[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M71CF4AABKHH98ARK9WJB68D":3,"skill-same:01M71CF4AABKHH98ARK9WJB68D":95},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":23,"publishedAt":44,"linkOnly":45,"markdownContent":46,"markdownBody":47,"frontMatter":48,"refName":68,"commitSha":69,"skillDirectory":70,"forksCount":14,"repositoryHtmlUrl":71,"repositoryHomepageUrl":6,"ownerHtmlUrl":72,"ownerBlogUrl":6,"ownerDescription":73,"updatedAt":74,"install":75,"resources":88},"01M71CF4AABKHH98ARK9WJB68D","containers-docker-bench-exploit",null,"Docker Bench for Security is an open-source script that checks dozens of common best practices around deploying Docker containers in production. Based on the CIS Docker Benchmark, it audits host confi","DCx7C5\u002Fai-marketplace","DCx7C5","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F42419559?v=4","01M71C01G2AZV3NTNGWAWSHJPP","DC","01M71C01GQW6G50S2BYMS7PP3E",0,"MIT","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fcloud\u002Fcontainers\u002Fdocker\u002Fbench\u002Fexploit\u002FSKILL.md",[18],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000011","运维与部署","SCENARIO","使用场景",[24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43],"docker","containers docker bench exploit","exploit","containers","open-source","id","common","PS","best practices","Bash","cybersecurity","common best practices","host","t1059","open","container","assessment","cm","for","pr","2026-11-10 10:12:30",false,"---\nname: containers-docker-bench-exploit\ndescription: Docker Bench for Security is an open-source script that checks dozens of common best practices around deploying Docker containers in production. Based on the CIS Docker Benchmark, it audits host confi\ndomain: cybersecurity\nsubdomain: container-security\ntags:\n- containers\n- docker\n- security\n- CIS-benchmark\n- assessment\nnist_csf:\n- PR.PS-01\n- PR.IR-01\n- ID.AM-08\n- DE.CM-01\nmodel: sonnet\nmaxTurns: 20\ntools: [Read, Bash, Glob, Grep]\nmitre_attack:\n- T1059\n- T1610\ncapec: []\n---\n\n# Performing Docker Bench Security Assessment\n\n## Overview\n\nDocker Bench for Security is an open-source script that checks dozens of common best practices around deploying Docker containers in production. Based on the CIS Docker Benchmark, it audits host configuration, Docker daemon settings, container images, runtime configurations, and security operations to generate a compliance report with pass\u002Ffail\u002Fwarn results.\n\n\n## When to Use\n\n- When conducting security assessments that involve performing docker bench security assessment\n- When following incident response procedures for related security events\n- When performing scheduled security testing or auditing activities\n- When validating security controls through hands-on testing\n\n## Prerequisites\n\n- Docker Engine installed and running\n- Root or sudo access on Docker host\n- Docker Bench Security script or container image\n\n## Workflow\n\n### Step 1: Run Docker Bench Security\n\n```bash\n# Run as a container (recommended)\ndocker run --rm --net host --pid host --userns host --cap-add audit_control \\\n  -e DOCKER_CONTENT_TRUST=$DOCKER_CONTENT_TRUST \\\n  -v \u002Fetc:\u002Fetc:ro \\\n  -v \u002Fusr\u002Fbin\u002Fcontainerd:\u002Fusr\u002Fbin\u002Fcontainerd:ro \\\n  -v \u002Fusr\u002Fbin\u002Frunc:\u002Fusr\u002Fbin\u002Frunc:ro \\\n  -v \u002Fusr\u002Flibs\u002Fsystemd:\u002Fusr\u002Flibs\u002Fsystemd:ro \\\n  -v \u002Fvar\u002Flibs:\u002Fvar\u002Flibs:ro \\\n  -v \u002Fvar\u002Frun\u002Fdocker.sock:\u002Fvar\u002Frun\u002Fdocker.sock:ro \\\n  --label docker_bench_security \\\n  docker\u002Fdocker-bench-security\n\n# Run with JSON output\ndocker run --rm --net host --pid host --userns host --cap-add audit_control \\\n  -v \u002Fetc:\u002Fetc:ro \\\n  -v \u002Fvar\u002Flibs:\u002Fvar\u002Flibs:ro \\\n  -v \u002Fvar\u002Frun\u002Fdocker.sock:\u002Fvar\u002Frun\u002Fdocker.sock:ro \\\n  docker\u002Fdocker-bench-security -l \u002Fdev\u002Fstdout 2>\u002Fdev\u002Fnull | tee docker-bench-results.json\n\n# Run specific sections only\ndocker run --rm --net host --pid host --userns host \\\n  -v \u002Fvar\u002Frun\u002Fdocker.sock:\u002Fvar\u002Frun\u002Fdocker.sock:ro \\\n  docker\u002Fdocker-bench-security -c container_images,container_runtime\n```\n\n### Step 2: Interpret Results\n\n```\n[INFO] 1 - Host Configuration\n[PASS] 1.1.1 - Ensure a separate partition for containers has been created\n[WARN] 1.1.2 - Ensure only trusted users are allowed to control Docker daemon\n[PASS] 1.1.3 - Ensure auditing is configured for the Docker daemon\n\n[INFO] 2 - Docker daemon configuration\n[FAIL] 2.1 - Run the Docker daemon as a non-root user\n[PASS] 2.2 - Ensure network traffic is restricted between containers on the default bridge\n```\n\n### Step 3: Remediate Common Failures\n\n```bash\n# Fix 2.2: Restrict inter-container communication\necho '{\"icc\": false}' | sudo tee \u002Fetc\u002Fdocker\u002Fdaemon.json\n\n# Fix 2.17: Restrict containers from acquiring new privileges\necho '{\"no-new-privileges\": true}' | sudo tee -a \u002Fetc\u002Fdocker\u002Fdaemon.json\n\n# Fix 5.3: Restrict Linux kernel capabilities\n# Use --cap-drop ALL in docker run commands\n\n# Fix 5.12: Mount container's root filesystem as read only\n# Use --read-only flag in docker run commands\n\n# Restart Docker daemon after configuration changes\nsudo systemctl restart docker\n```\n\n### Step 4: Automate Scheduled Assessments\n\n```yaml\n# docker-compose for scheduled assessment\nservices:\n  bench-security:\n    image: docker\u002Fdocker-bench-security\n    network_mode: host\n    pid: host\n    userns_mode: host\n    cap_add:\n      - audit_control\n    volumes:\n      - \u002Fetc:\u002Fetc:ro\n      - \u002Fvar\u002Flibs:\u002Fvar\u002Flibs:ro\n      - \u002Fvar\u002Frun\u002Fdocker.sock:\u002Fvar\u002Frun\u002Fdocker.sock:ro\n      - .\u002Fresults:\u002Fresults\n    command: -l \u002Fresults\u002Fbench-$(date +%Y%m%d).log\n    deploy:\n      restart_policy:\n        condition: none\n```\n\n## Validation Commands\n\n```bash\n# Verify remediation\ndocker run --rm docker\u002Fdocker-bench-security 2>&1 | grep -E \"(PASS|FAIL|WARN)\" | sort | uniq -c\n\n# Count results by type\ndocker run --rm docker\u002Fdocker-bench-security 2>&1 | grep -c \"PASS\"\ndocker run --rm docker\u002Fdocker-bench-security 2>&1 | grep -c \"FAIL\"\ndocker run --rm docker\u002Fdocker-bench-security 2>&1 | grep -c \"WARN\"\n```\n\n## References\n\n- [Docker Bench Security](https:\u002F\u002Fgithub.com\u002Fdocker\u002Fdocker-bench-security)\n- [CIS Docker Benchmark](https:\u002F\u002Fwww.cisecurity.org\u002Fbenchmark\u002Fdocker)\n- [Docker Security Best Practices](https:\u002F\u002Fdocs.docker.com\u002Fengine\u002Fsecurity\u002F)\n","# Performing Docker Bench Security Assessment\n\n## Overview\n\nDocker Bench for Security is an open-source script that checks dozens of common best practices around deploying Docker containers in production. Based on the CIS Docker Benchmark, it audits host configuration, Docker daemon settings, container images, runtime configurations, and security operations to generate a compliance report with pass\u002Ffail\u002Fwarn results.\n\n\n## When to Use\n\n- When conducting security assessments that involve performing docker bench security assessment\n- When following incident response procedures for related security events\n- When performing scheduled security testing or auditing activities\n- When validating security controls through hands-on testing\n\n## Prerequisites\n\n- Docker Engine installed and running\n- Root or sudo access on Docker host\n- Docker Bench Security script or container image\n\n## Workflow\n\n### Step 1: Run Docker Bench Security\n\n```bash\n# Run as a container (recommended)\ndocker run --rm --net host --pid host --userns host --cap-add audit_control \\\n  -e DOCKER_CONTENT_TRUST=$DOCKER_CONTENT_TRUST \\\n  -v \u002Fetc:\u002Fetc:ro \\\n  -v \u002Fusr\u002Fbin\u002Fcontainerd:\u002Fusr\u002Fbin\u002Fcontainerd:ro \\\n  -v \u002Fusr\u002Fbin\u002Frunc:\u002Fusr\u002Fbin\u002Frunc:ro \\\n  -v \u002Fusr\u002Flibs\u002Fsystemd:\u002Fusr\u002Flibs\u002Fsystemd:ro \\\n  -v \u002Fvar\u002Flibs:\u002Fvar\u002Flibs:ro \\\n  -v \u002Fvar\u002Frun\u002Fdocker.sock:\u002Fvar\u002Frun\u002Fdocker.sock:ro \\\n  --label docker_bench_security \\\n  docker\u002Fdocker-bench-security\n\n# Run with JSON output\ndocker run --rm --net host --pid host --userns host --cap-add audit_control \\\n  -v \u002Fetc:\u002Fetc:ro \\\n  -v \u002Fvar\u002Flibs:\u002Fvar\u002Flibs:ro \\\n  -v \u002Fvar\u002Frun\u002Fdocker.sock:\u002Fvar\u002Frun\u002Fdocker.sock:ro \\\n  docker\u002Fdocker-bench-security -l \u002Fdev\u002Fstdout 2>\u002Fdev\u002Fnull | tee docker-bench-results.json\n\n# Run specific sections only\ndocker run --rm --net host --pid host --userns host \\\n  -v \u002Fvar\u002Frun\u002Fdocker.sock:\u002Fvar\u002Frun\u002Fdocker.sock:ro \\\n  docker\u002Fdocker-bench-security -c container_images,container_runtime\n```\n\n### Step 2: Interpret Results\n\n```\n[INFO] 1 - Host Configuration\n[PASS] 1.1.1 - Ensure a separate partition for containers has been created\n[WARN] 1.1.2 - Ensure only trusted users are allowed to control Docker daemon\n[PASS] 1.1.3 - Ensure auditing is configured for the Docker daemon\n\n[INFO] 2 - Docker daemon configuration\n[FAIL] 2.1 - Run the Docker daemon as a non-root user\n[PASS] 2.2 - Ensure network traffic is restricted between containers on the default bridge\n```\n\n### Step 3: Remediate Common Failures\n\n```bash\n# Fix 2.2: Restrict inter-container communication\necho '{\"icc\": false}' | sudo tee \u002Fetc\u002Fdocker\u002Fdaemon.json\n\n# Fix 2.17: Restrict containers from acquiring new privileges\necho '{\"no-new-privileges\": true}' | sudo tee -a \u002Fetc\u002Fdocker\u002Fdaemon.json\n\n# Fix 5.3: Restrict Linux kernel capabilities\n# Use --cap-drop ALL in docker run commands\n\n# Fix 5.12: Mount container's root filesystem as read only\n# Use --read-only flag in docker run commands\n\n# Restart Docker daemon after configuration changes\nsudo systemctl restart docker\n```\n\n### Step 4: Automate Scheduled Assessments\n\n```yaml\n# docker-compose for scheduled assessment\nservices:\n  bench-security:\n    image: docker\u002Fdocker-bench-security\n    network_mode: host\n    pid: host\n    userns_mode: host\n    cap_add:\n      - audit_control\n    volumes:\n      - \u002Fetc:\u002Fetc:ro\n      - \u002Fvar\u002Flibs:\u002Fvar\u002Flibs:ro\n      - \u002Fvar\u002Frun\u002Fdocker.sock:\u002Fvar\u002Frun\u002Fdocker.sock:ro\n      - .\u002Fresults:\u002Fresults\n    command: -l \u002Fresults\u002Fbench-$(date +%Y%m%d).log\n    deploy:\n      restart_policy:\n        condition: none\n```\n\n## Validation Commands\n\n```bash\n# Verify remediation\ndocker run --rm docker\u002Fdocker-bench-security 2>&1 | grep -E \"(PASS|FAIL|WARN)\" | sort | uniq -c\n\n# Count results by type\ndocker run --rm docker\u002Fdocker-bench-security 2>&1 | grep -c \"PASS\"\ndocker run --rm docker\u002Fdocker-bench-security 2>&1 | grep -c \"FAIL\"\ndocker run --rm docker\u002Fdocker-bench-security 2>&1 | grep -c \"WARN\"\n```\n\n## References\n\n- [Docker Bench Security](https:\u002F\u002Fgithub.com\u002Fdocker\u002Fdocker-bench-security)\n- [CIS Docker Benchmark](https:\u002F\u002Fwww.cisecurity.org\u002Fbenchmark\u002Fdocker)\n- [Docker Security Best Practices](https:\u002F\u002Fdocs.docker.com\u002Fengine\u002Fsecurity\u002F)\n",{"name":5,"tags":49,"capec":52,"model":53,"tools":54,"domain":34,"maxTurns":58,"nist_csf":59,"subdomain":64,"description":7,"mitre_attack":65},[27,24,50,51,40],"security","CIS-benchmark",[],"sonnet",[55,33,56,57],"Read","Glob","Grep",20,[60,61,62,63],"PR.PS-01","PR.IR-01","ID.AM-08","DE.CM-01","container-security",[66,67],"T1059","T1610","main","a91f1293287ffa9f4f1b8f486cd6e835a1568c84","skills\u002Fcloud\u002Fcontainers\u002Fdocker\u002Fbench\u002Fexploit","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace","https:\u002F\u002Fgithub.com\u002FDCx7C5","#Python","2026-09-01 11:21:00",{"source":8,"skillName":5,"commands":76,"prompt":86,"zipAvailable":87},[77,80,83],{"tool":78,"command":79},"npx","npx skills add DCx7C5\u002Fai-marketplace --skill containers-docker-bench-exploit",{"tool":81,"command":82},"bunx","bunx skills add DCx7C5\u002Fai-marketplace --skill containers-docker-bench-exploit",{"tool":84,"command":85},"pnpm","pnpm dlx skills add DCx7C5\u002Fai-marketplace --skill containers-docker-bench-exploit","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fcloud\u002Fcontainers\u002Fdocker\u002Fbench\u002Fexploit\u002FSKILL.md",true,[89],{"path":90,"resourceType":91,"resourceTypeDesc":92,"sizeBytes":93,"sourceHtmlUrl":94},"index.json","REFERENCE","参考文档",704,"https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fcloud\u002Fcontainers\u002Fdocker\u002Fbench\u002Fexploit\u002Findex.json",[96,120,141,162,184,200],{"skillNo":97,"name":98,"nameZh":6,"description":99,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":100,"categories":101,"keywords":102,"publishedAt":44},"01M71HAPZ01KQ30RKTB0FFSQ05","services-wmi-persistence-detect","Detect WMI event subscription persistence by enumerating ActiveScriptEventConsumer, CommandLineEventConsumer, and permanent subscriptions in the WMI repository.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fservices\u002Fwmi\u002Fpersistence\u002Fdetect\u002FSKILL.md",[],[103,104,105,106,107,108,41,109,110,111,112,113,114,115,116,117,118,34,119],"services","detect","services wmi persistence detect","wmi","persistence","de","process","activescript","event","subscriptions","commandline-consumer","repository","subscription","event-subscription","t1546.003","forensics","process-forensics",{"skillNo":121,"name":122,"nameZh":6,"description":123,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":124,"categories":125,"keywords":126,"publishedAt":44},"01M71HAK6JTTTS229T17WJMMCG","services-wmi-exec-exploit","Perform lateral movement across Windows networks using WMI-based remote execution techniques including Impacket wmiexec.py, CrackMapExec, and native WMI commands for stealthy post-exploitation during red team engagements.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fservices\u002Fwmi\u002Fexec\u002Fexploit\u002FSKILL.md",[],[26,103,127,106,128,129,130,34,33,131,132,133,134,135,108,136,137,138,139,140],"services wmi exec exploit","exec","remote","traffic","analysis","team","across","crackmapexec","native","command","lateral movement","read","lateral-movement","Impacket",{"skillNo":142,"name":143,"nameZh":6,"description":144,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":145,"categories":146,"keywords":147,"publishedAt":44},"01M71HAG6MHKNQV8KDZKMT4886","registry-artifact-extract","Extract and analyze Windows Registry hives to uncover user activity, installed software, autostart entries, and evidence of system compromise.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fregistry\u002Fartifact\u002Fextract\u002FSKILL.md",[],[148,149,150,151,152,153,34,33,154,131,155,156,108,138,157,158,159,160,161,53],"artifact","registry","registry artifact extract","extract","evidence-collection","artifact-analysis","collection","analyze","uncover","software","activity","digital-forensics","windows-registry","regripper",{"skillNo":163,"name":164,"nameZh":6,"description":165,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":166,"categories":167,"keywords":168,"publishedAt":44},"01M71HACR4A8XTWTTSXK4124AA","processes-token-impersonate-detect","Detect Windows token impersonation and privilege abuse including SeImpersonatePrivilege exploitation via Potato attacks and token stealing techniques.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fprocesses\u002Ftoken\u002Fimpersonate\u002Fdetect\u002FSKILL.md",[],[104,169,170,171,172,173,174,41,175,34,119,176,177,178,179,180,181,182,183,108],"processes token impersonate detect","token","processes","attacks","windows","escalation","techniques","privilege-escalation","seimpersonate","token-impersonation","printspoofer","exploitation","potato","impersonation","via",{"skillNo":185,"name":186,"nameZh":6,"description":187,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":188,"categories":189,"keywords":190,"publishedAt":44},"01M71HAABSB4Z6QFSXEG00R4RK","processes-thread-injection-detect","Detect Windows thread injection techniques including CreateRemoteThread, QueueUserAPC, NtCreateThreadEx, and thread hijacking via process memory analysis.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fprocesses\u002Fthread\u002Finjection\u002Fdetect\u002FSKILL.md",[],[191,192,104,193,171,173,194,41,195,175,34,119,131,196,197,198,199,183,108,109],"thread","processes thread injection detect","injection","memory","process-injection","api","apc-injection","thread-injection","nt-api",{"skillNo":201,"name":202,"nameZh":6,"description":203,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":204,"categories":205,"keywords":206,"publishedAt":44},"01M71HA7H311V5G14WMX58HQSS","processes-hollow-technique-detect","Detect process hollowing (RunPE) by identifying processes with mismatched image paths between PEB and VAD tree, or unmapped PE headers in memory.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fprocesses\u002Fhollow\u002Ftechnique\u002Fdetect\u002FSKILL.md",[],[207,104,171,208,194,41,209,210,34,119,211,212,213,214,215,216,108,109,217,218],"processes hollow technique detect","tree","memory-forensics","process-hollow","peb","runpe","image","pe-header","in memory","with","mismatched","headers"]