[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M71C9VT5YWW35MWJW5BVFGCP":3,"skill-same:01M71C9VT5YWW35MWJW5BVFGCP":63},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":23,"publishedAt":31,"linkOnly":32,"markdownContent":33,"markdownBody":34,"frontMatter":35,"refName":36,"commitSha":37,"skillDirectory":38,"forksCount":14,"repositoryHtmlUrl":39,"repositoryHomepageUrl":6,"ownerHtmlUrl":40,"ownerBlogUrl":6,"ownerDescription":41,"updatedAt":42,"install":43,"resources":56},"01M71C9VT5YWW35MWJW5BVFGCP","cloud-security-data-protect",null,"Cloud Security Data Protect.","DCx7C5\u002Fai-marketplace","DCx7C5","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F42419559?v=4","01M71C01G2AZV3NTNGWAWSHJPP","DC","01M71C01GQW6G50S2BYMS7PP3E",0,"MIT","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fcloud-security-data-protect\u002FSKILL.md",[18],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000033","数据分析师","PROFESSION","适用职业",[24,25,26,27,28,29,30],"security","cloud","cloud security","data","protect","cloud security data protect","cybersecurity","2026-11-10 10:12:30",false,"---\nname: cloud-security-data-protect\ndescription: \"Cloud Security Data Protect.\"\ndomain: cybersecurity\n---\n\n|\n| S3 Data Events | CloudTrail object-level logging that captures GetObject, PutObject, DeleteObject, and CopyObject API calls with request details |\n| GuardDuty S3 Protection | Threat detection feature analyzing CloudTrail S3 data events to identify anomalous access patterns and exfiltration attempts |\n| Amazon Macie | Data security service that discovers and classifies sensitive data in S3 and generates findings for data exposure risks |\n| VPC Endpoint Policy | Access control policy on an S3 VPC endpoint that restricts which buckets and actions can be accessed through the endpoint |\n| Data Exfiltration | Unauthorized transfer of data from an organization's S3 storage to an external location controlled by an attacker |\n| Anomalous Behavior Detection | Machine learning-based identification of S3 access patterns that deviate from established baselines for a principal |\n\n## Tools & Systems\n\n- **AWS CloudTrail**: Audit logging of S3 object-level operations for forensic analysis and anomaly detection\n- **Amazon GuardDuty**: ML-based threat detection with S3-specific finding types for exfiltration and unauthorized access\n- **Amazon Macie**: Sensitive data discovery and classification for correlating access anomalies with data sensitivity\n- **Amazon Athena**: SQL query engine for analyzing CloudTrail logs at scale to identify bulk download patterns\n- **CloudWatch Logs Insights**: Real-time log analysis for building detection queries against CloudTrail data\n\n## Common Scenarios\n\n### Scenario: Compromised IAM Credentials Used for Bulk S3 Data Download\n\n**Context**: GuardDuty reports an `Exfiltration:S3\u002FObjectRead.Unusual` finding indicating that a developer's access key is downloading thousands of objects from a sensitive data bucket at 3 AM from an IP address in a foreign country.\n\n**Approach**:\n1. Immediately deactivate the compromised access key\n2. Query CloudTrail for all S3 actions by the compromised principal in the last 72 hours\n3. Identify which buckets and objects were accessed using Athena queries\n4. Cross-reference accessed objects with Macie classifications to assess data sensitivity\n5. Check for CopyObject calls to external accounts (cross-account exfiltration)\n6. Review how the credentials were compromised (TruffleHog scan, phishing investigation)\n7. Implement VPC endpoint policies to restrict future S3 access to approved network paths\n\n**Pitfalls**: CloudTrail S3 data events can generate massive log volume. Use Athena with partitioned tables rather than CloudWatch Logs Insights for queries spanning more than 24 hours. GuardDuty baseline learning requires 7-14 days, so new accounts may generate false positives for normal access patterns.\n\n## Output Format\n\n```\nS3 Data Exfiltration Investigation Report\n============================================\nAccount: 123456789012\nDetection Source: GuardDuty Exfiltration:S3\u002FObjectRead.Unusual\nInvestigation Date: 2026-02-23\n\nINCIDENT TIMELINE:\n  2026-02-23 02:47 UTC - First anomalous GetObject from 185.x.x.x\n  2026-02-23 02:47-04:12 UTC - 12,847 GetObject requests\n  2026-02-23 04:15 UTC - GuardDuty finding generated\n  2026-02-23 04:20 UTC - PagerDuty alert received by SOC\n  2026-02-23 04:25 UTC - Access key deactivated\n\nCOMPROMISED PRINCIPAL:\n  ARN: arn:aws:iam::123456789012:user\u002Fdeveloper-jane\n  Access Key: AKIA...WXYZ\n  Source IP: 185.x.x.x (Tor exit node)\n\nDATA IMPACT ASSESSMENT:\n  Buckets accessed: 3\n  Objects downloaded: 12,847\n  Total data volume: 4.7 GB\n  Sensitive data types: PII (SSN, email), Financial (credit card)\n  Macie severity: CRITICAL\n\nCONTAINMENT ACTIONS:\n  [x] Access key deactivated\n  [x] User password reset and MFA re-enrolled\n  [x] VPC endpoint policy applied to sensitive buckets\n  [x] Bucket policy restricting to VPC-only access\n  [x] TruffleHog scan initiated on developer repositories\n```\n","|\n| S3 Data Events | CloudTrail object-level logging that captures GetObject, PutObject, DeleteObject, and CopyObject API calls with request details |\n| GuardDuty S3 Protection | Threat detection feature analyzing CloudTrail S3 data events to identify anomalous access patterns and exfiltration attempts |\n| Amazon Macie | Data security service that discovers and classifies sensitive data in S3 and generates findings for data exposure risks |\n| VPC Endpoint Policy | Access control policy on an S3 VPC endpoint that restricts which buckets and actions can be accessed through the endpoint |\n| Data Exfiltration | Unauthorized transfer of data from an organization's S3 storage to an external location controlled by an attacker |\n| Anomalous Behavior Detection | Machine learning-based identification of S3 access patterns that deviate from established baselines for a principal |\n\n## Tools & Systems\n\n- **AWS CloudTrail**: Audit logging of S3 object-level operations for forensic analysis and anomaly detection\n- **Amazon GuardDuty**: ML-based threat detection with S3-specific finding types for exfiltration and unauthorized access\n- **Amazon Macie**: Sensitive data discovery and classification for correlating access anomalies with data sensitivity\n- **Amazon Athena**: SQL query engine for analyzing CloudTrail logs at scale to identify bulk download patterns\n- **CloudWatch Logs Insights**: Real-time log analysis for building detection queries against CloudTrail data\n\n## Common Scenarios\n\n### Scenario: Compromised IAM Credentials Used for Bulk S3 Data Download\n\n**Context**: GuardDuty reports an `Exfiltration:S3\u002FObjectRead.Unusual` finding indicating that a developer's access key is downloading thousands of objects from a sensitive data bucket at 3 AM from an IP address in a foreign country.\n\n**Approach**:\n1. Immediately deactivate the compromised access key\n2. Query CloudTrail for all S3 actions by the compromised principal in the last 72 hours\n3. Identify which buckets and objects were accessed using Athena queries\n4. Cross-reference accessed objects with Macie classifications to assess data sensitivity\n5. Check for CopyObject calls to external accounts (cross-account exfiltration)\n6. Review how the credentials were compromised (TruffleHog scan, phishing investigation)\n7. Implement VPC endpoint policies to restrict future S3 access to approved network paths\n\n**Pitfalls**: CloudTrail S3 data events can generate massive log volume. Use Athena with partitioned tables rather than CloudWatch Logs Insights for queries spanning more than 24 hours. GuardDuty baseline learning requires 7-14 days, so new accounts may generate false positives for normal access patterns.\n\n## Output Format\n\n```\nS3 Data Exfiltration Investigation Report\n============================================\nAccount: 123456789012\nDetection Source: GuardDuty Exfiltration:S3\u002FObjectRead.Unusual\nInvestigation Date: 2026-02-23\n\nINCIDENT TIMELINE:\n  2026-02-23 02:47 UTC - First anomalous GetObject from 185.x.x.x\n  2026-02-23 02:47-04:12 UTC - 12,847 GetObject requests\n  2026-02-23 04:15 UTC - GuardDuty finding generated\n  2026-02-23 04:20 UTC - PagerDuty alert received by SOC\n  2026-02-23 04:25 UTC - Access key deactivated\n\nCOMPROMISED PRINCIPAL:\n  ARN: arn:aws:iam::123456789012:user\u002Fdeveloper-jane\n  Access Key: AKIA...WXYZ\n  Source IP: 185.x.x.x (Tor exit node)\n\nDATA IMPACT ASSESSMENT:\n  Buckets accessed: 3\n  Objects downloaded: 12,847\n  Total data volume: 4.7 GB\n  Sensitive data types: PII (SSN, email), Financial (credit card)\n  Macie severity: CRITICAL\n\nCONTAINMENT ACTIONS:\n  [x] Access key deactivated\n  [x] User password reset and MFA re-enrolled\n  [x] VPC endpoint policy applied to sensitive buckets\n  [x] Bucket policy restricting to VPC-only access\n  [x] TruffleHog scan initiated on developer repositories\n```\n",{"name":5,"domain":30,"description":7},"main","a91f1293287ffa9f4f1b8f486cd6e835a1568c84","skills\u002Fcloud-security-data-protect","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace","https:\u002F\u002Fgithub.com\u002FDCx7C5","#Python","2026-09-01 11:21:00",{"source":8,"skillName":5,"commands":44,"prompt":54,"zipAvailable":55},[45,48,51],{"tool":46,"command":47},"npx","npx skills add DCx7C5\u002Fai-marketplace --skill cloud-security-data-protect",{"tool":49,"command":50},"bunx","bunx skills add DCx7C5\u002Fai-marketplace --skill cloud-security-data-protect",{"tool":52,"command":53},"pnpm","pnpm dlx skills add DCx7C5\u002Fai-marketplace --skill cloud-security-data-protect","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fcloud-security-data-protect\u002FSKILL.md",true,[57],{"path":58,"resourceType":59,"resourceTypeDesc":60,"sizeBytes":61,"sourceHtmlUrl":62},"index.json","REFERENCE","参考文档",508,"https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fcloud-security-data-protect\u002Findex.json",[64,89,112,134,156,172],{"skillNo":65,"name":66,"nameZh":6,"description":67,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":68,"categories":69,"keywords":70,"publishedAt":31},"01M71HAPZ01KQ30RKTB0FFSQ05","services-wmi-persistence-detect","Detect WMI event subscription persistence by enumerating ActiveScriptEventConsumer, CommandLineEventConsumer, and permanent subscriptions in the WMI repository.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fservices\u002Fwmi\u002Fpersistence\u002Fdetect\u002FSKILL.md",[],[71,72,73,74,75,76,77,78,79,80,81,82,83,84,85,86,87,30,88],"services","detect","services wmi persistence detect","wmi","persistence","de","cm","process","activescript","event","subscriptions","commandline-consumer","repository","subscription","event-subscription","t1546.003","forensics","process-forensics",{"skillNo":90,"name":91,"nameZh":6,"description":92,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":93,"categories":94,"keywords":95,"publishedAt":31},"01M71HAK6JTTTS229T17WJMMCG","services-wmi-exec-exploit","Perform lateral movement across Windows networks using WMI-based remote execution techniques including Impacket wmiexec.py, CrackMapExec, and native WMI commands for stealthy post-exploitation during red team engagements.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fservices\u002Fwmi\u002Fexec\u002Fexploit\u002FSKILL.md",[],[96,71,97,74,98,99,100,30,101,102,103,104,105,106,76,107,108,109,110,111],"exploit","services wmi exec exploit","exec","remote","traffic","Bash","analysis","team","across","crackmapexec","native","command","lateral movement","read","lateral-movement","Impacket",{"skillNo":113,"name":114,"nameZh":6,"description":115,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":116,"categories":117,"keywords":118,"publishedAt":31},"01M71HAG6MHKNQV8KDZKMT4886","registry-artifact-extract","Extract and analyze Windows Registry hives to uncover user activity, installed software, autostart entries, and evidence of system compromise.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fregistry\u002Fartifact\u002Fextract\u002FSKILL.md",[],[119,120,121,122,123,124,30,101,125,102,126,127,76,109,128,129,130,131,132,133],"artifact","registry","registry artifact extract","extract","evidence-collection","artifact-analysis","collection","analyze","uncover","software","activity","digital-forensics","windows-registry","regripper","sonnet",{"skillNo":135,"name":136,"nameZh":6,"description":137,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":138,"categories":139,"keywords":140,"publishedAt":31},"01M71HACR4A8XTWTTSXK4124AA","processes-token-impersonate-detect","Detect Windows token impersonation and privilege abuse including SeImpersonatePrivilege exploitation via Potato attacks and token stealing techniques.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fprocesses\u002Ftoken\u002Fimpersonate\u002Fdetect\u002FSKILL.md",[],[72,141,142,143,144,145,146,77,147,30,88,148,149,150,151,152,153,154,155,76],"processes token impersonate detect","token","processes","attacks","windows","escalation","techniques","privilege-escalation","seimpersonate","token-impersonation","printspoofer","exploitation","potato","impersonation","via",{"skillNo":157,"name":158,"nameZh":6,"description":159,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":160,"categories":161,"keywords":162,"publishedAt":31},"01M71HAABSB4Z6QFSXEG00R4RK","processes-thread-injection-detect","Detect Windows thread injection techniques including CreateRemoteThread, QueueUserAPC, NtCreateThreadEx, and thread hijacking via process memory analysis.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fprocesses\u002Fthread\u002Finjection\u002Fdetect\u002FSKILL.md",[],[163,164,72,165,143,145,166,77,167,147,30,88,102,168,169,170,171,155,76,78],"thread","processes thread injection detect","injection","memory","process-injection","api","apc-injection","thread-injection","nt-api",{"skillNo":173,"name":174,"nameZh":6,"description":175,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":176,"categories":177,"keywords":178,"publishedAt":31},"01M71HA7H311V5G14WMX58HQSS","processes-hollow-technique-detect","Detect process hollowing (RunPE) by identifying processes with mismatched image paths between PEB and VAD tree, or unmapped PE headers in memory.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fprocesses\u002Fhollow\u002Ftechnique\u002Fdetect\u002FSKILL.md",[],[179,72,143,180,166,77,181,182,30,88,183,184,185,186,187,188,76,78,189,190],"processes hollow technique detect","tree","memory-forensics","process-hollow","peb","runpe","image","pe-header","in memory","with","mismatched","headers"]