[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M71CG4HT330F88QVPPEXW5CR":3,"skill-same:01M71CG4HT330F88QVPPEXW5CR":104},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":23,"publishedAt":44,"linkOnly":45,"markdownContent":46,"markdownBody":47,"frontMatter":48,"refName":77,"commitSha":78,"skillDirectory":79,"forksCount":14,"repositoryHtmlUrl":80,"repositoryHomepageUrl":6,"ownerHtmlUrl":81,"ownerBlogUrl":6,"ownerDescription":82,"updatedAt":83,"install":84,"resources":97},"01M71CG4HT330F88QVPPEXW5CR","containers-runtime-detect",null,"Implement eBPF-based runtime security observability and enforcement in Kubernetes clusters using Cilium Tetragon for kernel-level threat detection and policy enforcement.","DCx7C5\u002Fai-marketplace","DCx7C5","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F42419559?v=4","01M71C01G2AZV3NTNGWAWSHJPP","DC","01M71C01GQW6G50S2BYMS7PP3E",0,"MIT","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fcloud\u002Fcontainers\u002Fruntime\u002Fdetect\u002FSKILL.md",[18],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000011","运维与部署","SCENARIO","使用场景",[24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43],"containers","containers runtime detect","detect","runtime","observability","ebpf","sonnet","threat","Clusters","security","read","container-security","de","security observability","Bash","aml","cybersecurity","map","cm","runtime-security","2026-11-10 10:12:30",false,"---\nname: containers-runtime-detect\ndescription: Implement eBPF-based runtime security observability and enforcement in Kubernetes clusters using Cilium Tetragon for kernel-level threat detection and policy enforcement.\ndomain: cybersecurity\nsubdomain: container-security\ntags:\n- tetragon\n- ebpf\n- runtime-security\n- kubernetes\n- cilium\n- container-security\n- observability\n- kernel-security\n- cncf\nnist_ai_rmf:\n- MEASURE-2.7\n- MAP-5.1\n- MANAGE-2.4\natlas_techniques:\n- AML.T0070\n- AML.T0066\n- AML.T0082\nnist_csf:\n- PR.PS-01\n- PR.IR-01\n- ID.AM-08\n- DE.CM-01\nmodel: sonnet\nmaxTurns: 20\ntools: [Read, Bash, Glob, Grep]\nmitre_attack:\n- T1547\n- T1610\ncapec: []\n---\n\n# Implementing Runtime Security with Tetragon\n\n## Overview\n\nTetragon is a CNCF project under Cilium that provides flexible Kubernetes-aware security observability and runtime enforcement using eBPF. By operating at the Linux kernel level, Tetragon can monitor and enforce policies on process execution, file access, network connections, and system calls with less than 1% performance overhead -- far more efficient than traditional user-space security agents.\n\n\n## When to Use\n\n- When deploying or configuring implementing runtime security with tetragon capabilities in your environment\n- When establishing security controls aligned to compliance requirements\n- When building or improving security architecture for this domain\n- When conducting security assessments that require this implementation\n\n## Prerequisites\n\n- Kubernetes cluster v1.24+ with Helm 3.x installed\n- Linux kernel 5.4+ (5.10+ recommended for full eBPF feature support)\n- kubectl access with cluster-admin privileges\n- Familiarity with eBPF concepts and Kubernetes security primitives\n\n## Core Concepts\n\n### eBPF-Based Security\n\nTetragon attaches eBPF programs directly to kernel functions, enabling:\n\n- **Process lifecycle tracking**: Monitor every process creation, execution, and termination across all pods\n- **File integrity monitoring**: Detect unauthorized reads\u002Fwrites to sensitive files\n- **Network observability**: Track all TCP\u002FUDP connections with full pod context\n- **System call filtering**: Enforce policies on dangerous syscalls like ptrace, mount, or unshare\n\n### TracingPolicy Custom Resources\n\nTetragon uses `TracingPolicy` CRDs to define what kernel events to observe and what actions to take:\n\n```yaml\napiVersion: cilium.io\u002Fv1alpha1\nkind: TracingPolicy\nmetadata:\n  name: detect-privilege-escalation\nspec:\n  kprobes:\n    - call: \"security_bprm_check\"\n      syscall: false\n      args:\n        - index: 0\n          type: \"linux_binprm\"\n      selectors:\n        - matchBinaries:\n            - operator: \"In\"\n              values:\n                - \"\u002Fbin\u002Fsu\"\n                - \"\u002Fusr\u002Fbin\u002Fsudo\"\n                - \"\u002Fusr\u002Fbin\u002Fpasswd\"\n          matchNamespaces:\n            - namespace: Pid\n              operator: NotIn\n              values:\n                - \"host_ns\"\n          matchActions:\n            - action: Post\n```\n\n### Enforcement Actions\n\nTetragon can take three types of actions directly in the kernel:\n\n1. **Sigkill**: Immediately terminate the offending process\n2. **Signal**: Send a configurable signal to the process\n3. **Override**: Override the return value of a kernel function to deny an operation\n\n## Installation and Configuration\n\n### Step 1: Install Tetragon with Helm\n\n```bash\nhelm repo add cilium https:\u002F\u002Fhelm.cilium.io\nhelm repo update\n\nhelm install tetragon cilium\u002Ftetragon \\\n  --namespace kube-system \\\n  --set tetragon.enableProcessCred=true \\\n  --set tetragon.enableProcessNs=true \\\n  --set tetragon.grpc.address=\"localhost:54321\"\n```\n\n### Step 2: Install the Tetragon CLI\n\n```bash\nGOOS=$(go env GOOS)\nGOARCH=$(go env GOARCH)\ncurl -L --remote-name-all \\\n  https:\u002F\u002Fgithub.com\u002Fcilium\u002Ftetragon\u002Freleases\u002Flatest\u002Fdownload\u002Ftetra-${GOOS}-${GOARCH}.tar.gz\ntar -xzvf tetra-${GOOS}-${GOARCH}.tar.gz\nsudo install tetra \u002Fusr\u002Flocal\u002Fbin\u002F\n```\n\n### Step 3: Verify Installation\n\n```bash\nkubectl get pods -n kube-system -l app.kubernetes.io\u002Fname=tetragon\ntetra status\n```\n\n## Practical Implementation\n\n### Detecting Container Escape Attempts\n\nCreate a TracingPolicy to detect processes attempting to escape container namespaces:\n\n```yaml\napiVersion: cilium.io\u002Fv1alpha1\nkind: TracingPolicy\nmetadata:\n  name: detect-container-escape\nspec:\n  kprobes:\n    - call: \"__x64_sys_setns\"\n      syscall: true\n      args:\n        - index: 0\n          type: \"int\"\n        - index: 1\n          type: \"int\"\n      selectors:\n        - matchNamespaces:\n            - namespace: Pid\n              operator: NotIn\n              values:\n                - \"host_ns\"\n          matchActions:\n            - action: Sigkill\n```\n\n### Monitoring Sensitive File Access\n\nDetect reads of sensitive credentials:\n\n```yaml\napiVersion: cilium.io\u002Fv1alpha1\nkind: TracingPolicy\nmetadata:\n  name: monitor-sensitive-files\nspec:\n  kprobes:\n    - call: \"security_file_open\"\n      syscall: false\n      args:\n        - index: 0\n          type: \"file\"\n      selectors:\n        - matchArgs:\n            - index: 0\n              operator: \"Prefix\"\n              values:\n                - \"\u002Fetc\u002Fshadow\"\n                - \"\u002Fetc\u002Fkubernetes\u002Fpki\"\n                - \"\u002Fvar\u002Frun\u002Fsecrets\u002Fkubernetes.io\"\n          matchActions:\n            - action: Post\n```\n\n### Blocking Crypto-Miner Execution\n\nPrevent known crypto-mining binaries from executing:\n\n```yaml\napiVersion: cilium.io\u002Fv1alpha1\nkind: TracingPolicy\nmetadata:\n  name: block-cryptominers\nspec:\n  kprobes:\n    - call: \"security_bprm_check\"\n      syscall: false\n      args:\n        - index: 0\n          type: \"linux_binprm\"\n      selectors:\n        - matchBinaries:\n            - operator: \"In\"\n              values:\n                - \"\u002Fusr\u002Fbin\u002Fxmrig\"\n                - \"\u002Ftmp\u002Fxmrig\"\n                - \"\u002Fusr\u002Fbin\u002Fminerd\"\n          matchActions:\n            - action: Sigkill\n```\n\n### Observing Events with Tetra CLI\n\nStream runtime events in real-time:\n\n```bash\n# Watch all process execution events\nkubectl exec -n kube-system ds\u002Ftetragon -c tetragon -- \\\n  tetra getevents -o compact --process-only\n\n# Filter events for a specific namespace\nkubectl exec -n kube-system ds\u002Ftetragon -c tetragon -- \\\n  tetra getevents -o compact --namespace production\n\n# Export events in JSON for SIEM integration\nkubectl exec -n kube-system ds\u002Ftetragon -c tetragon -- \\\n  tetra getevents -o json | tee \u002Fvar\u002Flog\u002Ftetragon-events.json\n```\n\n## Integration with SIEM and Alerting\n\n### Export to Elasticsearch\n\n```yaml\n# tetragon-helm-values.yaml\nexport:\n  stdout:\n    enabledCommand: true\n    enabledArgs: true\n  filenames:\n    - \u002Fvar\u002Flog\u002Ftetragon\u002Ftetragon.log\n  elasticsearch:\n    enabled: true\n    url: \"https:\u002F\u002Felasticsearch.monitoring:9200\"\n    index: \"tetragon-events\"\n```\n\n### Prometheus Metrics\n\nTetragon exposes metrics at `:2112\u002Fmetrics`:\n\n```yaml\napiVersion: monitoring.coreos.com\u002Fv1\nkind: ServiceMonitor\nmetadata:\n  name: tetragon-metrics\n  namespace: kube-system\nspec:\n  selector:\n    matchLabels:\n      app.kubernetes.io\u002Fname: tetragon\n  endpoints:\n    - port: metrics\n      interval: 15s\n```\n\n## Key Metrics and Alerts\n\n| Metric | Description | Alert Threshold |\n|--------|-------------|-----------------|\n| `tetragon_events_total` | Total security events observed | Spike > 3x baseline |\n| `tetragon_policy_events_total` | Events matching TracingPolicies | Any Sigkill action |\n| `tetragon_process_exec_total` | Process executions tracked | Anomalous new binaries |\n| `tetragon_missed_events_total` | Dropped events due to buffer overflow | > 0 sustained |\n\n## References\n\n- [Tetragon Official Documentation](https:\u002F\u002Ftetragon.io\u002Fdocs\u002F)\n- [Cilium Tetragon GitHub Repository](https:\u002F\u002Fgithub.com\u002Fcilium\u002Ftetragon)\n- [CNCF Tetragon Project Page](https:\u002F\u002Fwww.cncf.io\u002Fprojects\u002Ftetragon\u002F)\n- [eBPF Security Observability with Tetragon - CoreWeave](https:\u002F\u002Fdocs.coreweave.com\u002Fsecurity\u002Ftutorials\u002Febpf-observability)\n- [Kubernetes Security: eBPF & Tetragon for Runtime Monitoring](https:\u002F\u002Fmedium.com\u002F@noah_h\u002Fkubernetes-security-ebpf-tetragon-for-runtime-monitoring-policy-enforcement-819b6ed97953)\n","# Implementing Runtime Security with Tetragon\n\n## Overview\n\nTetragon is a CNCF project under Cilium that provides flexible Kubernetes-aware security observability and runtime enforcement using eBPF. By operating at the Linux kernel level, Tetragon can monitor and enforce policies on process execution, file access, network connections, and system calls with less than 1% performance overhead -- far more efficient than traditional user-space security agents.\n\n\n## When to Use\n\n- When deploying or configuring implementing runtime security with tetragon capabilities in your environment\n- When establishing security controls aligned to compliance requirements\n- When building or improving security architecture for this domain\n- When conducting security assessments that require this implementation\n\n## Prerequisites\n\n- Kubernetes cluster v1.24+ with Helm 3.x installed\n- Linux kernel 5.4+ (5.10+ recommended for full eBPF feature support)\n- kubectl access with cluster-admin privileges\n- Familiarity with eBPF concepts and Kubernetes security primitives\n\n## Core Concepts\n\n### eBPF-Based Security\n\nTetragon attaches eBPF programs directly to kernel functions, enabling:\n\n- **Process lifecycle tracking**: Monitor every process creation, execution, and termination across all pods\n- **File integrity monitoring**: Detect unauthorized reads\u002Fwrites to sensitive files\n- **Network observability**: Track all TCP\u002FUDP connections with full pod context\n- **System call filtering**: Enforce policies on dangerous syscalls like ptrace, mount, or unshare\n\n### TracingPolicy Custom Resources\n\nTetragon uses `TracingPolicy` CRDs to define what kernel events to observe and what actions to take:\n\n```yaml\napiVersion: cilium.io\u002Fv1alpha1\nkind: TracingPolicy\nmetadata:\n  name: detect-privilege-escalation\nspec:\n  kprobes:\n    - call: \"security_bprm_check\"\n      syscall: false\n      args:\n        - index: 0\n          type: \"linux_binprm\"\n      selectors:\n        - matchBinaries:\n            - operator: \"In\"\n              values:\n                - \"\u002Fbin\u002Fsu\"\n                - \"\u002Fusr\u002Fbin\u002Fsudo\"\n                - \"\u002Fusr\u002Fbin\u002Fpasswd\"\n          matchNamespaces:\n            - namespace: Pid\n              operator: NotIn\n              values:\n                - \"host_ns\"\n          matchActions:\n            - action: Post\n```\n\n### Enforcement Actions\n\nTetragon can take three types of actions directly in the kernel:\n\n1. **Sigkill**: Immediately terminate the offending process\n2. **Signal**: Send a configurable signal to the process\n3. **Override**: Override the return value of a kernel function to deny an operation\n\n## Installation and Configuration\n\n### Step 1: Install Tetragon with Helm\n\n```bash\nhelm repo add cilium https:\u002F\u002Fhelm.cilium.io\nhelm repo update\n\nhelm install tetragon cilium\u002Ftetragon \\\n  --namespace kube-system \\\n  --set tetragon.enableProcessCred=true \\\n  --set tetragon.enableProcessNs=true \\\n  --set tetragon.grpc.address=\"localhost:54321\"\n```\n\n### Step 2: Install the Tetragon CLI\n\n```bash\nGOOS=$(go env GOOS)\nGOARCH=$(go env GOARCH)\ncurl -L --remote-name-all \\\n  https:\u002F\u002Fgithub.com\u002Fcilium\u002Ftetragon\u002Freleases\u002Flatest\u002Fdownload\u002Ftetra-${GOOS}-${GOARCH}.tar.gz\ntar -xzvf tetra-${GOOS}-${GOARCH}.tar.gz\nsudo install tetra \u002Fusr\u002Flocal\u002Fbin\u002F\n```\n\n### Step 3: Verify Installation\n\n```bash\nkubectl get pods -n kube-system -l app.kubernetes.io\u002Fname=tetragon\ntetra status\n```\n\n## Practical Implementation\n\n### Detecting Container Escape Attempts\n\nCreate a TracingPolicy to detect processes attempting to escape container namespaces:\n\n```yaml\napiVersion: cilium.io\u002Fv1alpha1\nkind: TracingPolicy\nmetadata:\n  name: detect-container-escape\nspec:\n  kprobes:\n    - call: \"__x64_sys_setns\"\n      syscall: true\n      args:\n        - index: 0\n          type: \"int\"\n        - index: 1\n          type: \"int\"\n      selectors:\n        - matchNamespaces:\n            - namespace: Pid\n              operator: NotIn\n              values:\n                - \"host_ns\"\n          matchActions:\n            - action: Sigkill\n```\n\n### Monitoring Sensitive File Access\n\nDetect reads of sensitive credentials:\n\n```yaml\napiVersion: cilium.io\u002Fv1alpha1\nkind: TracingPolicy\nmetadata:\n  name: monitor-sensitive-files\nspec:\n  kprobes:\n    - call: \"security_file_open\"\n      syscall: false\n      args:\n        - index: 0\n          type: \"file\"\n      selectors:\n        - matchArgs:\n            - index: 0\n              operator: \"Prefix\"\n              values:\n                - \"\u002Fetc\u002Fshadow\"\n                - \"\u002Fetc\u002Fkubernetes\u002Fpki\"\n                - \"\u002Fvar\u002Frun\u002Fsecrets\u002Fkubernetes.io\"\n          matchActions:\n            - action: Post\n```\n\n### Blocking Crypto-Miner Execution\n\nPrevent known crypto-mining binaries from executing:\n\n```yaml\napiVersion: cilium.io\u002Fv1alpha1\nkind: TracingPolicy\nmetadata:\n  name: block-cryptominers\nspec:\n  kprobes:\n    - call: \"security_bprm_check\"\n      syscall: false\n      args:\n        - index: 0\n          type: \"linux_binprm\"\n      selectors:\n        - matchBinaries:\n            - operator: \"In\"\n              values:\n                - \"\u002Fusr\u002Fbin\u002Fxmrig\"\n                - \"\u002Ftmp\u002Fxmrig\"\n                - \"\u002Fusr\u002Fbin\u002Fminerd\"\n          matchActions:\n            - action: Sigkill\n```\n\n### Observing Events with Tetra CLI\n\nStream runtime events in real-time:\n\n```bash\n# Watch all process execution events\nkubectl exec -n kube-system ds\u002Ftetragon -c tetragon -- \\\n  tetra getevents -o compact --process-only\n\n# Filter events for a specific namespace\nkubectl exec -n kube-system ds\u002Ftetragon -c tetragon -- \\\n  tetra getevents -o compact --namespace production\n\n# Export events in JSON for SIEM integration\nkubectl exec -n kube-system ds\u002Ftetragon -c tetragon -- \\\n  tetra getevents -o json | tee \u002Fvar\u002Flog\u002Ftetragon-events.json\n```\n\n## Integration with SIEM and Alerting\n\n### Export to Elasticsearch\n\n```yaml\n# tetragon-helm-values.yaml\nexport:\n  stdout:\n    enabledCommand: true\n    enabledArgs: true\n  filenames:\n    - \u002Fvar\u002Flog\u002Ftetragon\u002Ftetragon.log\n  elasticsearch:\n    enabled: true\n    url: \"https:\u002F\u002Felasticsearch.monitoring:9200\"\n    index: \"tetragon-events\"\n```\n\n### Prometheus Metrics\n\nTetragon exposes metrics at `:2112\u002Fmetrics`:\n\n```yaml\napiVersion: monitoring.coreos.com\u002Fv1\nkind: ServiceMonitor\nmetadata:\n  name: tetragon-metrics\n  namespace: kube-system\nspec:\n  selector:\n    matchLabels:\n      app.kubernetes.io\u002Fname: tetragon\n  endpoints:\n    - port: metrics\n      interval: 15s\n```\n\n## Key Metrics and Alerts\n\n| Metric | Description | Alert Threshold |\n|--------|-------------|-----------------|\n| `tetragon_events_total` | Total security events observed | Spike > 3x baseline |\n| `tetragon_policy_events_total` | Events matching TracingPolicies | Any Sigkill action |\n| `tetragon_process_exec_total` | Process executions tracked | Anomalous new binaries |\n| `tetragon_missed_events_total` | Dropped events due to buffer overflow | > 0 sustained |\n\n## References\n\n- [Tetragon Official Documentation](https:\u002F\u002Ftetragon.io\u002Fdocs\u002F)\n- [Cilium Tetragon GitHub Repository](https:\u002F\u002Fgithub.com\u002Fcilium\u002Ftetragon)\n- [CNCF Tetragon Project Page](https:\u002F\u002Fwww.cncf.io\u002Fprojects\u002Ftetragon\u002F)\n- [eBPF Security Observability with Tetragon - CoreWeave](https:\u002F\u002Fdocs.coreweave.com\u002Fsecurity\u002Ftutorials\u002Febpf-observability)\n- [Kubernetes Security: eBPF & Tetragon for Runtime Monitoring](https:\u002F\u002Fmedium.com\u002F@noah_h\u002Fkubernetes-security-ebpf-tetragon-for-runtime-monitoring-policy-enforcement-819b6ed97953)\n",{"name":5,"tags":49,"capec":55,"model":30,"tools":56,"domain":40,"maxTurns":60,"nist_csf":61,"subdomain":35,"description":7,"nist_ai_rmf":66,"mitre_attack":70,"atlas_techniques":73},[50,29,43,51,52,35,28,53,54],"tetragon","kubernetes","cilium","kernel-security","cncf",[],[57,38,58,59],"Read","Glob","Grep",20,[62,63,64,65],"PR.PS-01","PR.IR-01","ID.AM-08","DE.CM-01",[67,68,69],"MEASURE-2.7","MAP-5.1","MANAGE-2.4",[71,72],"T1547","T1610",[74,75,76],"AML.T0070","AML.T0066","AML.T0082","main","a91f1293287ffa9f4f1b8f486cd6e835a1568c84","skills\u002Fcloud\u002Fcontainers\u002Fruntime\u002Fdetect","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace","https:\u002F\u002Fgithub.com\u002FDCx7C5","#Python","2026-09-01 11:21:00",{"source":8,"skillName":5,"commands":85,"prompt":95,"zipAvailable":96},[86,89,92],{"tool":87,"command":88},"npx","npx skills add DCx7C5\u002Fai-marketplace --skill containers-runtime-detect",{"tool":90,"command":91},"bunx","bunx skills add DCx7C5\u002Fai-marketplace --skill containers-runtime-detect",{"tool":93,"command":94},"pnpm","pnpm dlx skills add DCx7C5\u002Fai-marketplace --skill containers-runtime-detect","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fcloud\u002Fcontainers\u002Fruntime\u002Fdetect\u002FSKILL.md",true,[98],{"path":99,"resourceType":100,"resourceTypeDesc":101,"sizeBytes":102,"sourceHtmlUrl":103},"index.json","REFERENCE","参考文档",656,"https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fcloud\u002Fcontainers\u002Fruntime\u002Fdetect\u002Findex.json",[105,127,148,169,191,207],{"skillNo":106,"name":107,"nameZh":6,"description":108,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":109,"categories":110,"keywords":111,"publishedAt":44},"01M71HAPZ01KQ30RKTB0FFSQ05","services-wmi-persistence-detect","Detect WMI event subscription persistence by enumerating ActiveScriptEventConsumer, CommandLineEventConsumer, and permanent subscriptions in the WMI repository.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fservices\u002Fwmi\u002Fpersistence\u002Fdetect\u002FSKILL.md",[],[112,26,113,114,115,36,42,116,117,118,119,120,121,122,123,124,125,40,126],"services","services wmi persistence detect","wmi","persistence","process","activescript","event","subscriptions","commandline-consumer","repository","subscription","event-subscription","t1546.003","forensics","process-forensics",{"skillNo":128,"name":129,"nameZh":6,"description":130,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":131,"categories":132,"keywords":133,"publishedAt":44},"01M71HAK6JTTTS229T17WJMMCG","services-wmi-exec-exploit","Perform lateral movement across Windows networks using WMI-based remote execution techniques including Impacket wmiexec.py, CrackMapExec, and native WMI commands for stealthy post-exploitation during red team engagements.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fservices\u002Fwmi\u002Fexec\u002Fexploit\u002FSKILL.md",[],[134,112,135,114,136,137,138,40,38,139,140,141,142,143,36,144,145,34,146,147],"exploit","services wmi exec exploit","exec","remote","traffic","analysis","team","across","crackmapexec","native","command","lateral movement","lateral-movement","Impacket",{"skillNo":149,"name":150,"nameZh":6,"description":151,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":152,"categories":153,"keywords":154,"publishedAt":44},"01M71HAG6MHKNQV8KDZKMT4886","registry-artifact-extract","Extract and analyze Windows Registry hives to uncover user activity, installed software, autostart entries, and evidence of system compromise.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fregistry\u002Fartifact\u002Fextract\u002FSKILL.md",[],[155,156,157,158,159,160,40,38,161,139,162,163,36,34,164,165,166,167,168,30],"artifact","registry","registry artifact extract","extract","evidence-collection","artifact-analysis","collection","analyze","uncover","software","activity","digital-forensics","windows-registry","regripper",{"skillNo":170,"name":171,"nameZh":6,"description":172,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":173,"categories":174,"keywords":175,"publishedAt":44},"01M71HACR4A8XTWTTSXK4124AA","processes-token-impersonate-detect","Detect Windows token impersonation and privilege abuse including SeImpersonatePrivilege exploitation via Potato attacks and token stealing techniques.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fprocesses\u002Ftoken\u002Fimpersonate\u002Fdetect\u002FSKILL.md",[],[26,176,177,178,179,180,181,42,182,40,126,183,184,185,186,187,188,189,190,36],"processes token impersonate detect","token","processes","attacks","windows","escalation","techniques","privilege-escalation","seimpersonate","token-impersonation","printspoofer","exploitation","potato","impersonation","via",{"skillNo":192,"name":193,"nameZh":6,"description":194,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":195,"categories":196,"keywords":197,"publishedAt":44},"01M71HAABSB4Z6QFSXEG00R4RK","processes-thread-injection-detect","Detect Windows thread injection techniques including CreateRemoteThread, QueueUserAPC, NtCreateThreadEx, and thread hijacking via process memory analysis.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fprocesses\u002Fthread\u002Finjection\u002Fdetect\u002FSKILL.md",[],[198,199,26,200,178,180,201,42,202,182,40,126,139,203,204,205,206,190,36,116],"thread","processes thread injection detect","injection","memory","process-injection","api","apc-injection","thread-injection","nt-api",{"skillNo":208,"name":209,"nameZh":6,"description":210,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":211,"categories":212,"keywords":213,"publishedAt":44},"01M71HA7H311V5G14WMX58HQSS","processes-hollow-technique-detect","Detect process hollowing (RunPE) by identifying processes with mismatched image paths between PEB and VAD tree, or unmapped PE headers in memory.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fprocesses\u002Fhollow\u002Ftechnique\u002Fdetect\u002FSKILL.md",[],[214,26,178,215,201,42,216,217,40,126,218,219,220,221,222,223,36,116,224,225],"processes hollow technique detect","tree","memory-forensics","process-hollow","peb","runpe","image","pe-header","in memory","with","mismatched","headers"]