[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M71CFA460NVSBJ4BWD2RJDWV":3,"skill-same:01M71CFA460NVSBJ4BWD2RJDWV":94},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":23,"publishedAt":44,"linkOnly":45,"markdownContent":46,"markdownBody":47,"frontMatter":48,"refName":67,"commitSha":68,"skillDirectory":69,"forksCount":14,"repositoryHtmlUrl":70,"repositoryHomepageUrl":6,"ownerHtmlUrl":71,"ownerBlogUrl":6,"ownerDescription":72,"updatedAt":73,"install":74,"resources":87},"01M71CFA460NVSBJ4BWD2RJDWV","containers-docker-dockertrivy-detect",null,"Trivy is a comprehensive open-source vulnerability scanner by Aqua Security that detects vulnerabilities in OS packages, language-specific dependencies, misconfigurations, secrets, and license violati","DCx7C5\u002Fai-marketplace","DCx7C5","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F42419559?v=4","01M71C01G2AZV3NTNGWAWSHJPP","DC","01M71C01GQW6G50S2BYMS7PP3E",0,"MIT","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fcloud\u002Fcontainers\u002Fdocker\u002Fdockertrivy\u002Fdetect\u002FSKILL.md",[18],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000011","运维与部署","SCENARIO","使用场景",[24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43],"containers","docker","detect","containers docker dockertrivy detect","os","vulnerability scanner","secrets","read","scanning","container-security","de","vulnerability-scanning","packages","scanner","aqua","vulnerability","Bash","cybersecurity","open","cm","2026-11-10 10:12:30",false,"---\nname: containers-docker-dockertrivy-detect\ndescription: Trivy is a comprehensive open-source vulnerability scanner by Aqua Security that detects vulnerabilities in OS packages, language-specific dependencies, misconfigurations, secrets, and license violati\ndomain: cybersecurity\nsubdomain: container-security\ntags:\n- containers\n- docker\n- security\n- trivy\n- vulnerability-scanning\nnist_csf:\n- PR.PS-01\n- PR.IR-01\n- ID.AM-08\n- DE.CM-01\nmodel: sonnet\nmaxTurns: 20\ntools: [Read, Bash, Glob, Grep]\nmitre_attack:\n- T1046\n- T1610\ncapec: []\n---\n\n# Scanning Docker Images with Trivy\n\n## Overview\n\nTrivy is a comprehensive open-source vulnerability scanner by Aqua Security that detects vulnerabilities in OS packages, language-specific dependencies, misconfigurations, secrets, and license violations within container images. It integrates into CI\u002FCD pipelines and supports multiple output formats including SARIF, CycloneDX, and SPDX.\n\n\n## When to Use\n\n- When conducting security assessments that involve scanning docker images with trivy\n- When following incident response procedures for related security events\n- When performing scheduled security testing or auditing activities\n- When validating security controls through hands-on testing\n\n## Prerequisites\n\n- Docker Engine 20.10+\n- Trivy v0.50+ installed\n- Internet access for vulnerability database updates\n- Container registry credentials (for private registries)\n\n## Core Concepts\n\n### Scanner Types\n\n| Scanner | Flag | Detects |\n|---------|------|---------|\n| Vulnerability | `--scanners vuln` | CVEs in OS packages and libraries |\n| Misconfiguration | `--scanners misconfig` | Dockerfile\u002FK8s manifest misconfigs |\n| Secret | `--scanners secret` | Hardcoded passwords, API keys, tokens |\n| License | `--scanners license` | Software license compliance issues |\n\n### Severity Levels\n\n- **CRITICAL**: CVSS 9.0-10.0 - Immediate action required\n- **HIGH**: CVSS 7.0-8.9 - Fix before production deployment\n- **MEDIUM**: CVSS 4.0-6.9 - Plan remediation\n- **LOW**: CVSS 0.1-3.9 - Accept or fix opportunistically\n- **UNKNOWN**: Unscored - Evaluate manually\n\n### Vulnerability Database\n\nTrivy uses multiple vulnerability databases:\n- NVD (National Vulnerability Database)\n- Red Hat Security Data\n- Alpine SecDB\n- Debian Security Tracker\n- Ubuntu CVE Tracker\n- Amazon Linux Security Center\n- GitHub Advisory Database\n\n## Workflow\n\n### Step 1: Install Trivy\n\n```bash\n# Linux (apt)\nsudo apt-get install wget apt-transport-https gnupg lsb-release\nwget -qO - https:\u002F\u002Faquasecurity.github.io\u002Ftrivy-repo\u002Fdeb\u002Fpublic.key | gpg --dearmor | sudo tee \u002Fusr\u002Fshare\u002Fkeyrings\u002Ftrivy.gpg > \u002Fdev\u002Fnull\necho \"deb [signed-by=\u002Fusr\u002Fshare\u002Fkeyrings\u002Ftrivy.gpg] https:\u002F\u002Faquasecurity.github.io\u002Ftrivy-repo\u002Fdeb $(lsb_release -sc) main\" | sudo tee -a \u002Fetc\u002Fapt\u002Fsources.list.d\u002Ftrivy.list\nsudo apt-get update && sudo apt-get install trivy\n\n# macOS\nbrew install trivy\n\n# Docker\ndocker pull aquasecurity\u002Ftrivy:latest\n```\n\n### Step 2: Basic Image Scanning\n\n```bash\n# Scan a public image\ntrivy image python:3.12-slim\n\n# Scan with severity filter\ntrivy image --severity CRITICAL,HIGH nginx:latest\n\n# Ignore unfixed vulnerabilities\ntrivy image --ignore-unfixed alpine:3.19\n\n# Scan local image\ndocker build -t myapp:latest .\ntrivy image myapp:latest\n\n# Scan from tar archive\ndocker save myapp:latest -o myapp.tar\ntrivy image --input myapp.tar\n```\n\n### Step 3: Advanced Scanning Options\n\n```bash\n# All scanners (vuln + misconfig + secret + license)\ntrivy image --scanners vuln,misconfig,secret,license myapp:latest\n\n# Generate SBOM in CycloneDX format\ntrivy image --format cyclonedx --output sbom.cdx.json myapp:latest\n\n# Generate SBOM in SPDX format\ntrivy image --format spdx-json --output sbom.spdx.json myapp:latest\n\n# JSON output for programmatic processing\ntrivy image --format json --output results.json myapp:latest\n\n# SARIF output for GitHub Security tab\ntrivy image --format sarif --output results.sarif myapp:latest\n\n# Template-based output\ntrivy image --format template --template \"@contrib\u002Fhtml.tpl\" --output report.html myapp:latest\n\n# Scan specific layers only\ntrivy image --list-all-pkgs myapp:latest\n```\n\n### Step 4: Scanning Kubernetes Manifests\n\n```bash\n# Scan Dockerfile for misconfigurations\ntrivy config Dockerfile\n\n# Scan Kubernetes manifests\ntrivy config k8s-deployment.yaml\n\n# Scan Helm charts\ntrivy config .\u002Fhelm-chart\u002F\n\n# Scan Terraform files\ntrivy config .\u002Fterraform\u002F\n```\n\n### Step 5: CI\u002FCD Integration\n\n```yaml\n# GitHub Actions\nname: containers-docker-dockertrivy\non: push\n\njobs:\n  scan:\n    runs-on: ubuntu-latest\n    steps:\n      - uses: actions\u002Fcheckout@v4\n\n      - name: Build image\n        run: docker build -t myapp:${{ github.sha }} .\n\n      - name: Run Trivy vulnerability scanner\n        uses: aquasecurity\u002Ftrivy-action@master\n        with:\n          image-ref: myapp:${{ github.sha }}\n          format: sarif\n          output: trivy-results.sarif\n          severity: CRITICAL,HIGH\n          exit-code: 1\n\n      - name: Upload Trivy scan results\n        uses: github\u002Fcodeql-action\u002Fupload-sarif@v3\n        if: always()\n        with:\n          sarif_file: trivy-results.sarif\n\n      - name: Generate SBOM\n        uses: aquasecurity\u002Ftrivy-action@master\n        with:\n          image-ref: myapp:${{ github.sha }}\n          format: cyclonedx\n          output: sbom.cdx.json\n```\n\n```yaml\n# GitLab CI\ntrivy-scan:\n  stage: security\n  image:\n    name: aquasecurity\u002Ftrivy:latest\n    entrypoint: [\"\"]\n  script:\n    - trivy image --exit-code 1 --severity CRITICAL,HIGH\n        --format json --output gl-container-scanning-report.json\n        $CI_REGISTRY_IMAGE:$CI_COMMIT_SHA\n  artifacts:\n    reports:\n      container_scanning: gl-container-scanning-report.json\n```\n\n### Step 6: Policy Enforcement with .trivyignore\n\n```bash\n# .trivyignore - Ignore specific CVEs with expiry\n# Accepted risk: low-impact vulnerability in dev dependency\nCVE-2023-12345 exp:2025-06-01\n\n# False positive: not exploitable in our configuration\nCVE-2024-67890\n\n# Vendor will not fix\nCVE-2023-11111\n```\n\n### Step 7: Scan Private Registry Images\n\n```bash\n# Docker Hub (uses ~\u002F.docker\u002Fconfig.json)\ntrivy image myregistry.azurecr.io\u002Fmyapp:latest\n\n# ECR\naws ecr get-login-password --region us-east-1 | docker login --username AWS --password-stdin \u003Caccount>.dkr.ecr.us-east-1.amazonaws.com\ntrivy image \u003Caccount>.dkr.ecr.us-east-1.amazonaws.com\u002Fmyapp:latest\n\n# GCR\ntrivy image gcr.io\u002Fmy-project\u002Fmyapp:latest\n\n# With explicit credentials\nTRIVY_USERNAME=user TRIVY_PASSWORD=pass trivy image registry.example.com\u002Fmyapp:latest\n```\n\n## Validation Commands\n\n```bash\n# Verify Trivy installation\ntrivy version\n\n# Update vulnerability database\ntrivy image --download-db-only\n\n# Quick scan with table output\ntrivy image --severity CRITICAL python:3.12\n\n# Verify no CRITICAL vulnerabilities\ntrivy image --exit-code 1 --severity CRITICAL myapp:latest\necho \"Exit code: $?\"  # 0 = no vulns, 1 = vulns found\n```\n\n## References\n\n- [Trivy Documentation](https:\u002F\u002Ftrivy.dev\u002Fdocs\u002F)\n- [Trivy GitHub Repository](https:\u002F\u002Fgithub.com\u002Faquasecurity\u002Ftrivy)\n- [Trivy GitHub Action](https:\u002F\u002Fgithub.com\u002Faquasecurity\u002Ftrivy-action)\n- [Aqua Security - Trivy Scanner Guide](https:\u002F\u002Fwww.aquasec.com\u002Fproducts\u002Ftrivy\u002F)\n","# Scanning Docker Images with Trivy\n\n## Overview\n\nTrivy is a comprehensive open-source vulnerability scanner by Aqua Security that detects vulnerabilities in OS packages, language-specific dependencies, misconfigurations, secrets, and license violations within container images. It integrates into CI\u002FCD pipelines and supports multiple output formats including SARIF, CycloneDX, and SPDX.\n\n\n## When to Use\n\n- When conducting security assessments that involve scanning docker images with trivy\n- When following incident response procedures for related security events\n- When performing scheduled security testing or auditing activities\n- When validating security controls through hands-on testing\n\n## Prerequisites\n\n- Docker Engine 20.10+\n- Trivy v0.50+ installed\n- Internet access for vulnerability database updates\n- Container registry credentials (for private registries)\n\n## Core Concepts\n\n### Scanner Types\n\n| Scanner | Flag | Detects |\n|---------|------|---------|\n| Vulnerability | `--scanners vuln` | CVEs in OS packages and libraries |\n| Misconfiguration | `--scanners misconfig` | Dockerfile\u002FK8s manifest misconfigs |\n| Secret | `--scanners secret` | Hardcoded passwords, API keys, tokens |\n| License | `--scanners license` | Software license compliance issues |\n\n### Severity Levels\n\n- **CRITICAL**: CVSS 9.0-10.0 - Immediate action required\n- **HIGH**: CVSS 7.0-8.9 - Fix before production deployment\n- **MEDIUM**: CVSS 4.0-6.9 - Plan remediation\n- **LOW**: CVSS 0.1-3.9 - Accept or fix opportunistically\n- **UNKNOWN**: Unscored - Evaluate manually\n\n### Vulnerability Database\n\nTrivy uses multiple vulnerability databases:\n- NVD (National Vulnerability Database)\n- Red Hat Security Data\n- Alpine SecDB\n- Debian Security Tracker\n- Ubuntu CVE Tracker\n- Amazon Linux Security Center\n- GitHub Advisory Database\n\n## Workflow\n\n### Step 1: Install Trivy\n\n```bash\n# Linux (apt)\nsudo apt-get install wget apt-transport-https gnupg lsb-release\nwget -qO - https:\u002F\u002Faquasecurity.github.io\u002Ftrivy-repo\u002Fdeb\u002Fpublic.key | gpg --dearmor | sudo tee \u002Fusr\u002Fshare\u002Fkeyrings\u002Ftrivy.gpg > \u002Fdev\u002Fnull\necho \"deb [signed-by=\u002Fusr\u002Fshare\u002Fkeyrings\u002Ftrivy.gpg] https:\u002F\u002Faquasecurity.github.io\u002Ftrivy-repo\u002Fdeb $(lsb_release -sc) main\" | sudo tee -a \u002Fetc\u002Fapt\u002Fsources.list.d\u002Ftrivy.list\nsudo apt-get update && sudo apt-get install trivy\n\n# macOS\nbrew install trivy\n\n# Docker\ndocker pull aquasecurity\u002Ftrivy:latest\n```\n\n### Step 2: Basic Image Scanning\n\n```bash\n# Scan a public image\ntrivy image python:3.12-slim\n\n# Scan with severity filter\ntrivy image --severity CRITICAL,HIGH nginx:latest\n\n# Ignore unfixed vulnerabilities\ntrivy image --ignore-unfixed alpine:3.19\n\n# Scan local image\ndocker build -t myapp:latest .\ntrivy image myapp:latest\n\n# Scan from tar archive\ndocker save myapp:latest -o myapp.tar\ntrivy image --input myapp.tar\n```\n\n### Step 3: Advanced Scanning Options\n\n```bash\n# All scanners (vuln + misconfig + secret + license)\ntrivy image --scanners vuln,misconfig,secret,license myapp:latest\n\n# Generate SBOM in CycloneDX format\ntrivy image --format cyclonedx --output sbom.cdx.json myapp:latest\n\n# Generate SBOM in SPDX format\ntrivy image --format spdx-json --output sbom.spdx.json myapp:latest\n\n# JSON output for programmatic processing\ntrivy image --format json --output results.json myapp:latest\n\n# SARIF output for GitHub Security tab\ntrivy image --format sarif --output results.sarif myapp:latest\n\n# Template-based output\ntrivy image --format template --template \"@contrib\u002Fhtml.tpl\" --output report.html myapp:latest\n\n# Scan specific layers only\ntrivy image --list-all-pkgs myapp:latest\n```\n\n### Step 4: Scanning Kubernetes Manifests\n\n```bash\n# Scan Dockerfile for misconfigurations\ntrivy config Dockerfile\n\n# Scan Kubernetes manifests\ntrivy config k8s-deployment.yaml\n\n# Scan Helm charts\ntrivy config .\u002Fhelm-chart\u002F\n\n# Scan Terraform files\ntrivy config .\u002Fterraform\u002F\n```\n\n### Step 5: CI\u002FCD Integration\n\n```yaml\n# GitHub Actions\nname: containers-docker-dockertrivy\non: push\n\njobs:\n  scan:\n    runs-on: ubuntu-latest\n    steps:\n      - uses: actions\u002Fcheckout@v4\n\n      - name: Build image\n        run: docker build -t myapp:${{ github.sha }} .\n\n      - name: Run Trivy vulnerability scanner\n        uses: aquasecurity\u002Ftrivy-action@master\n        with:\n          image-ref: myapp:${{ github.sha }}\n          format: sarif\n          output: trivy-results.sarif\n          severity: CRITICAL,HIGH\n          exit-code: 1\n\n      - name: Upload Trivy scan results\n        uses: github\u002Fcodeql-action\u002Fupload-sarif@v3\n        if: always()\n        with:\n          sarif_file: trivy-results.sarif\n\n      - name: Generate SBOM\n        uses: aquasecurity\u002Ftrivy-action@master\n        with:\n          image-ref: myapp:${{ github.sha }}\n          format: cyclonedx\n          output: sbom.cdx.json\n```\n\n```yaml\n# GitLab CI\ntrivy-scan:\n  stage: security\n  image:\n    name: aquasecurity\u002Ftrivy:latest\n    entrypoint: [\"\"]\n  script:\n    - trivy image --exit-code 1 --severity CRITICAL,HIGH\n        --format json --output gl-container-scanning-report.json\n        $CI_REGISTRY_IMAGE:$CI_COMMIT_SHA\n  artifacts:\n    reports:\n      container_scanning: gl-container-scanning-report.json\n```\n\n### Step 6: Policy Enforcement with .trivyignore\n\n```bash\n# .trivyignore - Ignore specific CVEs with expiry\n# Accepted risk: low-impact vulnerability in dev dependency\nCVE-2023-12345 exp:2025-06-01\n\n# False positive: not exploitable in our configuration\nCVE-2024-67890\n\n# Vendor will not fix\nCVE-2023-11111\n```\n\n### Step 7: Scan Private Registry Images\n\n```bash\n# Docker Hub (uses ~\u002F.docker\u002Fconfig.json)\ntrivy image myregistry.azurecr.io\u002Fmyapp:latest\n\n# ECR\naws ecr get-login-password --region us-east-1 | docker login --username AWS --password-stdin \u003Caccount>.dkr.ecr.us-east-1.amazonaws.com\ntrivy image \u003Caccount>.dkr.ecr.us-east-1.amazonaws.com\u002Fmyapp:latest\n\n# GCR\ntrivy image gcr.io\u002Fmy-project\u002Fmyapp:latest\n\n# With explicit credentials\nTRIVY_USERNAME=user TRIVY_PASSWORD=pass trivy image registry.example.com\u002Fmyapp:latest\n```\n\n## Validation Commands\n\n```bash\n# Verify Trivy installation\ntrivy version\n\n# Update vulnerability database\ntrivy image --download-db-only\n\n# Quick scan with table output\ntrivy image --severity CRITICAL python:3.12\n\n# Verify no CRITICAL vulnerabilities\ntrivy image --exit-code 1 --severity CRITICAL myapp:latest\necho \"Exit code: $?\"  # 0 = no vulns, 1 = vulns found\n```\n\n## References\n\n- [Trivy Documentation](https:\u002F\u002Ftrivy.dev\u002Fdocs\u002F)\n- [Trivy GitHub Repository](https:\u002F\u002Fgithub.com\u002Faquasecurity\u002Ftrivy)\n- [Trivy GitHub Action](https:\u002F\u002Fgithub.com\u002Faquasecurity\u002Ftrivy-action)\n- [Aqua Security - Trivy Scanner Guide](https:\u002F\u002Fwww.aquasec.com\u002Fproducts\u002Ftrivy\u002F)\n",{"name":5,"tags":49,"capec":52,"model":53,"tools":54,"domain":41,"maxTurns":58,"nist_csf":59,"subdomain":33,"description":7,"mitre_attack":64},[24,25,50,51,35],"security","trivy",[],"sonnet",[55,40,56,57],"Read","Glob","Grep",20,[60,61,62,63],"PR.PS-01","PR.IR-01","ID.AM-08","DE.CM-01",[65,66],"T1046","T1610","main","a91f1293287ffa9f4f1b8f486cd6e835a1568c84","skills\u002Fcloud\u002Fcontainers\u002Fdocker\u002Fdockertrivy\u002Fdetect","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace","https:\u002F\u002Fgithub.com\u002FDCx7C5","#Python","2026-09-01 11:21:00",{"source":8,"skillName":5,"commands":75,"prompt":85,"zipAvailable":86},[76,79,82],{"tool":77,"command":78},"npx","npx skills add DCx7C5\u002Fai-marketplace --skill containers-docker-dockertrivy-detect",{"tool":80,"command":81},"bunx","bunx skills add DCx7C5\u002Fai-marketplace --skill containers-docker-dockertrivy-detect",{"tool":83,"command":84},"pnpm","pnpm dlx skills add DCx7C5\u002Fai-marketplace --skill containers-docker-dockertrivy-detect","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fcloud\u002Fcontainers\u002Fdocker\u002Fdockertrivy\u002Fdetect\u002FSKILL.md",true,[88],{"path":89,"resourceType":90,"resourceTypeDesc":91,"sizeBytes":92,"sourceHtmlUrl":93},"index.json","REFERENCE","参考文档",719,"https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fcloud\u002Fcontainers\u002Fdocker\u002Fdockertrivy\u002Fdetect\u002Findex.json",[95,117,138,159,181,197],{"skillNo":96,"name":97,"nameZh":6,"description":98,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":99,"categories":100,"keywords":101,"publishedAt":44},"01M71HAPZ01KQ30RKTB0FFSQ05","services-wmi-persistence-detect","Detect WMI event subscription persistence by enumerating ActiveScriptEventConsumer, CommandLineEventConsumer, and permanent subscriptions in the WMI repository.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fservices\u002Fwmi\u002Fpersistence\u002Fdetect\u002FSKILL.md",[],[102,26,103,104,105,34,43,106,107,108,109,110,111,112,113,114,115,41,116],"services","services wmi persistence detect","wmi","persistence","process","activescript","event","subscriptions","commandline-consumer","repository","subscription","event-subscription","t1546.003","forensics","process-forensics",{"skillNo":118,"name":119,"nameZh":6,"description":120,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":121,"categories":122,"keywords":123,"publishedAt":44},"01M71HAK6JTTTS229T17WJMMCG","services-wmi-exec-exploit","Perform lateral movement across Windows networks using WMI-based remote execution techniques including Impacket wmiexec.py, CrackMapExec, and native WMI commands for stealthy post-exploitation during red team engagements.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fservices\u002Fwmi\u002Fexec\u002Fexploit\u002FSKILL.md",[],[124,102,125,104,126,127,128,41,40,129,130,131,132,133,34,134,135,31,136,137],"exploit","services wmi exec exploit","exec","remote","traffic","analysis","team","across","crackmapexec","native","command","lateral movement","lateral-movement","Impacket",{"skillNo":139,"name":140,"nameZh":6,"description":141,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":142,"categories":143,"keywords":144,"publishedAt":44},"01M71HAG6MHKNQV8KDZKMT4886","registry-artifact-extract","Extract and analyze Windows Registry hives to uncover user activity, installed software, autostart entries, and evidence of system compromise.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fregistry\u002Fartifact\u002Fextract\u002FSKILL.md",[],[145,146,147,148,149,150,41,40,151,129,152,153,34,31,154,155,156,157,158,53],"artifact","registry","registry artifact extract","extract","evidence-collection","artifact-analysis","collection","analyze","uncover","software","activity","digital-forensics","windows-registry","regripper",{"skillNo":160,"name":161,"nameZh":6,"description":162,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":163,"categories":164,"keywords":165,"publishedAt":44},"01M71HACR4A8XTWTTSXK4124AA","processes-token-impersonate-detect","Detect Windows token impersonation and privilege abuse including SeImpersonatePrivilege exploitation via Potato attacks and token stealing techniques.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fprocesses\u002Ftoken\u002Fimpersonate\u002Fdetect\u002FSKILL.md",[],[26,166,167,168,169,170,171,43,172,41,116,173,174,175,176,177,178,179,180,34],"processes token impersonate detect","token","processes","attacks","windows","escalation","techniques","privilege-escalation","seimpersonate","token-impersonation","printspoofer","exploitation","potato","impersonation","via",{"skillNo":182,"name":183,"nameZh":6,"description":184,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":185,"categories":186,"keywords":187,"publishedAt":44},"01M71HAABSB4Z6QFSXEG00R4RK","processes-thread-injection-detect","Detect Windows thread injection techniques including CreateRemoteThread, QueueUserAPC, NtCreateThreadEx, and thread hijacking via process memory analysis.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fprocesses\u002Fthread\u002Finjection\u002Fdetect\u002FSKILL.md",[],[188,189,26,190,168,170,191,43,192,172,41,116,129,193,194,195,196,180,34,106],"thread","processes thread injection detect","injection","memory","process-injection","api","apc-injection","thread-injection","nt-api",{"skillNo":198,"name":199,"nameZh":6,"description":200,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":201,"categories":202,"keywords":203,"publishedAt":44},"01M71HA7H311V5G14WMX58HQSS","processes-hollow-technique-detect","Detect process hollowing (RunPE) by identifying processes with mismatched image paths between PEB and VAD tree, or unmapped PE headers in memory.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fprocesses\u002Fhollow\u002Ftechnique\u002Fdetect\u002FSKILL.md",[],[204,26,168,205,191,43,206,207,41,116,208,209,210,211,212,213,34,106,214,215],"processes hollow technique detect","tree","memory-forensics","process-hollow","peb","runpe","image","pe-header","in memory","with","mismatched","headers"]