[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M71CFGS4YJR8373VKNH08DJZ":3,"skill-same:01M71CFGS4YJR8373VKNH08DJZ":104},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":31,"publishedAt":52,"linkOnly":53,"markdownContent":54,"markdownBody":55,"frontMatter":56,"refName":77,"commitSha":78,"skillDirectory":79,"forksCount":14,"repositoryHtmlUrl":80,"repositoryHomepageUrl":6,"ownerHtmlUrl":81,"ownerBlogUrl":6,"ownerDescription":82,"updatedAt":83,"install":84,"resources":97},"01M71CFGS4YJR8373VKNH08DJZ","containers-helm-audit",null,"Secure Helm chart deployments by validating chart integrity, scanning plugins for misconfigurations, and enforcing security contexts in Kubernetes releases.","DCx7C5\u002Fai-marketplace","DCx7C5","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F42419559?v=4","01M71C01G2AZV3NTNGWAWSHJPP","DC","01M71C01GQW6G50S2BYMS7PP3E",0,"MIT","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fcloud\u002Fcontainers\u002Fhelm\u002Faudit\u002FSKILL.md",[18,23,26],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000011","运维与部署","SCENARIO","使用场景",{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000013","分析与可视化",{"categoryNo":27,"categoryName":28,"taxonomyType":29,"taxonomyTypeDesc":30},"01JBSEEDCAT000000000000033","数据分析师","PROFESSION","适用职业",[32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49,50,51],"containers helm audit","containers","helm","audit","sonnet","supply-chain","security","integrity","secure","read","scanning","releases","container-security","de","Bash","chart","cybersecurity","t1195","cm","chain","2026-11-10 10:12:30",false,"---\nname: containers-helm-audit\ndescription: Secure Helm chart deployments by validating chart integrity, scanning plugins for misconfigurations, and enforcing security contexts in Kubernetes releases.\ndomain: cybersecurity\nsubdomain: container-security\ntags:\n- helm\n- kubernetes\n- chart-security\n- supply-chain\n- configuration-security\n- deployment\nnist_csf:\n- PR.PS-01\n- PR.IR-01\n- ID.AM-08\n- DE.CM-01\nmodel: sonnet\nmaxTurns: 20\ntools: [Read, Bash, Glob, Grep]\nmitre_attack:\n- T1046\n- T1195\n- T1610\ncapec: []\n---\n\n# Securing Helm Chart Deployments\n\n## Overview\n\nHelm is the Kubernetes package manager. Securing Helm deployments requires validating chart provenance, scanning templates for security misconfigurations, enforcing pod security contexts, managing secrets securely, and controlling RBAC for Helm operations.\n\n\n## When to Use\n\n- When deploying or configuring securing helm chart deployments capabilities in your environment\n- When establishing security controls aligned to compliance requirements\n- When building or improving security architecture for this domain\n- When conducting security assessments that require this implementation\n\n## Prerequisites\n\n- Helm 3.12+ installed\n- kubectl with cluster access\n- GnuPG for chart signing\u002Fverification\n- kubesec or checkov for template scanning\n\n## Chart Provenance and Integrity\n\n### Sign a Helm Chart\n\n```bash\n# Generate GPG key for signing\ngpg --full-generate-key\n\n# Package and sign chart\nhelm package .\u002Fmychart --sign --key \"helm-signing@example.com\" --keyring ~\u002F.gnupg\u002Fpubring.gpg\n\n# Verify chart signature\nhelm verify mychart-0.1.0.tgz --keyring ~\u002F.gnupg\u002Fpubring.gpg\n```\n\n### Verify Chart Before Install\n\n```bash\n# Verify chart from repository\nhelm pull myrepo\u002Fmychart --verify --keyring \u002Fpath\u002Fto\u002Fkeyring.gpg\n\n# Check chart provenance file\ncat mychart-0.1.0.tgz.prov\n```\n\n## Template Security Scanning\n\n### Render and Scan Templates\n\n```bash\n# Render plugins without deploying\nhelm template myrelease .\u002Fmychart --values values-prod.yaml > rendered.yaml\n\n# Scan with kubesec\nkubesec scan rendered.yaml\n\n# Scan with checkov\ncheckov -f rendered.yaml --framework kubernetes\n\n# Scan with trivy\ntrivy config rendered.yaml\n\n# Scan with kube-linter\nkube-linter lint rendered.yaml\n```\n\n### Helm Lint for Misconfigurations\n\n```bash\n# Lint chart\nhelm lint .\u002Fmychart --values values-prod.yaml --strict\n\n# Lint with debug output\nhelm lint .\u002Fmychart --debug\n```\n\n## Security Context Enforcement in values.yaml\n\n```yaml\n# values.yaml - Security hardened defaults\nsecurityContext:\n  runAsNonRoot: true\n  runAsUser: 1000\n  runAsGroup: 3000\n  fsGroup: 2000\n  readOnlyRootFilesystem: true\n  allowPrivilegeEscalation: false\n  capabilities:\n    drop:\n      - ALL\n\npodSecurityContext:\n  seccompProfile:\n    type: RuntimeDefault\n\nresources:\n  limits:\n    cpu: 500m\n    memory: 512Mi\n  requests:\n    cpu: 100m\n    memory: 128Mi\n\nnetworkPolicy:\n  enabled: true\n\nserviceAccount:\n  create: true\n  automountServiceAccountToken: false\n\nimage:\n  pullPolicy: Always\n  # Use digest instead of tag for immutability\n  # tag: \"1.0.0\"\n  # digest: \"sha256:abc123...\"\n```\n\n### Template with Security Contexts\n\n```yaml\n# plugins\u002Fdeployment.yaml\napiVersion: apps\u002Fv1\nkind: Deployment\nmetadata:\n  name: {{ include \"mychart.fullname\" . }}\nspec:\n  template:\n    spec:\n      automountServiceAccountToken: {{ .Values.serviceAccount.automountServiceAccountToken }}\n      securityContext:\n        {{- toYaml .Values.podSecurityContext | nindent 8 }}\n      containers:\n        - name: {{ .Chart.Name }}\n          securityContext:\n            {{- toYaml .Values.securityContext | nindent 12 }}\n          image: \"{{ .Values.image.repository }}:{{ .Values.image.tag }}\"\n          resources:\n            {{- toYaml .Values.resources | nindent 12 }}\n```\n\n## Secrets Management\n\n### Use External Secrets (Not Helm Values)\n\n```yaml\n# plugins\u002Fexternal-secret.yaml\napiVersion: external-secrets.io\u002Fv1beta1\nkind: ExternalSecret\nmetadata:\n  name: {{ include \"mychart.fullname\" . }}-secrets\nspec:\n  refreshInterval: 1h\n  secretStoreRef:\n    name: aws-secretsmanager\n    kind: ClusterSecretStore\n  target:\n    name: {{ include \"mychart.fullname\" . }}-secrets\n  data:\n    - secretKey: db-password\n      remoteRef:\n        key: production\u002Fdatabase\n        property: password\n```\n\n### helm-secrets Plugin\n\n```bash\n# Install helm-secrets plugin\nhelm plugin install https:\u002F\u002Fgithub.com\u002Fjkroepke\u002Fhelm-secrets\n\n# Encrypt values file\nhelm secrets encrypt values-secrets.yaml\n\n# Deploy with encrypted secrets\nhelm secrets install myrelease .\u002Fmychart -f values.yaml -f values-secrets.yaml\n\n# Decrypt for editing\nhelm secrets edit values-secrets.yaml\n```\n\n## RBAC for Helm Operations\n\n```yaml\n# helm-deployer-role.yaml\napiVersion: rbac.authorization.k8s.io\u002Fv1\nkind: Role\nmetadata:\n  name: helm-deployer\n  namespace: production\nrules:\n  - apiGroups: [\"\", \"apps\", \"batch\", \"networking.k8s.io\"]\n    resources: [\"deployments\", \"services\", \"configmaps\", \"secrets\", \"ingresses\", \"jobs\"]\n    verbs: [\"get\", \"list\", \"create\", \"update\", \"patch\", \"delete\"]\n  - apiGroups: [\"\"]\n    resources: [\"pods\", \"pods\u002Flog\"]\n    verbs: [\"get\", \"list\"]\n\n---\napiVersion: rbac.authorization.k8s.io\u002Fv1\nkind: RoleBinding\nmetadata:\n  name: helm-deployer-binding\n  namespace: production\nsubjects:\n  - kind: ServiceAccount\n    name: helm-deployer\n    namespace: production\nroleRef:\n  kind: Role\n  name: helm-deployer\n  apiGroup: rbac.authorization.k8s.io\n```\n\n## CI\u002FCD Helm Security Pipeline\n\n```yaml\n# .github\u002Fworkflows\u002Fhelm-security.yaml\nname: containers-helm\non:\n  pull_request:\n    paths: ['charts\u002F**']\n\njobs:\n  lint-and-scan:\n    runs-on: ubuntu-latest\n    steps:\n      - uses: actions\u002Fcheckout@v4\n\n      - name: Helm lint\n        run: helm lint .\u002Fcharts\u002Fmychart --strict\n\n      - name: Render plugins\n        run: helm template test .\u002Fcharts\u002Fmychart -f charts\u002Fmychart\u002Fvalues.yaml > rendered.yaml\n\n      - name: Scan with kube-linter\n        uses: stackrox\u002Fkube-linter-action@v1\n        with:\n          directory: rendered.yaml\n\n      - name: Scan with trivy\n        uses: aquasecurity\u002Ftrivy-action@master\n        with:\n          scan-type: config\n          scan-ref: rendered.yaml\n\n      - name: Scan with checkov\n        uses: bridgecrewio\u002Fcheckov-action@master\n        with:\n          file: rendered.yaml\n          framework: kubernetes\n```\n\n## Best Practices\n\n1. **Sign charts** with GPG and verify before installation\n2. **Render and scan** templates before deploying to catch misconfigurations\n3. **Enforce security contexts** in values.yaml defaults\n4. **Never store secrets** in Helm values - use external secrets or helm-secrets plugin\n5. **Use image digests** instead of tags for immutable references\n6. **Restrict Helm RBAC** to least privilege per namespace\n7. **Pin chart versions** in requirements - never use `latest`\n8. **Lint strictly** in CI with `--strict` flag\n9. **Review third-party charts** before deploying to production\n10. **Use Helm test hooks** to validate deployments post-install\n","# Securing Helm Chart Deployments\n\n## Overview\n\nHelm is the Kubernetes package manager. Securing Helm deployments requires validating chart provenance, scanning templates for security misconfigurations, enforcing pod security contexts, managing secrets securely, and controlling RBAC for Helm operations.\n\n\n## When to Use\n\n- When deploying or configuring securing helm chart deployments capabilities in your environment\n- When establishing security controls aligned to compliance requirements\n- When building or improving security architecture for this domain\n- When conducting security assessments that require this implementation\n\n## Prerequisites\n\n- Helm 3.12+ installed\n- kubectl with cluster access\n- GnuPG for chart signing\u002Fverification\n- kubesec or checkov for template scanning\n\n## Chart Provenance and Integrity\n\n### Sign a Helm Chart\n\n```bash\n# Generate GPG key for signing\ngpg --full-generate-key\n\n# Package and sign chart\nhelm package .\u002Fmychart --sign --key \"helm-signing@example.com\" --keyring ~\u002F.gnupg\u002Fpubring.gpg\n\n# Verify chart signature\nhelm verify mychart-0.1.0.tgz --keyring ~\u002F.gnupg\u002Fpubring.gpg\n```\n\n### Verify Chart Before Install\n\n```bash\n# Verify chart from repository\nhelm pull myrepo\u002Fmychart --verify --keyring \u002Fpath\u002Fto\u002Fkeyring.gpg\n\n# Check chart provenance file\ncat mychart-0.1.0.tgz.prov\n```\n\n## Template Security Scanning\n\n### Render and Scan Templates\n\n```bash\n# Render plugins without deploying\nhelm template myrelease .\u002Fmychart --values values-prod.yaml > rendered.yaml\n\n# Scan with kubesec\nkubesec scan rendered.yaml\n\n# Scan with checkov\ncheckov -f rendered.yaml --framework kubernetes\n\n# Scan with trivy\ntrivy config rendered.yaml\n\n# Scan with kube-linter\nkube-linter lint rendered.yaml\n```\n\n### Helm Lint for Misconfigurations\n\n```bash\n# Lint chart\nhelm lint .\u002Fmychart --values values-prod.yaml --strict\n\n# Lint with debug output\nhelm lint .\u002Fmychart --debug\n```\n\n## Security Context Enforcement in values.yaml\n\n```yaml\n# values.yaml - Security hardened defaults\nsecurityContext:\n  runAsNonRoot: true\n  runAsUser: 1000\n  runAsGroup: 3000\n  fsGroup: 2000\n  readOnlyRootFilesystem: true\n  allowPrivilegeEscalation: false\n  capabilities:\n    drop:\n      - ALL\n\npodSecurityContext:\n  seccompProfile:\n    type: RuntimeDefault\n\nresources:\n  limits:\n    cpu: 500m\n    memory: 512Mi\n  requests:\n    cpu: 100m\n    memory: 128Mi\n\nnetworkPolicy:\n  enabled: true\n\nserviceAccount:\n  create: true\n  automountServiceAccountToken: false\n\nimage:\n  pullPolicy: Always\n  # Use digest instead of tag for immutability\n  # tag: \"1.0.0\"\n  # digest: \"sha256:abc123...\"\n```\n\n### Template with Security Contexts\n\n```yaml\n# plugins\u002Fdeployment.yaml\napiVersion: apps\u002Fv1\nkind: Deployment\nmetadata:\n  name: {{ include \"mychart.fullname\" . }}\nspec:\n  template:\n    spec:\n      automountServiceAccountToken: {{ .Values.serviceAccount.automountServiceAccountToken }}\n      securityContext:\n        {{- toYaml .Values.podSecurityContext | nindent 8 }}\n      containers:\n        - name: {{ .Chart.Name }}\n          securityContext:\n            {{- toYaml .Values.securityContext | nindent 12 }}\n          image: \"{{ .Values.image.repository }}:{{ .Values.image.tag }}\"\n          resources:\n            {{- toYaml .Values.resources | nindent 12 }}\n```\n\n## Secrets Management\n\n### Use External Secrets (Not Helm Values)\n\n```yaml\n# plugins\u002Fexternal-secret.yaml\napiVersion: external-secrets.io\u002Fv1beta1\nkind: ExternalSecret\nmetadata:\n  name: {{ include \"mychart.fullname\" . }}-secrets\nspec:\n  refreshInterval: 1h\n  secretStoreRef:\n    name: aws-secretsmanager\n    kind: ClusterSecretStore\n  target:\n    name: {{ include \"mychart.fullname\" . }}-secrets\n  data:\n    - secretKey: db-password\n      remoteRef:\n        key: production\u002Fdatabase\n        property: password\n```\n\n### helm-secrets Plugin\n\n```bash\n# Install helm-secrets plugin\nhelm plugin install https:\u002F\u002Fgithub.com\u002Fjkroepke\u002Fhelm-secrets\n\n# Encrypt values file\nhelm secrets encrypt values-secrets.yaml\n\n# Deploy with encrypted secrets\nhelm secrets install myrelease .\u002Fmychart -f values.yaml -f values-secrets.yaml\n\n# Decrypt for editing\nhelm secrets edit values-secrets.yaml\n```\n\n## RBAC for Helm Operations\n\n```yaml\n# helm-deployer-role.yaml\napiVersion: rbac.authorization.k8s.io\u002Fv1\nkind: Role\nmetadata:\n  name: helm-deployer\n  namespace: production\nrules:\n  - apiGroups: [\"\", \"apps\", \"batch\", \"networking.k8s.io\"]\n    resources: [\"deployments\", \"services\", \"configmaps\", \"secrets\", \"ingresses\", \"jobs\"]\n    verbs: [\"get\", \"list\", \"create\", \"update\", \"patch\", \"delete\"]\n  - apiGroups: [\"\"]\n    resources: [\"pods\", \"pods\u002Flog\"]\n    verbs: [\"get\", \"list\"]\n\n---\napiVersion: rbac.authorization.k8s.io\u002Fv1\nkind: RoleBinding\nmetadata:\n  name: helm-deployer-binding\n  namespace: production\nsubjects:\n  - kind: ServiceAccount\n    name: helm-deployer\n    namespace: production\nroleRef:\n  kind: Role\n  name: helm-deployer\n  apiGroup: rbac.authorization.k8s.io\n```\n\n## CI\u002FCD Helm Security Pipeline\n\n```yaml\n# .github\u002Fworkflows\u002Fhelm-security.yaml\nname: containers-helm\non:\n  pull_request:\n    paths: ['charts\u002F**']\n\njobs:\n  lint-and-scan:\n    runs-on: ubuntu-latest\n    steps:\n      - uses: actions\u002Fcheckout@v4\n\n      - name: Helm lint\n        run: helm lint .\u002Fcharts\u002Fmychart --strict\n\n      - name: Render plugins\n        run: helm template test .\u002Fcharts\u002Fmychart -f charts\u002Fmychart\u002Fvalues.yaml > rendered.yaml\n\n      - name: Scan with kube-linter\n        uses: stackrox\u002Fkube-linter-action@v1\n        with:\n          directory: rendered.yaml\n\n      - name: Scan with trivy\n        uses: aquasecurity\u002Ftrivy-action@master\n        with:\n          scan-type: config\n          scan-ref: rendered.yaml\n\n      - name: Scan with checkov\n        uses: bridgecrewio\u002Fcheckov-action@master\n        with:\n          file: rendered.yaml\n          framework: kubernetes\n```\n\n## Best Practices\n\n1. **Sign charts** with GPG and verify before installation\n2. **Render and scan** templates before deploying to catch misconfigurations\n3. **Enforce security contexts** in values.yaml defaults\n4. **Never store secrets** in Helm values - use external secrets or helm-secrets plugin\n5. **Use image digests** instead of tags for immutable references\n6. **Restrict Helm RBAC** to least privilege per namespace\n7. **Pin chart versions** in requirements - never use `latest`\n8. **Lint strictly** in CI with `--strict` flag\n9. **Review third-party charts** before deploying to production\n10. **Use Helm test hooks** to validate deployments post-install\n",{"name":5,"tags":57,"capec":62,"model":36,"tools":63,"domain":48,"maxTurns":67,"nist_csf":68,"subdomain":44,"description":7,"mitre_attack":73},[34,58,59,37,60,61],"kubernetes","chart-security","configuration-security","deployment",[],[64,46,65,66],"Read","Glob","Grep",20,[69,70,71,72],"PR.PS-01","PR.IR-01","ID.AM-08","DE.CM-01",[74,75,76],"T1046","T1195","T1610","main","a91f1293287ffa9f4f1b8f486cd6e835a1568c84","skills\u002Fcloud\u002Fcontainers\u002Fhelm\u002Faudit","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace","https:\u002F\u002Fgithub.com\u002FDCx7C5","#Python","2026-09-01 11:21:00",{"source":8,"skillName":5,"commands":85,"prompt":95,"zipAvailable":96},[86,89,92],{"tool":87,"command":88},"npx","npx skills add DCx7C5\u002Fai-marketplace --skill containers-helm-audit",{"tool":90,"command":91},"bunx","bunx skills add DCx7C5\u002Fai-marketplace --skill containers-helm-audit",{"tool":93,"command":94},"pnpm","pnpm dlx skills add DCx7C5\u002Fai-marketplace --skill containers-helm-audit","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fcloud\u002Fcontainers\u002Fhelm\u002Faudit\u002FSKILL.md",true,[98],{"path":99,"resourceType":100,"resourceTypeDesc":101,"sizeBytes":102,"sourceHtmlUrl":103},"index.json","REFERENCE","参考文档",630,"https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fcloud\u002Fcontainers\u002Fhelm\u002Faudit\u002Findex.json",[105,128,149,170,192,208],{"skillNo":106,"name":107,"nameZh":6,"description":108,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":109,"categories":110,"keywords":111,"publishedAt":52},"01M71HAPZ01KQ30RKTB0FFSQ05","services-wmi-persistence-detect","Detect WMI event subscription persistence by enumerating ActiveScriptEventConsumer, CommandLineEventConsumer, and permanent subscriptions in the WMI repository.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fservices\u002Fwmi\u002Fpersistence\u002Fdetect\u002FSKILL.md",[],[112,113,114,115,116,45,50,117,118,119,120,121,122,123,124,125,126,48,127],"services","detect","services wmi persistence detect","wmi","persistence","process","activescript","event","subscriptions","commandline-consumer","repository","subscription","event-subscription","t1546.003","forensics","process-forensics",{"skillNo":129,"name":130,"nameZh":6,"description":131,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":132,"categories":133,"keywords":134,"publishedAt":52},"01M71HAK6JTTTS229T17WJMMCG","services-wmi-exec-exploit","Perform lateral movement across Windows networks using WMI-based remote execution techniques including Impacket wmiexec.py, CrackMapExec, and native WMI commands for stealthy post-exploitation during red team engagements.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fservices\u002Fwmi\u002Fexec\u002Fexploit\u002FSKILL.md",[],[135,112,136,115,137,138,139,48,46,140,141,142,143,144,45,145,146,41,147,148],"exploit","services wmi exec exploit","exec","remote","traffic","analysis","team","across","crackmapexec","native","command","lateral movement","lateral-movement","Impacket",{"skillNo":150,"name":151,"nameZh":6,"description":152,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":153,"categories":154,"keywords":155,"publishedAt":52},"01M71HAG6MHKNQV8KDZKMT4886","registry-artifact-extract","Extract and analyze Windows Registry hives to uncover user activity, installed software, autostart entries, and evidence of system compromise.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fregistry\u002Fartifact\u002Fextract\u002FSKILL.md",[],[156,157,158,159,160,161,48,46,162,140,163,164,45,41,165,166,167,168,169,36],"artifact","registry","registry artifact extract","extract","evidence-collection","artifact-analysis","collection","analyze","uncover","software","activity","digital-forensics","windows-registry","regripper",{"skillNo":171,"name":172,"nameZh":6,"description":173,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":174,"categories":175,"keywords":176,"publishedAt":52},"01M71HACR4A8XTWTTSXK4124AA","processes-token-impersonate-detect","Detect Windows token impersonation and privilege abuse including SeImpersonatePrivilege exploitation via Potato attacks and token stealing techniques.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fprocesses\u002Ftoken\u002Fimpersonate\u002Fdetect\u002FSKILL.md",[],[113,177,178,179,180,181,182,50,183,48,127,184,185,186,187,188,189,190,191,45],"processes token impersonate detect","token","processes","attacks","windows","escalation","techniques","privilege-escalation","seimpersonate","token-impersonation","printspoofer","exploitation","potato","impersonation","via",{"skillNo":193,"name":194,"nameZh":6,"description":195,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":196,"categories":197,"keywords":198,"publishedAt":52},"01M71HAABSB4Z6QFSXEG00R4RK","processes-thread-injection-detect","Detect Windows thread injection techniques including CreateRemoteThread, QueueUserAPC, NtCreateThreadEx, and thread hijacking via process memory analysis.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fprocesses\u002Fthread\u002Finjection\u002Fdetect\u002FSKILL.md",[],[199,200,113,201,179,181,202,50,203,183,48,127,140,204,205,206,207,191,45,117],"thread","processes thread injection detect","injection","memory","process-injection","api","apc-injection","thread-injection","nt-api",{"skillNo":209,"name":210,"nameZh":6,"description":211,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":212,"categories":213,"keywords":214,"publishedAt":52},"01M71HA7H311V5G14WMX58HQSS","processes-hollow-technique-detect","Detect process hollowing (RunPE) by identifying processes with mismatched image paths between PEB and VAD tree, or unmapped PE headers in memory.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fprocesses\u002Fhollow\u002Ftechnique\u002Fdetect\u002FSKILL.md",[],[215,113,179,216,202,50,217,218,48,127,219,220,221,222,223,224,45,117,225,226],"processes hollow technique detect","tree","memory-forensics","process-hollow","peb","runpe","image","pe-header","in memory","with","mismatched","headers"]