[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M71CG1H1KBM4B2Q2CCF2PEPM":3,"skill-same:01M71CG1H1KBM4B2Q2CCF2PEPM":93},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":23,"publishedAt":44,"linkOnly":45,"markdownContent":46,"markdownBody":47,"frontMatter":48,"refName":66,"commitSha":67,"skillDirectory":68,"forksCount":14,"repositoryHtmlUrl":69,"repositoryHomepageUrl":6,"ownerHtmlUrl":70,"ownerBlogUrl":6,"ownerDescription":71,"updatedAt":72,"install":73,"resources":86},"01M71CG1H1KBM4B2Q2CCF2PEPM","containers-registry-harbor-exploit",null,"Harbor is an open-source container registry that provides security features including vulnerability scanning (integrated Trivy), image signing (Notary\u002FCosign), RBAC, content trust policies, replicatio","DCx7C5\u002Fai-marketplace","DCx7C5","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F42419559?v=4","01M71C01G2AZV3NTNGWAWSHJPP","DC","01M71C01GQW6G50S2BYMS7PP3E",0,"MIT","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fcloud\u002Fcontainers\u002Fregistry\u002Fharbor\u002Fexploit\u002FSKILL.md",[18],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000011","运维与部署","SCENARIO","使用场景",[24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43],"containers","containers registry harbor exploit","exploit","harbor","registry","rbac","container-security","vulnerability","cybersecurity","open","Bash","read","scanning","security","cm","de","sonnet","source","features","image","2026-11-10 10:12:30",false,"---\nname: containers-registry-harbor-exploit\ndescription: Harbor is an open-source container registry that provides security features including vulnerability scanning (integrated Trivy), image signing (Notary\u002FCosign), RBAC, content trust policies, replicatio\ndomain: cybersecurity\nsubdomain: container-security\ntags:\n- containers\n- kubernetes\n- docker\n- security\n- registry\n- harbor\nnist_csf:\n- PR.PS-01\n- PR.IR-01\n- ID.AM-08\n- DE.CM-01\nmodel: sonnet\nmaxTurns: 20\ntools: [Read, Bash, Glob, Grep]\nmitre_attack:\n- T1046\n- T1610\ncapec: []\n---\n\n# Securing Container Registry with Harbor\n\n## Overview\n\nHarbor is an open-source container registry that provides security features including vulnerability scanning (integrated Trivy), image signing (Notary\u002FCosign), RBAC, content trust policies, replication, and audit logging. Securing Harbor involves configuring these features to enforce image provenance, prevent vulnerable image deployment, and maintain registry access control.\n\n\n## When to Use\n\n- When deploying or configuring securing container registry with harbor capabilities in your environment\n- When establishing security controls aligned to compliance requirements\n- When building or improving security architecture for this domain\n- When conducting security assessments that require this implementation\n\n## Prerequisites\n\n- Harbor 2.10+ installed (Helm or Docker Compose)\n- TLS certificates for HTTPS\n- Trivy scanner integration\n- OIDC\u002FLDAP for authentication\n- Kubernetes cluster (for deployment target)\n\n## Workflow\n\n### Step 1: Install Harbor with Security Configuration\n\n```yaml\n# harbor-values.yaml for Helm deployment\nexpose:\n  type: ingress\n  tls:\n    enabled: true\n    certSource: secret\n    secret:\n      secretName: harbor-tls\n      notarySecretName: harbor-tls\n  ingress:\n    hosts:\n      core: harbor.example.com\n      notary: notary.example.com\n\nexternalURL: https:\u002F\u002Fharbor.example.com\n\npersistence:\n  enabled: true\n  resourcePolicy: \"keep\"\n\nharborAdminPassword: \"\u003Cstrong-password>\"\n\ntrivy:\n  enabled: true\n  gitHubToken: \"\u003Cgithub-token>\"\n  severity: \"CRITICAL,HIGH,MEDIUM\"\n  autoScan: true\n\nnotary:\n  enabled: true\n\ncore:\n  secretKey: \"\u003C32-char-secret>\"\n\ndatabase:\n  type: external\n  external:\n    host: postgres.example.com\n    port: \"5432\"\n    username: harbor\n    password: \"\u003Cdb-password>\"\n    sslmode: require\n```\n\n```bash\nhelm repo add harbor https:\u002F\u002Fhelm.getharbor.io\nhelm install harbor harbor\u002Fharbor -f harbor-values.yaml -n harbor --create-namespace\n```\n\n### Step 2: Configure Vulnerability Scanning Policies\n\n```bash\n# Enable auto-scan on push (via Harbor API)\ncurl -k -X PUT \"https:\u002F\u002Fharbor.example.com\u002Fapi\u002Fv2.0\u002Fprojects\u002Fmyproject\" \\\n  -H \"Authorization: Basic $(echo -n admin:Harbor12345 | base64)\" \\\n  -H \"Content-Type: application\u002Fjson\" \\\n  -d '{\n    \"metadata\": {\n      \"auto_scan\": \"true\",\n      \"severity\": \"critical\",\n      \"prevent_vul\": \"true\",\n      \"reuse_sys_cve_allowlist\": \"true\"\n    }\n  }'\n```\n\n### Step 3: Configure Content Trust\n\n```bash\n# Enable content trust at project level\ncurl -k -X PUT \"https:\u002F\u002Fharbor.example.com\u002Fapi\u002Fv2.0\u002Fprojects\u002Fmyproject\" \\\n  -H \"Authorization: Basic $(echo -n admin:Harbor12345 | base64)\" \\\n  -H \"Content-Type: application\u002Fjson\" \\\n  -d '{\n    \"metadata\": {\n      \"enable_content_trust\": \"true\",\n      \"enable_content_trust_cosign\": \"true\"\n    }\n  }'\n\n# Sign image with Cosign\ncosign sign --key cosign.key harbor.example.com\u002Fmyproject\u002Fmyapp:v1.0.0\n\n# Verify signature\ncosign verify --key cosign.pub harbor.example.com\u002Fmyproject\u002Fmyapp:v1.0.0\n```\n\n### Step 4: Configure RBAC and Project Isolation\n\n```bash\n# Create project with private visibility\ncurl -k -X POST \"https:\u002F\u002Fharbor.example.com\u002Fapi\u002Fv2.0\u002Fprojects\" \\\n  -H \"Authorization: Basic $(echo -n admin:Harbor12345 | base64)\" \\\n  -H \"Content-Type: application\u002Fjson\" \\\n  -d '{\n    \"project_name\": \"production\",\n    \"metadata\": {\n      \"public\": \"false\",\n      \"auto_scan\": \"true\",\n      \"prevent_vul\": \"true\",\n      \"severity\": \"high\"\n    }\n  }'\n\n# Harbor roles: ProjectAdmin, Maintainer, Developer, Guest, LimitedGuest\n# Add member with specific role\ncurl -k -X POST \"https:\u002F\u002Fharbor.example.com\u002Fapi\u002Fv2.0\u002Fprojects\u002Fproduction\u002Fmembers\" \\\n  -H \"Authorization: Basic $(echo -n admin:Harbor12345 | base64)\" \\\n  -H \"Content-Type: application\u002Fjson\" \\\n  -d '{\n    \"role_id\": 3,\n    \"member_user\": {\"username\": \"developer1\"}\n  }'\n```\n\n### Step 5: Configure Immutable Tags and Retention\n\n```bash\n# Create tag immutability rule (prevent overwriting release tags)\ncurl -k -X POST \"https:\u002F\u002Fharbor.example.com\u002Fapi\u002Fv2.0\u002Fprojects\u002Fproduction\u002Fimmutabletagrules\" \\\n  -H \"Authorization: Basic $(echo -n admin:Harbor12345 | base64)\" \\\n  -H \"Content-Type: application\u002Fjson\" \\\n  -d '{\n    \"tag_filter\": \"v*\",\n    \"scope_selectors\": {\n      \"repository\": [{\"kind\": \"doublestar\", \"decoration\": \"repoMatches\", \"pattern\": \"**\"}]\n    }\n  }'\n\n# Configure retention policy (keep last 10 tags, delete untagged after 7 days)\ncurl -k -X POST \"https:\u002F\u002Fharbor.example.com\u002Fapi\u002Fv2.0\u002Fretentions\" \\\n  -H \"Authorization: Basic $(echo -n admin:Harbor12345 | base64)\" \\\n  -H \"Content-Type: application\u002Fjson\" \\\n  -d '{\n    \"algorithm\": \"or\",\n    \"rules\": [\n      {\n        \"action\": \"retain\",\n        \"template\": \"latestPushedK\",\n        \"params\": {\"latestPushedK\": 10},\n        \"tag_selectors\": [{\"kind\": \"doublestar\", \"decoration\": \"matches\", \"pattern\": \"**\"}],\n        \"scope_selectors\": {\"repository\": [{\"kind\": \"doublestar\", \"decoration\": \"repoMatches\", \"pattern\": \"**\"}]}\n      }\n    ],\n    \"trigger\": {\"kind\": \"Schedule\", \"settings\": {\"cron\": \"0 0 * * *\"}}\n  }'\n```\n\n### Step 6: OIDC Authentication Integration\n\n```yaml\n# Harbor configuration for OIDC\nauth_mode: oidc_auth\noidc_name: \"Okta\"\noidc_endpoint: \"https:\u002F\u002Fcompany.okta.com\u002Foauth2\u002Fdefault\"\noidc_client_id: \"harbor-client-id\"\noidc_client_secret: \"harbor-client-secret\"\noidc_groups_claim: \"groups\"\noidc_admin_group: \"harbor-admins\"\noidc_scope: \"openid,profile,email,groups\"\noidc_verify_cert: true\noidc_auto_onboard: true\n```\n\n## Validation Commands\n\n```bash\n# Test vulnerability prevention (should block pull of vulnerable image)\ndocker pull harbor.example.com\u002Fproduction\u002Fvulnerable-app:latest\n# Expected: Error - image blocked due to vulnerabilities\n\n# Verify content trust enforcement\nDOCKER_CONTENT_TRUST=0 docker push harbor.example.com\u002Fproduction\u002Funsigned:latest\n# Expected: Push rejected due to content trust policy\n\n# Check scan results via API\ncurl -k \"https:\u002F\u002Fharbor.example.com\u002Fapi\u002Fv2.0\u002Fprojects\u002Fproduction\u002Frepositories\u002Fmyapp\u002Fartifacts\u002Fv1.0.0\u002Fadditions\u002Fvulnerabilities\" \\\n  -H \"Authorization: Basic $(echo -n admin:Harbor12345 | base64)\"\n\n# Audit log check\ncurl -k \"https:\u002F\u002Fharbor.example.com\u002Fapi\u002Fv2.0\u002Faudit-logs?page=1&page_size=10\" \\\n  -H \"Authorization: Basic $(echo -n admin:Harbor12345 | base64)\"\n```\n\n## References\n\n- [Harbor Documentation](https:\u002F\u002Fgoharbor.io\u002Fdocs\u002F)\n- [Harbor Security Best Practices](https:\u002F\u002Fgoharbor.io\u002Fdocs\u002F2.10.0\u002Fadministration\u002Fvulnerability-scanning\u002F)\n- [Harbor GitHub Repository](https:\u002F\u002Fgithub.com\u002Fgoharbor\u002Fharbor)\n","# Securing Container Registry with Harbor\n\n## Overview\n\nHarbor is an open-source container registry that provides security features including vulnerability scanning (integrated Trivy), image signing (Notary\u002FCosign), RBAC, content trust policies, replication, and audit logging. Securing Harbor involves configuring these features to enforce image provenance, prevent vulnerable image deployment, and maintain registry access control.\n\n\n## When to Use\n\n- When deploying or configuring securing container registry with harbor capabilities in your environment\n- When establishing security controls aligned to compliance requirements\n- When building or improving security architecture for this domain\n- When conducting security assessments that require this implementation\n\n## Prerequisites\n\n- Harbor 2.10+ installed (Helm or Docker Compose)\n- TLS certificates for HTTPS\n- Trivy scanner integration\n- OIDC\u002FLDAP for authentication\n- Kubernetes cluster (for deployment target)\n\n## Workflow\n\n### Step 1: Install Harbor with Security Configuration\n\n```yaml\n# harbor-values.yaml for Helm deployment\nexpose:\n  type: ingress\n  tls:\n    enabled: true\n    certSource: secret\n    secret:\n      secretName: harbor-tls\n      notarySecretName: harbor-tls\n  ingress:\n    hosts:\n      core: harbor.example.com\n      notary: notary.example.com\n\nexternalURL: https:\u002F\u002Fharbor.example.com\n\npersistence:\n  enabled: true\n  resourcePolicy: \"keep\"\n\nharborAdminPassword: \"\u003Cstrong-password>\"\n\ntrivy:\n  enabled: true\n  gitHubToken: \"\u003Cgithub-token>\"\n  severity: \"CRITICAL,HIGH,MEDIUM\"\n  autoScan: true\n\nnotary:\n  enabled: true\n\ncore:\n  secretKey: \"\u003C32-char-secret>\"\n\ndatabase:\n  type: external\n  external:\n    host: postgres.example.com\n    port: \"5432\"\n    username: harbor\n    password: \"\u003Cdb-password>\"\n    sslmode: require\n```\n\n```bash\nhelm repo add harbor https:\u002F\u002Fhelm.getharbor.io\nhelm install harbor harbor\u002Fharbor -f harbor-values.yaml -n harbor --create-namespace\n```\n\n### Step 2: Configure Vulnerability Scanning Policies\n\n```bash\n# Enable auto-scan on push (via Harbor API)\ncurl -k -X PUT \"https:\u002F\u002Fharbor.example.com\u002Fapi\u002Fv2.0\u002Fprojects\u002Fmyproject\" \\\n  -H \"Authorization: Basic $(echo -n admin:Harbor12345 | base64)\" \\\n  -H \"Content-Type: application\u002Fjson\" \\\n  -d '{\n    \"metadata\": {\n      \"auto_scan\": \"true\",\n      \"severity\": \"critical\",\n      \"prevent_vul\": \"true\",\n      \"reuse_sys_cve_allowlist\": \"true\"\n    }\n  }'\n```\n\n### Step 3: Configure Content Trust\n\n```bash\n# Enable content trust at project level\ncurl -k -X PUT \"https:\u002F\u002Fharbor.example.com\u002Fapi\u002Fv2.0\u002Fprojects\u002Fmyproject\" \\\n  -H \"Authorization: Basic $(echo -n admin:Harbor12345 | base64)\" \\\n  -H \"Content-Type: application\u002Fjson\" \\\n  -d '{\n    \"metadata\": {\n      \"enable_content_trust\": \"true\",\n      \"enable_content_trust_cosign\": \"true\"\n    }\n  }'\n\n# Sign image with Cosign\ncosign sign --key cosign.key harbor.example.com\u002Fmyproject\u002Fmyapp:v1.0.0\n\n# Verify signature\ncosign verify --key cosign.pub harbor.example.com\u002Fmyproject\u002Fmyapp:v1.0.0\n```\n\n### Step 4: Configure RBAC and Project Isolation\n\n```bash\n# Create project with private visibility\ncurl -k -X POST \"https:\u002F\u002Fharbor.example.com\u002Fapi\u002Fv2.0\u002Fprojects\" \\\n  -H \"Authorization: Basic $(echo -n admin:Harbor12345 | base64)\" \\\n  -H \"Content-Type: application\u002Fjson\" \\\n  -d '{\n    \"project_name\": \"production\",\n    \"metadata\": {\n      \"public\": \"false\",\n      \"auto_scan\": \"true\",\n      \"prevent_vul\": \"true\",\n      \"severity\": \"high\"\n    }\n  }'\n\n# Harbor roles: ProjectAdmin, Maintainer, Developer, Guest, LimitedGuest\n# Add member with specific role\ncurl -k -X POST \"https:\u002F\u002Fharbor.example.com\u002Fapi\u002Fv2.0\u002Fprojects\u002Fproduction\u002Fmembers\" \\\n  -H \"Authorization: Basic $(echo -n admin:Harbor12345 | base64)\" \\\n  -H \"Content-Type: application\u002Fjson\" \\\n  -d '{\n    \"role_id\": 3,\n    \"member_user\": {\"username\": \"developer1\"}\n  }'\n```\n\n### Step 5: Configure Immutable Tags and Retention\n\n```bash\n# Create tag immutability rule (prevent overwriting release tags)\ncurl -k -X POST \"https:\u002F\u002Fharbor.example.com\u002Fapi\u002Fv2.0\u002Fprojects\u002Fproduction\u002Fimmutabletagrules\" \\\n  -H \"Authorization: Basic $(echo -n admin:Harbor12345 | base64)\" \\\n  -H \"Content-Type: application\u002Fjson\" \\\n  -d '{\n    \"tag_filter\": \"v*\",\n    \"scope_selectors\": {\n      \"repository\": [{\"kind\": \"doublestar\", \"decoration\": \"repoMatches\", \"pattern\": \"**\"}]\n    }\n  }'\n\n# Configure retention policy (keep last 10 tags, delete untagged after 7 days)\ncurl -k -X POST \"https:\u002F\u002Fharbor.example.com\u002Fapi\u002Fv2.0\u002Fretentions\" \\\n  -H \"Authorization: Basic $(echo -n admin:Harbor12345 | base64)\" \\\n  -H \"Content-Type: application\u002Fjson\" \\\n  -d '{\n    \"algorithm\": \"or\",\n    \"rules\": [\n      {\n        \"action\": \"retain\",\n        \"template\": \"latestPushedK\",\n        \"params\": {\"latestPushedK\": 10},\n        \"tag_selectors\": [{\"kind\": \"doublestar\", \"decoration\": \"matches\", \"pattern\": \"**\"}],\n        \"scope_selectors\": {\"repository\": [{\"kind\": \"doublestar\", \"decoration\": \"repoMatches\", \"pattern\": \"**\"}]}\n      }\n    ],\n    \"trigger\": {\"kind\": \"Schedule\", \"settings\": {\"cron\": \"0 0 * * *\"}}\n  }'\n```\n\n### Step 6: OIDC Authentication Integration\n\n```yaml\n# Harbor configuration for OIDC\nauth_mode: oidc_auth\noidc_name: \"Okta\"\noidc_endpoint: \"https:\u002F\u002Fcompany.okta.com\u002Foauth2\u002Fdefault\"\noidc_client_id: \"harbor-client-id\"\noidc_client_secret: \"harbor-client-secret\"\noidc_groups_claim: \"groups\"\noidc_admin_group: \"harbor-admins\"\noidc_scope: \"openid,profile,email,groups\"\noidc_verify_cert: true\noidc_auto_onboard: true\n```\n\n## Validation Commands\n\n```bash\n# Test vulnerability prevention (should block pull of vulnerable image)\ndocker pull harbor.example.com\u002Fproduction\u002Fvulnerable-app:latest\n# Expected: Error - image blocked due to vulnerabilities\n\n# Verify content trust enforcement\nDOCKER_CONTENT_TRUST=0 docker push harbor.example.com\u002Fproduction\u002Funsigned:latest\n# Expected: Push rejected due to content trust policy\n\n# Check scan results via API\ncurl -k \"https:\u002F\u002Fharbor.example.com\u002Fapi\u002Fv2.0\u002Fprojects\u002Fproduction\u002Frepositories\u002Fmyapp\u002Fartifacts\u002Fv1.0.0\u002Fadditions\u002Fvulnerabilities\" \\\n  -H \"Authorization: Basic $(echo -n admin:Harbor12345 | base64)\"\n\n# Audit log check\ncurl -k \"https:\u002F\u002Fharbor.example.com\u002Fapi\u002Fv2.0\u002Faudit-logs?page=1&page_size=10\" \\\n  -H \"Authorization: Basic $(echo -n admin:Harbor12345 | base64)\"\n```\n\n## References\n\n- [Harbor Documentation](https:\u002F\u002Fgoharbor.io\u002Fdocs\u002F)\n- [Harbor Security Best Practices](https:\u002F\u002Fgoharbor.io\u002Fdocs\u002F2.10.0\u002Fadministration\u002Fvulnerability-scanning\u002F)\n- [Harbor GitHub Repository](https:\u002F\u002Fgithub.com\u002Fgoharbor\u002Fharbor)\n",{"name":5,"tags":49,"capec":52,"model":40,"tools":53,"domain":32,"maxTurns":57,"nist_csf":58,"subdomain":30,"description":7,"mitre_attack":63},[24,50,51,37,28,27],"kubernetes","docker",[],[54,34,55,56],"Read","Glob","Grep",20,[59,60,61,62],"PR.PS-01","PR.IR-01","ID.AM-08","DE.CM-01",[64,65],"T1046","T1610","main","a91f1293287ffa9f4f1b8f486cd6e835a1568c84","skills\u002Fcloud\u002Fcontainers\u002Fregistry\u002Fharbor\u002Fexploit","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace","https:\u002F\u002Fgithub.com\u002FDCx7C5","#Python","2026-09-01 11:21:00",{"source":8,"skillName":5,"commands":74,"prompt":84,"zipAvailable":85},[75,78,81],{"tool":76,"command":77},"npx","npx skills add DCx7C5\u002Fai-marketplace --skill containers-registry-harbor-exploit",{"tool":79,"command":80},"bunx","bunx skills add DCx7C5\u002Fai-marketplace --skill containers-registry-harbor-exploit",{"tool":82,"command":83},"pnpm","pnpm dlx skills add DCx7C5\u002Fai-marketplace --skill containers-registry-harbor-exploit","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fcloud\u002Fcontainers\u002Fregistry\u002Fharbor\u002Fexploit\u002FSKILL.md",true,[87],{"path":88,"resourceType":89,"resourceTypeDesc":90,"sizeBytes":91,"sourceHtmlUrl":92},"index.json","REFERENCE","参考文档",713,"https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fcloud\u002Fcontainers\u002Fregistry\u002Fharbor\u002Fexploit\u002Findex.json",[94,117,137,157,179,195],{"skillNo":95,"name":96,"nameZh":6,"description":97,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":98,"categories":99,"keywords":100,"publishedAt":44},"01M71HAPZ01KQ30RKTB0FFSQ05","services-wmi-persistence-detect","Detect WMI event subscription persistence by enumerating ActiveScriptEventConsumer, CommandLineEventConsumer, and permanent subscriptions in the WMI repository.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fservices\u002Fwmi\u002Fpersistence\u002Fdetect\u002FSKILL.md",[],[101,102,103,104,105,39,38,106,107,108,109,110,111,112,113,114,115,32,116],"services","detect","services wmi persistence detect","wmi","persistence","process","activescript","event","subscriptions","commandline-consumer","repository","subscription","event-subscription","t1546.003","forensics","process-forensics",{"skillNo":118,"name":119,"nameZh":6,"description":120,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":121,"categories":122,"keywords":123,"publishedAt":44},"01M71HAK6JTTTS229T17WJMMCG","services-wmi-exec-exploit","Perform lateral movement across Windows networks using WMI-based remote execution techniques including Impacket wmiexec.py, CrackMapExec, and native WMI commands for stealthy post-exploitation during red team engagements.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fservices\u002Fwmi\u002Fexec\u002Fexploit\u002FSKILL.md",[],[26,101,124,104,125,126,127,32,34,128,129,130,131,132,39,133,134,35,135,136],"services wmi exec exploit","exec","remote","traffic","analysis","team","across","crackmapexec","native","command","lateral movement","lateral-movement","Impacket",{"skillNo":138,"name":139,"nameZh":6,"description":140,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":141,"categories":142,"keywords":143,"publishedAt":44},"01M71HAG6MHKNQV8KDZKMT4886","registry-artifact-extract","Extract and analyze Windows Registry hives to uncover user activity, installed software, autostart entries, and evidence of system compromise.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fregistry\u002Fartifact\u002Fextract\u002FSKILL.md",[],[144,28,145,146,147,148,32,34,149,128,150,151,39,35,152,153,154,155,156,40],"artifact","registry artifact extract","extract","evidence-collection","artifact-analysis","collection","analyze","uncover","software","activity","digital-forensics","windows-registry","regripper",{"skillNo":158,"name":159,"nameZh":6,"description":160,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":161,"categories":162,"keywords":163,"publishedAt":44},"01M71HACR4A8XTWTTSXK4124AA","processes-token-impersonate-detect","Detect Windows token impersonation and privilege abuse including SeImpersonatePrivilege exploitation via Potato attacks and token stealing techniques.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fprocesses\u002Ftoken\u002Fimpersonate\u002Fdetect\u002FSKILL.md",[],[102,164,165,166,167,168,169,38,170,32,116,171,172,173,174,175,176,177,178,39],"processes token impersonate detect","token","processes","attacks","windows","escalation","techniques","privilege-escalation","seimpersonate","token-impersonation","printspoofer","exploitation","potato","impersonation","via",{"skillNo":180,"name":181,"nameZh":6,"description":182,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":183,"categories":184,"keywords":185,"publishedAt":44},"01M71HAABSB4Z6QFSXEG00R4RK","processes-thread-injection-detect","Detect Windows thread injection techniques including CreateRemoteThread, QueueUserAPC, NtCreateThreadEx, and thread hijacking via process memory analysis.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fprocesses\u002Fthread\u002Finjection\u002Fdetect\u002FSKILL.md",[],[186,187,102,188,166,168,189,38,190,170,32,116,128,191,192,193,194,178,39,106],"thread","processes thread injection detect","injection","memory","process-injection","api","apc-injection","thread-injection","nt-api",{"skillNo":196,"name":197,"nameZh":6,"description":198,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":199,"categories":200,"keywords":201,"publishedAt":44},"01M71HA7H311V5G14WMX58HQSS","processes-hollow-technique-detect","Detect process hollowing (RunPE) by identifying processes with mismatched image paths between PEB and VAD tree, or unmapped PE headers in memory.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fprocesses\u002Fhollow\u002Ftechnique\u002Fdetect\u002FSKILL.md",[],[202,102,166,203,189,38,204,205,32,116,206,207,43,208,209,210,39,106,211,212],"processes hollow technique detect","tree","memory-forensics","process-hollow","peb","runpe","pe-header","in memory","with","mismatched","headers"]