.type' = 'enum',\n    'projection.account.values' = 'YOUR_ACCOUNT_ID',\n    'projection.region.type' = 'enum',\n    'projection.region.values' = 'us-east-1,us-west-2,eu-west-1',\n    'projection.timestamp.type' = 'date',\n    'projection.timestamp.format' = 'yyyy\u002FMM\u002Fdd',\n    'projection.timestamp.range' = '2023\u002F01\u002F01,NOW',\n    'projection.timestamp.interval' = '1',\n    'projection.timestamp.interval.unit' = 'DAYS',\n    'storage.location.template' = 's3:\u002F\u002FYOUR-CLOUDTRAIL-BUCKET\u002FAWSLogs\u002F${account}\u002FCloudTrail\u002F${region}\u002F${timestamp}'\n);\n```\n\n### Phase 2: Create VPC Flow Logs Table\n\n```sql\nCREATE EXTERNAL TABLE cloud_forensics.vpc_flow_logs (\n    version INT,\n    account_id STRING,\n    interface_id STRING,\n    srcaddr STRING,\n    dstaddr STRING,\n    srcport INT,\n    dstport INT,\n    protocol BIGINT,\n    packets BIGINT,\n    bytes BIGINT,\n    start BIGINT,\n    `end` BIGINT,\n    action STRING,\n    log_status STRING,\n    vpc_id STRING,\n    subnet_id STRING,\n    az_id STRING,\n    sublocation_type STRING,\n    sublocation_id STRING,\n    pkt_srcaddr STRING,\n    pkt_dstaddr STRING,\n    region STRING,\n    pkt_src_aws_service STRING,\n    pkt_dst_aws_service STRING,\n    flow_direction STRING,\n    traffic_path INT\n)\nPARTITIONED BY (\n    `date` STRING\n)\nROW FORMAT DELIMITED\nFIELDS TERMINATED BY ' '\nLOCATION 's3:\u002F\u002FYOUR-VPC-FLOW-LOGS-BUCKET\u002FAWSLogs\u002FYOUR_ACCOUNT_ID\u002Fvpcflowlogs\u002F'\nTBLPROPERTIES (\n    'skip.header.line.count' = '1',\n    'projection.enabled' = 'true',\n    'projection.date.type' = 'date',\n    'projection.date.format' = 'yyyy\u002FMM\u002Fdd',\n    'projection.date.range' = '2023\u002F01\u002F01,NOW',\n    'projection.date.interval' = '1',\n    'projection.date.interval.unit' = 'DAYS',\n    'storage.location.template' = 's3:\u002F\u002FYOUR-VPC-FLOW-LOGS-BUCKET\u002FAWSLogs\u002FYOUR_ACCOUNT_ID\u002Fvpcflowlogs\u002Fus-east-1\u002F${date}'\n);\n```\n\n### Phase 3: Create S3 Access Logs Table\n\n```sql\nCREATE EXTERNAL TABLE cloud_forensics.s3_access_logs (\n    bucket_owner STRING,\n    bucket_name STRING,\n    request_datetime STRING,\n    remote_ip STRING,\n    requester STRING,\n    request_id STRING,\n    operation STRING,\n    key STRING,\n    request_uri STRING,\n    http_status INT,\n    error_code STRING,\n    bytes_sent BIGINT,\n    object_size BIGINT,\n    total_time INT,\n    turn_around_time INT,\n    referrer STRING,\n    user_agent STRING,\n    version_id STRING,\n    host_id STRING,\n    signature_version STRING,\n    cipher_suite STRING,\n    authentication_type STRING,\n    host_header STRING,\n    tls_version STRING,\n    access_point_arn STRING,\n    acl_required STRING\n)\nROW FORMAT SERDE 'org.apache.hadoop.hive.serde2.RegexSerDe'\nWITH SERDEPROPERTIES (\n    'serialization.format' = '1',\n    'input.regex' = '([^ ]*) ([^ ]*) \\\\[(.*?)\\\\] ([^ ]*) ([^ ]*) ([^ ]*) ([^ ]*) ([^ ]*) (\\\"[^\\\"]*\\\"|-) (-|[0-9]*) ([^ ]*) ([^ ]*) ([^ ]*) ([^ ]*) ([^ ]*) ([^ ]*) (\\\"[^\\\"]*\\\"|-) ([^ ]*) ([^ ]*) ([^ ]*) ([^ ]*) ([^ ]*) ([^ ]*) ([^ ]*) ([^ ]*) ([^ ]*)'\n)\nSTORED AS INPUTFORMAT 'org.apache.hadoop.mapred.TextInputFormat'\nOUTPUTFORMAT 'org.apache.hadoop.hive.ql.io.HiveIgnoreKeyTextOutputFormat'\nLOCATION 's3:\u002F\u002FYOUR-S3-ACCESS-LOGS-BUCKET\u002Flogs\u002F';\n```\n\n### Phase 4: Create ALB Access Logs Table\n\n```sql\nCREATE EXTERNAL TABLE cloud_forensics.alb_access_logs (\n    type STRING,\n    time STRING,\n    elb STRING,\n    client_ip STRING,\n    client_port INT,\n    target_ip STRING,\n    target_port INT,\n    request_processing_time DOUBLE,\n    target_processing_time DOUBLE,\n    response_processing_time DOUBLE,\n    elb_status_code INT,\n    target_status_code STRING,\n    received_bytes BIGINT,\n    sent_bytes BIGINT,\n    request_verb STRING,\n    request_url STRING,\n    request_proto STRING,\n    user_agent STRING,\n    ssl_cipher STRING,\n    ssl_protocol STRING,\n    target_group_arn STRING,\n    trace_id STRING,\n    domain_name STRING,\n    chosen_cert_arn STRING,\n    matched_rule_priority STRING,\n    request_creation_time STRING,\n    actions_executed STRING,\n    redirect_url STRING,\n    lambda_error_reason STRING,\n    target_port_list STRING,\n    target_status_code_list STRING,\n    classification STRING,\n    classification_reason STRING,\n    conn_trace_id STRING\n)\nPARTITIONED BY (\n    `day` STRING\n)\nROW FORMAT SERDE 'org.apache.hadoop.hive.serde2.RegexSerDe'\nWITH SERDEPROPERTIES (\n    'serialization.format' = '1',\n    'input.regex' = '([^ ]*) ([^ ]*) ([^ ]*) ([^ ]*):([0-9]*) ([^ ]*)[:-]([0-9]*) ([-.0-9]*) ([-.0-9]*) ([-.0-9]*) (|[0-9]*) (-|[0-9]*) ([-0-9]*) ([-0-9]*) \\\"([^ ]*) (.*) (- |[^ ]*)\\\" \\\"([^\\\"]*)\\\" ([A-Z0-9-_]+) ([A-Za-z0-9.-]*) ([^ ]*) \\\"([^\\\"]*)\\\" \\\"([^\\\"]*)\\\" \\\"([^\\\"]*)\\\" ([-.0-9]*) ([^ ]*) \\\"([^\\\"]*)\\\" \\\"([^\\\"]*)\\\" \\\"([^ ]*)\\\" \\\"([^\\\"]*)\\\" \\\"([^ ]*)\\\" \\\"([^ ]*)\\\" \\\"([^ ]*)\\\"'\n)\nSTORED AS INPUTFORMAT 'org.apache.hadoop.mapred.TextInputFormat'\nOUTPUTFORMAT 'org.apache.hadoop.hive.ql.io.HiveIgnoreKeyTextOutputFormat'\nLOCATION 's3:\u002F\u002FYOUR-ALB-LOGS-BUCKET\u002FAWSLogs\u002FYOUR_ACCOUNT_ID\u002Felasticloadbalancing\u002Fus-east-1\u002F'\nTBLPROPERTIES (\n    'projection.enabled' = 'true',\n    'projection.day.type' = 'date',\n    'projection.day.format' = 'yyyy\u002FMM\u002Fdd',\n    'projection.day.range' = '2023\u002F01\u002F01,NOW',\n    'projection.day.interval' = '1',\n    'projection.day.interval.unit' = 'DAYS',\n    'storage.location.template' = 's3:\u002F\u002FYOUR-ALB-LOGS-BUCKET\u002FAWSLogs\u002FYOUR_ACCOUNT_ID\u002Felasticloadbalancing\u002Fus-east-1\u002F${day}'\n);\n```\n\n### Phase 5: Forensic Investigation Queries\n\n#### Detect Unauthorized API Calls\n\n```sql\nSELECT\n    eventtime,\n    useridentity.arn AS caller_arn,\n    useridentity.accountid AS account,\n    eventsource,\n    eventname,\n    errorcode,\n    errormessage,\n    sourceipaddress,\n    useragent\nFROM cloud_forensics.cloudtrail_logs\nWHERE errorcode IN ('AccessDenied', 'UnauthorizedAccess', 'Client.UnauthorizedAccess')\n    AND timestamp BETWEEN '2024\u002F01\u002F01' AND '2024\u002F12\u002F31'\nORDER BY eventtime DESC\nLIMIT 1000;\n```\n\n#### Detect Privilege Escalation Attempts\n\n```sql\nSELECT\n    eventtime,\n    useridentity.arn AS actor,\n    eventname,\n    eventsource,\n    json_extract_scalar(requestparameters, '$.policyArn') AS policy_arn,\n    json_extract_scalar(requestparameters, '$.roleName') AS role_name,\n    json_extract_scalar(requestparameters, '$.userName') AS target_user,\n    sourceipaddress\nFROM cloud_forensics.cloudtrail_logs\nWHERE eventname IN (\n    'AttachUserPolicy', 'AttachRolePolicy', 'AttachGroupPolicy',\n    'PutUserPolicy', 'PutRolePolicy', 'PutGroupPolicy',\n    'CreatePolicyVersion', 'SetDefaultPolicyVersion',\n    'AddUserToGroup', 'UpdateAssumeRolePolicy',\n    'CreateAccessKey', 'CreateLoginProfile',\n    'UpdateLoginProfile', 'AssumeRole'\n)\n    AND timestamp BETWEEN '2024\u002F01\u002F01' AND '2024\u002F12\u002F31'\nORDER BY eventtime DESC;\n```\n\n#### Detect Data Exfiltration via S3\n\n```sql\nSELECT\n    eventtime,\n    useridentity.arn AS actor,\n    eventname,\n    json_extract_scalar(requestparameters, '$.bucketName') AS bucket,\n    json_extract_scalar(requestparameters, '$.key') AS object_key,\n    sourceipaddress,\n    useragent\nFROM cloud_forensics.cloudtrail_logs\nWHERE eventsource = 's3.amazonaws.com'\n    AND eventname IN ('GetObject', 'CopyObject', 'PutBucketPolicy',\n                      'PutBucketAcl', 'PutObjectAcl', 'SelectObjectContent')\n    AND sourceipaddress NOT LIKE '10.%'\n    AND sourceipaddress NOT LIKE '172.%'\n    AND sourceipaddress NOT LIKE '192.168.%'\n    AND timestamp BETWEEN '2024\u002F01\u002F01' AND '2024\u002F12\u002F31'\nORDER BY eventtime DESC;\n```\n\n#### Detect Lateral Movement via VPC Flow Logs\n\n```sql\nSELECT\n    srcaddr,\n    dstaddr,\n    dstport,\n    protocol,\n    SUM(packets) AS total_packets,\n    SUM(bytes) AS total_bytes,\n    COUNT(*) AS connection_count,\n    MIN(from_unixtime(start)) AS first_seen,\n    MAX(from_unixtime(\"end\")) AS last_seen\nFROM cloud_forensics.vpc_flow_logs\nWHERE action = 'ACCEPT'\n    AND srcaddr LIKE '10.%'\n    AND dstport IN (22, 3389, 5985, 5986, 445, 135, 139)\n    AND date BETWEEN '2024\u002F06\u002F01' AND '2024\u002F06\u002F30'\nGROUP BY srcaddr, dstaddr, dstport, protocol\nHAVING COUNT(*) > 100\nORDER BY connection_count DESC;\n```\n\n#### Detect Port Scanning Activity\n\n```sql\nSELECT\n    srcaddr,\n    COUNT(DISTINCT dstport) AS unique_ports_scanned,\n    COUNT(DISTINCT dstaddr) AS unique_targets,\n    SUM(packets) AS total_packets,\n    MIN(from_unixtime(start)) AS first_seen,\n    MAX(from_unixtime(\"end\")) AS last_seen\nFROM cloud_forensics.vpc_flow_logs\nWHERE action = 'REJECT'\n    AND date BETWEEN '2024\u002F06\u002F01' AND '2024\u002F06\u002F30'\nGROUP BY srcaddr\nHAVING COUNT(DISTINCT dstport) > 25\nORDER BY unique_ports_scanned DESC;\n```\n\n#### Detect Suspicious S3 Bulk Downloads\n\n```sql\nSELECT\n    remote_ip,\n    requester,\n    bucket_name,\n    COUNT(*) AS request_count,\n    SUM(bytes_sent) AS total_bytes_downloaded,\n    COUNT(DISTINCT key) AS unique_objects,\n    MIN(request_datetime) AS first_request,\n    MAX(request_datetime) AS last_request\nFROM cloud_forensics.s3_access_logs\nWHERE operation LIKE '%GET%'\n    AND http_status = 200\nGROUP BY remote_ip, requester, bucket_name\nHAVING COUNT(*) > 500\nORDER BY total_bytes_downloaded DESC;\n```\n\n#### Detect ALB-Level Injection Attempts\n\n```sql\nSELECT\n    time,\n    client_ip,\n    request_verb,\n    request_url,\n    elb_status_code,\n    target_status_code,\n    user_agent\nFROM cloud_forensics.alb_access_logs\nWHERE (\n    request_url LIKE '%UNION%SELECT%'\n    OR request_url LIKE '%\u003Cscript%'\n    OR request_url LIKE '%..\u002F..\u002F..\u002F%'\n    OR request_url LIKE '%\u002Fetc\u002Fpasswd%'\n    OR request_url LIKE '%cmd.exe%'\n    OR request_url LIKE '%\u002Fproc\u002Fself%'\n    OR request_url LIKE '%SLEEP(%'\n    OR request_url LIKE '%WAITFOR%'\n)\n    AND day BETWEEN '2024\u002F06\u002F01' AND '2024\u002F06\u002F30'\nORDER BY time DESC;\n```\n\n### Phase 6: Cross-Log Correlation\n\nCorrelate findings across log sources for comprehensive incident timelines.\n\n```sql\n-- Correlate suspicious CloudTrail actor with VPC Flow Logs\nWITH suspicious_ips AS (\n    SELECT DISTINCT sourceipaddress AS ip\n    FROM cloud_forensics.cloudtrail_logs\n    WHERE errorcode = 'AccessDenied'\n        AND timestamp BETWEEN '2024\u002F06\u002F01' AND '2024\u002F06\u002F30'\n)\nSELECT\n    v.srcaddr,\n    v.dstaddr,\n    v.dstport,\n    v.protocol,\n    SUM(v.bytes) AS total_bytes,\n    COUNT(*) AS flow_count\nFROM cloud_forensics.vpc_flow_logs v\nJOIN suspicious_ips s ON v.srcaddr = s.ip\nWHERE v.date BETWEEN '2024\u002F06\u002F01' AND '2024\u002F06\u002F30'\nGROUP BY v.srcaddr, v.dstaddr, v.dstport, v.protocol\nORDER BY total_bytes DESC;\n```\n\n## Examples\n\n```python\n# Quick-start: run the forensics agent for a full investigation\npython agent.py \\\n    --action full_investigation \\\n    --database cloud_forensics \\\n    --start-date 2024-06-01 \\\n    --end-date 2024-06-30 \\\n    --output forensics_report.json\n\n# Run specific queries only\npython agent.py \\\n    --action privilege_escalation \\\n    --database cloud_forensics \\\n    --start-date 2024-06-15 \\\n    --end-date 2024-06-16\n\n# Create all forensic tables from scratch\npython agent.py \\\n    --action setup_tables \\\n    --cloudtrail-bucket my-cloudtrail-logs \\\n    --vpc-flow-bucket my-vpc-flow-logs \\\n    --s3-access-bucket my-s3-access-logs \\\n    --alb-bucket my-alb-logs \\\n    --account-id 123456789012 \\\n    --regions us-east-1,us-west-2\n```\n",{"name":5,"domain":25,"description":7},"main","a91f1293287ffa9f4f1b8f486cd6e835a1568c84","skills\u002Fcloud-logs-athena","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace","https:\u002F\u002Fgithub.com\u002FDCx7C5","#Python","2026-09-01 11:21:00",{"source":8,"skillName":5,"commands":42,"prompt":52,"zipAvailable":53},[43,46,49],{"tool":44,"command":45},"npx","npx skills add DCx7C5\u002Fai-marketplace --skill cloud-logs-athena",{"tool":47,"command":48},"bunx","bunx skills add DCx7C5\u002Fai-marketplace --skill cloud-logs-athena",{"tool":50,"command":51},"pnpm","pnpm dlx skills add DCx7C5\u002Fai-marketplace --skill cloud-logs-athena","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fcloud-logs-athena\u002FSKILL.md",true,[55],{"path":56,"resourceType":57,"resourceTypeDesc":58,"sizeBytes":59,"sourceHtmlUrl":60},"index.json","REFERENCE","参考文档",505,"https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fcloud-logs-athena\u002Findex.json",[62,87,110,132,154,170],{"skillNo":63,"name":64,"nameZh":6,"description":65,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":66,"categories":67,"keywords":68,"publishedAt":29},"01M71HAPZ01KQ30RKTB0FFSQ05","services-wmi-persistence-detect","Detect WMI event subscription persistence by enumerating ActiveScriptEventConsumer, CommandLineEventConsumer, and permanent subscriptions in the WMI repository.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fservices\u002Fwmi\u002Fpersistence\u002Fdetect\u002FSKILL.md",[],[69,70,71,72,73,74,75,76,77,78,79,80,81,82,83,84,85,25,86],"services","detect","services wmi persistence detect","wmi","persistence","de","cm","process","activescript","event","subscriptions","commandline-consumer","repository","subscription","event-subscription","t1546.003","forensics","process-forensics",{"skillNo":88,"name":89,"nameZh":6,"description":90,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":91,"categories":92,"keywords":93,"publishedAt":29},"01M71HAK6JTTTS229T17WJMMCG","services-wmi-exec-exploit","Perform lateral movement across Windows networks using WMI-based remote execution techniques including Impacket wmiexec.py, CrackMapExec, and native WMI commands for stealthy post-exploitation during red team engagements.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fservices\u002Fwmi\u002Fexec\u002Fexploit\u002FSKILL.md",[],[94,69,95,72,96,97,98,25,99,100,101,102,103,104,74,105,106,107,108,109],"exploit","services wmi exec exploit","exec","remote","traffic","Bash","analysis","team","across","crackmapexec","native","command","lateral movement","read","lateral-movement","Impacket",{"skillNo":111,"name":112,"nameZh":6,"description":113,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":114,"categories":115,"keywords":116,"publishedAt":29},"01M71HAG6MHKNQV8KDZKMT4886","registry-artifact-extract","Extract and analyze Windows Registry hives to uncover user activity, installed software, autostart entries, and evidence of system compromise.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fregistry\u002Fartifact\u002Fextract\u002FSKILL.md",[],[117,118,119,120,121,122,25,99,123,100,124,125,74,107,126,127,128,129,130,131],"artifact","registry","registry artifact extract","extract","evidence-collection","artifact-analysis","collection","analyze","uncover","software","activity","digital-forensics","windows-registry","regripper","sonnet",{"skillNo":133,"name":134,"nameZh":6,"description":135,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":136,"categories":137,"keywords":138,"publishedAt":29},"01M71HACR4A8XTWTTSXK4124AA","processes-token-impersonate-detect","Detect Windows token impersonation and privilege abuse including SeImpersonatePrivilege exploitation via Potato attacks and token stealing techniques.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fprocesses\u002Ftoken\u002Fimpersonate\u002Fdetect\u002FSKILL.md",[],[70,139,140,141,142,143,144,75,145,25,86,146,147,148,149,150,151,152,153,74],"processes token impersonate detect","token","processes","attacks","windows","escalation","techniques","privilege-escalation","seimpersonate","token-impersonation","printspoofer","exploitation","potato","impersonation","via",{"skillNo":155,"name":156,"nameZh":6,"description":157,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":158,"categories":159,"keywords":160,"publishedAt":29},"01M71HAABSB4Z6QFSXEG00R4RK","processes-thread-injection-detect","Detect Windows thread injection techniques including CreateRemoteThread, QueueUserAPC, NtCreateThreadEx, and thread hijacking via process memory analysis.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fprocesses\u002Fthread\u002Finjection\u002Fdetect\u002FSKILL.md",[],[161,162,70,163,141,143,164,75,165,145,25,86,100,166,167,168,169,153,74,76],"thread","processes thread injection detect","injection","memory","process-injection","api","apc-injection","thread-injection","nt-api",{"skillNo":171,"name":172,"nameZh":6,"description":173,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":174,"categories":175,"keywords":176,"publishedAt":29},"01M71HA7H311V5G14WMX58HQSS","processes-hollow-technique-detect","Detect process hollowing (RunPE) by identifying processes with mismatched image paths between PEB and VAD tree, or unmapped PE headers in memory.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fprocesses\u002Fhollow\u002Ftechnique\u002Fdetect\u002FSKILL.md",[],[177,70,141,178,164,75,179,180,25,86,181,182,183,184,185,186,74,76,187,188],"processes hollow technique detect","tree","memory-forensics","process-hollow","peb","runpe","image","pe-header","in memory","with","mismatched","headers"]