[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M71C9SPAEMF90K0RFHMTV5WK":3,"skill-same:01M71C9SPAEMF90K0RFHMTV5WK":57},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":18,"publishedAt":25,"linkOnly":26,"markdownContent":27,"markdownBody":28,"frontMatter":29,"refName":30,"commitSha":31,"skillDirectory":32,"forksCount":14,"repositoryHtmlUrl":33,"repositoryHomepageUrl":6,"ownerHtmlUrl":34,"ownerBlogUrl":6,"ownerDescription":35,"updatedAt":36,"install":37,"resources":50},"01M71C9SPAEMF90K0RFHMTV5WK","cloud-platform-general-overview",null,"Cloud Platform General Overview.","DCx7C5\u002Fai-marketplace","DCx7C5","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F42419559?v=4","01M71C01G2AZV3NTNGWAWSHJPP","DC","01M71C01GQW6G50S2BYMS7PP3E",0,"MIT","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fcloud-platform-general-overview\u002FSKILL.md",[],[19,20,21,22,23,24],"cloud","overview","general","platform","cloud platform general overview","cybersecurity","2026-11-10 10:12:30",false,"---\nname: cloud-platform-general-overview\ndescription: \"Cloud Platform General Overview.\"\ndomain: cybersecurity\n---\n\n|\n| CSPM | Cloud Security Posture Management, the practice of continuously monitoring cloud infrastructure for misconfigurations and compliance violations |\n| Configuration Drift | Unintended changes to cloud resource configurations that deviate from the approved security baseline over time |\n| Security Baseline | A documented set of minimum security configuration requirements that all cloud resources must meet |\n| Compliance Framework | A structured set of security controls and requirements (CIS, SOC 2, PCI DSS, NIST) against which cloud configurations are evaluated |\n| Finding Severity | Risk classification of a misconfiguration based on exploitability and potential impact (Critical, High, Medium, Low, Informational) |\n| Auto-Remediation | Automated corrective action that restores a non-compliant resource to its required configuration without manual intervention |\n\n## Tools & Systems\n\n- **Prowler**: Open-source multi-cloud security assessment tool with 300+ checks aligned to CIS, PCI DSS, HIPAA, and NIST\n- **ScoutSuite**: Multi-cloud security auditing tool producing risk-scored HTML reports from API-collected configuration data\n- **AWS Security Hub**: AWS-native CSPM with aggregated findings and compliance standard evaluation\n- **Microsoft Defender for Cloud**: Azure-native CSPM with secure score, regulatory compliance, and workload protection\n- **GCP Security Command Center**: GCP-native security platform with asset inventory, vulnerability scanning, and compliance monitoring\n\n## Common Scenarios\n\n### Scenario: Establishing CSPM for a Multi-Cloud Enterprise\n\n**Context**: An enterprise runs production workloads across AWS (primary), Azure (identity and Microsoft services), and GCP (data analytics). The security team needs unified posture visibility.\n\n**Approach**:\n1. Enable cloud-native CSPM in each provider: Security Hub, Defender for Cloud, SCC\n2. Deploy Prowler scans as daily scheduled jobs in each environment via CI\u002FCD pipelines\n3. Normalize and aggregate findings into a central data lake using the aggregation script\n4. Build dashboards in Grafana or Kibana showing posture scores by cloud, account, and severity\n5. Configure auto-remediation for known-good fixes (public access blocks, encryption enablement)\n6. Route CRITICAL findings to PagerDuty for immediate response and HIGH findings to Jira tickets\n7. Produce weekly compliance reports for executive stakeholders showing trend data\n\n**Pitfalls**: Running CSPM tools with overly broad permissions creates a high-value target. Use dedicated service accounts with read-only permissions and rotate credentials regularly. Different CSPM tools may report the same misconfiguration differently, so deduplication logic must account for varying resource ID formats and finding titles across tools.\n\n## Output Format\n\n```\nCloud Security Posture Management Dashboard\n==============================================\nOrganization: Acme Corp\nAssessment Date: 2026-02-23\nEnvironments: AWS (12 accounts), Azure (8 subscriptions), GCP (5 projects)\n\nPOSTURE SCORES:\n  AWS:   82\u002F100  (+3 from last week)\n  Azure: 76\u002F100  (-1 from last week)\n  GCP:   79\u002F100  (+5 from last week)\n  Overall: 79\u002F100\n\nFINDINGS BY SEVERITY:\n  Critical:  18 (AWS: 7, Azure: 8, GCP: 3)\n  High:      67 (AWS: 28, Azure: 24, GCP: 15)\n  Medium:   234 (AWS: 98, Azure: 87, GCP: 49)\n  Low:      412 (AWS: 178, Azure: 134, GCP: 100)\n\nTOP FAILING CATEGORIES:\n  1. IAM overly permissive policies     (43 findings)\n  2. Encryption not enabled at rest      (38 findings)\n  3. Public network exposure             (29 findings)\n  4. Logging and monitoring gaps         (24 findings)\n  5. Unused credentials and keys         (19 findings)\n\nAUTO-REMEDIATION (Last 7 Days):\n  Findings auto-remediated:  34\n  Manual remediation pending: 51\n  Exceptions approved:        8\n```\n","|\n| CSPM | Cloud Security Posture Management, the practice of continuously monitoring cloud infrastructure for misconfigurations and compliance violations |\n| Configuration Drift | Unintended changes to cloud resource configurations that deviate from the approved security baseline over time |\n| Security Baseline | A documented set of minimum security configuration requirements that all cloud resources must meet |\n| Compliance Framework | A structured set of security controls and requirements (CIS, SOC 2, PCI DSS, NIST) against which cloud configurations are evaluated |\n| Finding Severity | Risk classification of a misconfiguration based on exploitability and potential impact (Critical, High, Medium, Low, Informational) |\n| Auto-Remediation | Automated corrective action that restores a non-compliant resource to its required configuration without manual intervention |\n\n## Tools & Systems\n\n- **Prowler**: Open-source multi-cloud security assessment tool with 300+ checks aligned to CIS, PCI DSS, HIPAA, and NIST\n- **ScoutSuite**: Multi-cloud security auditing tool producing risk-scored HTML reports from API-collected configuration data\n- **AWS Security Hub**: AWS-native CSPM with aggregated findings and compliance standard evaluation\n- **Microsoft Defender for Cloud**: Azure-native CSPM with secure score, regulatory compliance, and workload protection\n- **GCP Security Command Center**: GCP-native security platform with asset inventory, vulnerability scanning, and compliance monitoring\n\n## Common Scenarios\n\n### Scenario: Establishing CSPM for a Multi-Cloud Enterprise\n\n**Context**: An enterprise runs production workloads across AWS (primary), Azure (identity and Microsoft services), and GCP (data analytics). The security team needs unified posture visibility.\n\n**Approach**:\n1. Enable cloud-native CSPM in each provider: Security Hub, Defender for Cloud, SCC\n2. Deploy Prowler scans as daily scheduled jobs in each environment via CI\u002FCD pipelines\n3. Normalize and aggregate findings into a central data lake using the aggregation script\n4. Build dashboards in Grafana or Kibana showing posture scores by cloud, account, and severity\n5. Configure auto-remediation for known-good fixes (public access blocks, encryption enablement)\n6. Route CRITICAL findings to PagerDuty for immediate response and HIGH findings to Jira tickets\n7. Produce weekly compliance reports for executive stakeholders showing trend data\n\n**Pitfalls**: Running CSPM tools with overly broad permissions creates a high-value target. Use dedicated service accounts with read-only permissions and rotate credentials regularly. Different CSPM tools may report the same misconfiguration differently, so deduplication logic must account for varying resource ID formats and finding titles across tools.\n\n## Output Format\n\n```\nCloud Security Posture Management Dashboard\n==============================================\nOrganization: Acme Corp\nAssessment Date: 2026-02-23\nEnvironments: AWS (12 accounts), Azure (8 subscriptions), GCP (5 projects)\n\nPOSTURE SCORES:\n  AWS:   82\u002F100  (+3 from last week)\n  Azure: 76\u002F100  (-1 from last week)\n  GCP:   79\u002F100  (+5 from last week)\n  Overall: 79\u002F100\n\nFINDINGS BY SEVERITY:\n  Critical:  18 (AWS: 7, Azure: 8, GCP: 3)\n  High:      67 (AWS: 28, Azure: 24, GCP: 15)\n  Medium:   234 (AWS: 98, Azure: 87, GCP: 49)\n  Low:      412 (AWS: 178, Azure: 134, GCP: 100)\n\nTOP FAILING CATEGORIES:\n  1. IAM overly permissive policies     (43 findings)\n  2. Encryption not enabled at rest      (38 findings)\n  3. Public network exposure             (29 findings)\n  4. Logging and monitoring gaps         (24 findings)\n  5. Unused credentials and keys         (19 findings)\n\nAUTO-REMEDIATION (Last 7 Days):\n  Findings auto-remediated:  34\n  Manual remediation pending: 51\n  Exceptions approved:        8\n```\n",{"name":5,"domain":24,"description":7},"main","a91f1293287ffa9f4f1b8f486cd6e835a1568c84","skills\u002Fcloud-platform-general-overview","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace","https:\u002F\u002Fgithub.com\u002FDCx7C5","#Python","2026-09-01 11:21:00",{"source":8,"skillName":5,"commands":38,"prompt":48,"zipAvailable":49},[39,42,45],{"tool":40,"command":41},"npx","npx skills add DCx7C5\u002Fai-marketplace --skill cloud-platform-general-overview",{"tool":43,"command":44},"bunx","bunx skills add DCx7C5\u002Fai-marketplace --skill cloud-platform-general-overview",{"tool":46,"command":47},"pnpm","pnpm dlx skills add DCx7C5\u002Fai-marketplace --skill cloud-platform-general-overview","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fcloud-platform-general-overview\u002FSKILL.md",true,[51],{"path":52,"resourceType":53,"resourceTypeDesc":54,"sizeBytes":55,"sourceHtmlUrl":56},"index.json","REFERENCE","参考文档",524,"https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fcloud-platform-general-overview\u002Findex.json",[58,83,106,128,150,166],{"skillNo":59,"name":60,"nameZh":6,"description":61,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":62,"categories":63,"keywords":64,"publishedAt":25},"01M71HAPZ01KQ30RKTB0FFSQ05","services-wmi-persistence-detect","Detect WMI event subscription persistence by enumerating ActiveScriptEventConsumer, CommandLineEventConsumer, and permanent subscriptions in the WMI repository.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fservices\u002Fwmi\u002Fpersistence\u002Fdetect\u002FSKILL.md",[],[65,66,67,68,69,70,71,72,73,74,75,76,77,78,79,80,81,24,82],"services","detect","services wmi persistence detect","wmi","persistence","de","cm","process","activescript","event","subscriptions","commandline-consumer","repository","subscription","event-subscription","t1546.003","forensics","process-forensics",{"skillNo":84,"name":85,"nameZh":6,"description":86,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":87,"categories":88,"keywords":89,"publishedAt":25},"01M71HAK6JTTTS229T17WJMMCG","services-wmi-exec-exploit","Perform lateral movement across Windows networks using WMI-based remote execution techniques including Impacket wmiexec.py, CrackMapExec, and native WMI commands for stealthy post-exploitation during red team engagements.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fservices\u002Fwmi\u002Fexec\u002Fexploit\u002FSKILL.md",[],[90,65,91,68,92,93,94,24,95,96,97,98,99,100,70,101,102,103,104,105],"exploit","services wmi exec exploit","exec","remote","traffic","Bash","analysis","team","across","crackmapexec","native","command","lateral movement","read","lateral-movement","Impacket",{"skillNo":107,"name":108,"nameZh":6,"description":109,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":110,"categories":111,"keywords":112,"publishedAt":25},"01M71HAG6MHKNQV8KDZKMT4886","registry-artifact-extract","Extract and analyze Windows Registry hives to uncover user activity, installed software, autostart entries, and evidence of system compromise.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fregistry\u002Fartifact\u002Fextract\u002FSKILL.md",[],[113,114,115,116,117,118,24,95,119,96,120,121,70,103,122,123,124,125,126,127],"artifact","registry","registry artifact extract","extract","evidence-collection","artifact-analysis","collection","analyze","uncover","software","activity","digital-forensics","windows-registry","regripper","sonnet",{"skillNo":129,"name":130,"nameZh":6,"description":131,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":132,"categories":133,"keywords":134,"publishedAt":25},"01M71HACR4A8XTWTTSXK4124AA","processes-token-impersonate-detect","Detect Windows token impersonation and privilege abuse including SeImpersonatePrivilege exploitation via Potato attacks and token stealing techniques.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fprocesses\u002Ftoken\u002Fimpersonate\u002Fdetect\u002FSKILL.md",[],[66,135,136,137,138,139,140,71,141,24,82,142,143,144,145,146,147,148,149,70],"processes token impersonate detect","token","processes","attacks","windows","escalation","techniques","privilege-escalation","seimpersonate","token-impersonation","printspoofer","exploitation","potato","impersonation","via",{"skillNo":151,"name":152,"nameZh":6,"description":153,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":154,"categories":155,"keywords":156,"publishedAt":25},"01M71HAABSB4Z6QFSXEG00R4RK","processes-thread-injection-detect","Detect Windows thread injection techniques including CreateRemoteThread, QueueUserAPC, NtCreateThreadEx, and thread hijacking via process memory analysis.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fprocesses\u002Fthread\u002Finjection\u002Fdetect\u002FSKILL.md",[],[157,158,66,159,137,139,160,71,161,141,24,82,96,162,163,164,165,149,70,72],"thread","processes thread injection detect","injection","memory","process-injection","api","apc-injection","thread-injection","nt-api",{"skillNo":167,"name":168,"nameZh":6,"description":169,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":170,"categories":171,"keywords":172,"publishedAt":25},"01M71HA7H311V5G14WMX58HQSS","processes-hollow-technique-detect","Detect process hollowing (RunPE) by identifying processes with mismatched image paths between PEB and VAD tree, or unmapped PE headers in memory.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fprocesses\u002Fhollow\u002Ftechnique\u002Fdetect\u002FSKILL.md",[],[173,66,137,174,160,71,175,176,24,82,177,178,179,180,181,182,70,72,183,184],"processes hollow technique detect","tree","memory-forensics","process-hollow","peb","runpe","image","pe-header","in memory","with","mismatched","headers"]