[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M71CJFMSF87HV1HDAQSWG2QA":3,"skill-same:01M71CJFMSF87HV1HDAQSWG2QA":97},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":23,"publishedAt":44,"linkOnly":45,"markdownContent":46,"markdownBody":47,"frontMatter":48,"refName":70,"commitSha":71,"skillDirectory":72,"forksCount":14,"repositoryHtmlUrl":73,"repositoryHomepageUrl":6,"ownerHtmlUrl":74,"ownerBlogUrl":6,"ownerDescription":75,"updatedAt":76,"install":77,"resources":90},"01M71CJFMSF87HV1HDAQSWG2QA","gcp-general-overview-analyze",null,"Implement GCP Binary Authorization to enforce deploy-time security controls that ensure only trusted, attested container images are deployed to Google Kubernetes Engine and Cloud Run.","DCx7C5\u002Fai-marketplace","DCx7C5","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F42419559?v=4","01M71C01G2AZV3NTNGWAWSHJPP","DC","01M71C01GQW6G50S2BYMS7PP3E",0,"MIT","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fcloud\u002Fgcp\u002Fgeneral\u002Foverview\u002Fanalyze\u002FSKILL.md",[18],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000011","运维与部署","SCENARIO","使用场景",[24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43],"analyze","gcp general overview analyze","general","overview","gcp","gke","t1078","t1195","attestation","Bash","cybersecurity","container-security","only","cm","images","cloud-security","time","chain","de","run","2026-11-10 10:12:30",false,"---\nname: gcp-general-overview-analyze\ndescription: Implement GCP Binary Authorization to enforce deploy-time security controls that ensure only trusted, attested container images are deployed to Google Kubernetes Engine and Cloud Run.\ndomain: cybersecurity\nsubdomain: cloud-security\ntags:\n- gcp\n- binary-authorization\n- container-security\n- supply-chain\n- gke\n- cloud-run\n- attestation\n- software-integrity\nnist_csf:\n- PR.IR-01\n- ID.AM-08\n- GV.SC-06\n- DE.CM-01\nmodel: sonnet\nmaxTurns: 20\ntools: [Read, Bash, Glob, Grep]\nmitre_attack:\n- T1078.004\n- T1195\n- T1610\ncapec: []\n---\n\n# Implementing GCP Binary Authorization\n\n## Overview\n\nBinary Authorization is a Google Cloud deploy-time security control that ensures only trusted container images are deployed on GKE or Cloud Run. It works through a policy-based model where images must have cryptographic attestations confirming they passed predefined requirements such as vulnerability scans, code reviews, or build pipeline verification. Continuous validation (CV) monitors running pods against policies and logs violations.\n\n\n## When to Use\n\n- When deploying or configuring implementing gcp binary authorization capabilities in your environment\n- When establishing security controls aligned to compliance requirements\n- When building or improving security architecture for this domain\n- When conducting security assessments that require this implementation\n\n## Prerequisites\n\n- GCP project with Binary Authorization API enabled\n- GKE cluster or Cloud Run service\n- Container Analysis API enabled\n- KMS keys for attestation signing\n- Cloud Build or external CI\u002FCD pipeline\n\n## Enable Binary Authorization\n\n```bash\n# Enable required APIs\ngcloud services enable binaryauthorization.googleapis.com\ngcloud services enable containeranalysis.googleapis.com\ngcloud services enable container.googleapis.com\n\n# Enable Binary Authorization on GKE cluster\ngcloud container clusters update CLUSTER_NAME \\\n  --enable-binauthz \\\n  --zone us-central1-a\n```\n\n## Create Attestor\n\n### Create a KMS key for signing\n\n```bash\n# Create keyring\ngcloud kms keyrings create binauthz-keyring \\\n  --location global\n\n# Create signing key\ngcloud kms keys create attestor-key \\\n  --keyring binauthz-keyring \\\n  --location global \\\n  --algorithm ec-sign-p256-sha256 \\\n  --purpose asymmetric-signing\n```\n\n### Create Container Analysis note\n\n```bash\ncat > \u002Ftmp\u002Fnote.json \u003C\u003C 'EOF'\n{\n  \"attestation\": {\n    \"hint\": {\n      \"humanReadableName\": \"Production Build Attestor\"\n    }\n  }\n}\nEOF\n\ncurl -X POST \\\n  -H \"Content-Type: application\u002Fjson\" \\\n  -H \"Authorization: Bearer $(gcloud auth print-access-token)\" \\\n  \"https:\u002F\u002Fcontaineranalysis.googleapis.com\u002Fv1\u002Fprojects\u002FPROJECT_ID\u002Fnotes\u002F?noteId=prod-build-note\" \\\n  -d @\u002Ftmp\u002Fnote.json\n```\n\n### Create the attestor\n\n```bash\ngcloud container binauthz attestors create prod-build-attestor \\\n  --attestation-authority-note=prod-build-note \\\n  --attestation-authority-note-project=PROJECT_ID\n\n# Add KMS key to attestor\ngcloud container binauthz attestors public-keys add \\\n  --attestor=prod-build-attestor \\\n  --keyversion-project=PROJECT_ID \\\n  --keyversion-location=global \\\n  --keyversion-keyring=binauthz-keyring \\\n  --keyversion-key=attestor-key \\\n  --keyversion=1\n```\n\n## Configure Policy\n\n### Default deny-all policy\n\n```yaml\n# binauthz-policy.yaml\nadmissionWhitelistPatterns:\n  - namePattern: \"gcr.io\u002Fgoogle_containers\u002F*\"\n  - namePattern: \"gcr.io\u002Fgoogle-containers\u002F*\"\n  - namePattern: \"k8s.gcr.io\u002F**\"\n  - namePattern: \"gke.gcr.io\u002F**\"\n  - namePattern: \"gcr.io\u002Fstackdriver-agents\u002F*\"\ndefaultAdmissionRule:\n  evaluationMode: REQUIRE_ATTESTATION\n  enforcementMode: ENFORCED_BLOCK_AND_AUDIT_LOG\n  requireAttestationsBy:\n    - projects\u002FPROJECT_ID\u002Fattestors\u002Fprod-build-attestor\nglobalPolicyEvaluationMode: ENABLE\n```\n\n```bash\ngcloud container binauthz policy import binauthz-policy.yaml\n```\n\n### Per-cluster rules\n\n```yaml\nadmissionWhitelistPatterns:\n  - namePattern: \"gcr.io\u002Fgoogle_containers\u002F*\"\nclusterAdmissionRules:\n  us-central1-a.production-cluster:\n    evaluationMode: REQUIRE_ATTESTATION\n    enforcementMode: ENFORCED_BLOCK_AND_AUDIT_LOG\n    requireAttestationsBy:\n      - projects\u002FPROJECT_ID\u002Fattestors\u002Fprod-build-attestor\n  us-central1-a.staging-cluster:\n    evaluationMode: ALWAYS_ALLOW\n    enforcementMode: DRYRUN_AUDIT_LOG_ONLY\ndefaultAdmissionRule:\n  evaluationMode: ALWAYS_DENY\n  enforcementMode: ENFORCED_BLOCK_AND_AUDIT_LOG\n```\n\n## Create Attestations\n\n### Attest an image after successful build\n\n```bash\n# Get image digest\nIMAGE_DIGEST=$(gcloud container images describe \\\n  gcr.io\u002FPROJECT_ID\u002Fmy-app:latest \\\n  --format='get(image_summary.digest)')\n\n# Create attestation\ngcloud container binauthz attestations sign-and-create \\\n  --artifact-url=\"gcr.io\u002FPROJECT_ID\u002Fmy-app@${IMAGE_DIGEST}\" \\\n  --attestor=\"prod-build-attestor\" \\\n  --attestor-project=\"PROJECT_ID\" \\\n  --keyversion-project=\"PROJECT_ID\" \\\n  --keyversion-location=\"global\" \\\n  --keyversion-keyring=\"binauthz-keyring\" \\\n  --keyversion-key=\"attestor-key\" \\\n  --keyversion=\"1\"\n```\n\n### Cloud Build integration\n\n```yaml\n# cloudbuild.yaml\nsteps:\n  - name: 'gcr.io\u002Fcloud-builders\u002Fdocker'\n    args: ['build', '-t', 'gcr.io\u002F$PROJECT_ID\u002Fmy-app:$SHORT_SHA', '.']\n\n  - name: 'gcr.io\u002Fcloud-builders\u002Fdocker'\n    args: ['push', 'gcr.io\u002F$PROJECT_ID\u002Fmy-app:$SHORT_SHA']\n\n  # Vulnerability scanning\n  - name: 'gcr.io\u002Fcloud-builders\u002Fgcloud'\n    entrypoint: 'bash'\n    args:\n      - '-c'\n      - |\n        gcloud artifacts docker images scan \\\n          gcr.io\u002F$PROJECT_ID\u002Fmy-app:$SHORT_SHA \\\n          --format='value(response.scan)'\n\n  # Create attestation after successful scan\n  - name: 'gcr.io\u002Fcloud-builders\u002Fgcloud'\n    entrypoint: 'bash'\n    args:\n      - '-c'\n      - |\n        IMAGE_DIGEST=$(gcloud container images describe \\\n          gcr.io\u002F$PROJECT_ID\u002Fmy-app:$SHORT_SHA \\\n          --format='get(image_summary.digest)')\n        gcloud container binauthz attestations sign-and-create \\\n          --artifact-url=\"gcr.io\u002F$PROJECT_ID\u002Fmy-app@$${IMAGE_DIGEST}\" \\\n          --attestor=\"prod-build-attestor\" \\\n          --attestor-project=\"$PROJECT_ID\" \\\n          --keyversion-project=\"$PROJECT_ID\" \\\n          --keyversion-location=\"global\" \\\n          --keyversion-keyring=\"binauthz-keyring\" \\\n          --keyversion-key=\"attestor-key\" \\\n          --keyversion=\"1\"\n```\n\n## Continuous Validation\n\n```bash\n# Enable CV on a GKE cluster\ngcloud container clusters update CLUSTER_NAME \\\n  --enable-binauthz-monitoring \\\n  --zone us-central1-a\n```\n\n### Monitor CV violations in Cloud Logging\n\n```\nresource.type=\"k8s_cluster\"\nlogName=\"projects\u002FPROJECT_ID\u002Flogs\u002Fbinaryauthorization.googleapis.com%2Fcontinuous_validation\"\n```\n\n## Verification and Testing\n\n### Test deployment of unattested image\n\n```bash\n# This should be blocked\nkubectl run test-unapproved \\\n  --image=docker.io\u002Flibrary\u002Fnginx:latest\n\n# Verify the pod was denied\nkubectl get events --field-selector reason=FailedCreate\n```\n\n### Verify attestation exists\n\n```bash\ngcloud container binauthz attestations list \\\n  --attestor=prod-build-attestor \\\n  --attestor-project=PROJECT_ID\n```\n\n## Break-Glass Override\n\nFor emergency deployments bypassing Binary Authorization:\n\n```yaml\napiVersion: v1\nkind: Pod\nmetadata:\n  name: emergency-pod\n  labels:\n    image-policy.k8s.io\u002Fbreak-glass: \"true\"\n  annotations:\n    alpha.image-policy.k8s.io\u002Fbreak-glass: \"Emergency deployment - ticket INC-12345\"\nspec:\n  containers:\n    - name: emergency\n      image: gcr.io\u002FPROJECT_ID\u002Femergency-fix:latest\n```\n\n## References\n\n- GCP Binary Authorization: https:\u002F\u002Fcloud.google.com\u002Fbinary-authorization\u002Fdocs\n- SLSA Framework: https:\u002F\u002Fslsa.dev\n- Sigstore\u002FCosign for container signing\n- Google Software Supply Chain Security Best Practices\n","# Implementing GCP Binary Authorization\n\n## Overview\n\nBinary Authorization is a Google Cloud deploy-time security control that ensures only trusted container images are deployed on GKE or Cloud Run. It works through a policy-based model where images must have cryptographic attestations confirming they passed predefined requirements such as vulnerability scans, code reviews, or build pipeline verification. Continuous validation (CV) monitors running pods against policies and logs violations.\n\n\n## When to Use\n\n- When deploying or configuring implementing gcp binary authorization capabilities in your environment\n- When establishing security controls aligned to compliance requirements\n- When building or improving security architecture for this domain\n- When conducting security assessments that require this implementation\n\n## Prerequisites\n\n- GCP project with Binary Authorization API enabled\n- GKE cluster or Cloud Run service\n- Container Analysis API enabled\n- KMS keys for attestation signing\n- Cloud Build or external CI\u002FCD pipeline\n\n## Enable Binary Authorization\n\n```bash\n# Enable required APIs\ngcloud services enable binaryauthorization.googleapis.com\ngcloud services enable containeranalysis.googleapis.com\ngcloud services enable container.googleapis.com\n\n# Enable Binary Authorization on GKE cluster\ngcloud container clusters update CLUSTER_NAME \\\n  --enable-binauthz \\\n  --zone us-central1-a\n```\n\n## Create Attestor\n\n### Create a KMS key for signing\n\n```bash\n# Create keyring\ngcloud kms keyrings create binauthz-keyring \\\n  --location global\n\n# Create signing key\ngcloud kms keys create attestor-key \\\n  --keyring binauthz-keyring \\\n  --location global \\\n  --algorithm ec-sign-p256-sha256 \\\n  --purpose asymmetric-signing\n```\n\n### Create Container Analysis note\n\n```bash\ncat > \u002Ftmp\u002Fnote.json \u003C\u003C 'EOF'\n{\n  \"attestation\": {\n    \"hint\": {\n      \"humanReadableName\": \"Production Build Attestor\"\n    }\n  }\n}\nEOF\n\ncurl -X POST \\\n  -H \"Content-Type: application\u002Fjson\" \\\n  -H \"Authorization: Bearer $(gcloud auth print-access-token)\" \\\n  \"https:\u002F\u002Fcontaineranalysis.googleapis.com\u002Fv1\u002Fprojects\u002FPROJECT_ID\u002Fnotes\u002F?noteId=prod-build-note\" \\\n  -d @\u002Ftmp\u002Fnote.json\n```\n\n### Create the attestor\n\n```bash\ngcloud container binauthz attestors create prod-build-attestor \\\n  --attestation-authority-note=prod-build-note \\\n  --attestation-authority-note-project=PROJECT_ID\n\n# Add KMS key to attestor\ngcloud container binauthz attestors public-keys add \\\n  --attestor=prod-build-attestor \\\n  --keyversion-project=PROJECT_ID \\\n  --keyversion-location=global \\\n  --keyversion-keyring=binauthz-keyring \\\n  --keyversion-key=attestor-key \\\n  --keyversion=1\n```\n\n## Configure Policy\n\n### Default deny-all policy\n\n```yaml\n# binauthz-policy.yaml\nadmissionWhitelistPatterns:\n  - namePattern: \"gcr.io\u002Fgoogle_containers\u002F*\"\n  - namePattern: \"gcr.io\u002Fgoogle-containers\u002F*\"\n  - namePattern: \"k8s.gcr.io\u002F**\"\n  - namePattern: \"gke.gcr.io\u002F**\"\n  - namePattern: \"gcr.io\u002Fstackdriver-agents\u002F*\"\ndefaultAdmissionRule:\n  evaluationMode: REQUIRE_ATTESTATION\n  enforcementMode: ENFORCED_BLOCK_AND_AUDIT_LOG\n  requireAttestationsBy:\n    - projects\u002FPROJECT_ID\u002Fattestors\u002Fprod-build-attestor\nglobalPolicyEvaluationMode: ENABLE\n```\n\n```bash\ngcloud container binauthz policy import binauthz-policy.yaml\n```\n\n### Per-cluster rules\n\n```yaml\nadmissionWhitelistPatterns:\n  - namePattern: \"gcr.io\u002Fgoogle_containers\u002F*\"\nclusterAdmissionRules:\n  us-central1-a.production-cluster:\n    evaluationMode: REQUIRE_ATTESTATION\n    enforcementMode: ENFORCED_BLOCK_AND_AUDIT_LOG\n    requireAttestationsBy:\n      - projects\u002FPROJECT_ID\u002Fattestors\u002Fprod-build-attestor\n  us-central1-a.staging-cluster:\n    evaluationMode: ALWAYS_ALLOW\n    enforcementMode: DRYRUN_AUDIT_LOG_ONLY\ndefaultAdmissionRule:\n  evaluationMode: ALWAYS_DENY\n  enforcementMode: ENFORCED_BLOCK_AND_AUDIT_LOG\n```\n\n## Create Attestations\n\n### Attest an image after successful build\n\n```bash\n# Get image digest\nIMAGE_DIGEST=$(gcloud container images describe \\\n  gcr.io\u002FPROJECT_ID\u002Fmy-app:latest \\\n  --format='get(image_summary.digest)')\n\n# Create attestation\ngcloud container binauthz attestations sign-and-create \\\n  --artifact-url=\"gcr.io\u002FPROJECT_ID\u002Fmy-app@${IMAGE_DIGEST}\" \\\n  --attestor=\"prod-build-attestor\" \\\n  --attestor-project=\"PROJECT_ID\" \\\n  --keyversion-project=\"PROJECT_ID\" \\\n  --keyversion-location=\"global\" \\\n  --keyversion-keyring=\"binauthz-keyring\" \\\n  --keyversion-key=\"attestor-key\" \\\n  --keyversion=\"1\"\n```\n\n### Cloud Build integration\n\n```yaml\n# cloudbuild.yaml\nsteps:\n  - name: 'gcr.io\u002Fcloud-builders\u002Fdocker'\n    args: ['build', '-t', 'gcr.io\u002F$PROJECT_ID\u002Fmy-app:$SHORT_SHA', '.']\n\n  - name: 'gcr.io\u002Fcloud-builders\u002Fdocker'\n    args: ['push', 'gcr.io\u002F$PROJECT_ID\u002Fmy-app:$SHORT_SHA']\n\n  # Vulnerability scanning\n  - name: 'gcr.io\u002Fcloud-builders\u002Fgcloud'\n    entrypoint: 'bash'\n    args:\n      - '-c'\n      - |\n        gcloud artifacts docker images scan \\\n          gcr.io\u002F$PROJECT_ID\u002Fmy-app:$SHORT_SHA \\\n          --format='value(response.scan)'\n\n  # Create attestation after successful scan\n  - name: 'gcr.io\u002Fcloud-builders\u002Fgcloud'\n    entrypoint: 'bash'\n    args:\n      - '-c'\n      - |\n        IMAGE_DIGEST=$(gcloud container images describe \\\n          gcr.io\u002F$PROJECT_ID\u002Fmy-app:$SHORT_SHA \\\n          --format='get(image_summary.digest)')\n        gcloud container binauthz attestations sign-and-create \\\n          --artifact-url=\"gcr.io\u002F$PROJECT_ID\u002Fmy-app@$${IMAGE_DIGEST}\" \\\n          --attestor=\"prod-build-attestor\" \\\n          --attestor-project=\"$PROJECT_ID\" \\\n          --keyversion-project=\"$PROJECT_ID\" \\\n          --keyversion-location=\"global\" \\\n          --keyversion-keyring=\"binauthz-keyring\" \\\n          --keyversion-key=\"attestor-key\" \\\n          --keyversion=\"1\"\n```\n\n## Continuous Validation\n\n```bash\n# Enable CV on a GKE cluster\ngcloud container clusters update CLUSTER_NAME \\\n  --enable-binauthz-monitoring \\\n  --zone us-central1-a\n```\n\n### Monitor CV violations in Cloud Logging\n\n```\nresource.type=\"k8s_cluster\"\nlogName=\"projects\u002FPROJECT_ID\u002Flogs\u002Fbinaryauthorization.googleapis.com%2Fcontinuous_validation\"\n```\n\n## Verification and Testing\n\n### Test deployment of unattested image\n\n```bash\n# This should be blocked\nkubectl run test-unapproved \\\n  --image=docker.io\u002Flibrary\u002Fnginx:latest\n\n# Verify the pod was denied\nkubectl get events --field-selector reason=FailedCreate\n```\n\n### Verify attestation exists\n\n```bash\ngcloud container binauthz attestations list \\\n  --attestor=prod-build-attestor \\\n  --attestor-project=PROJECT_ID\n```\n\n## Break-Glass Override\n\nFor emergency deployments bypassing Binary Authorization:\n\n```yaml\napiVersion: v1\nkind: Pod\nmetadata:\n  name: emergency-pod\n  labels:\n    image-policy.k8s.io\u002Fbreak-glass: \"true\"\n  annotations:\n    alpha.image-policy.k8s.io\u002Fbreak-glass: \"Emergency deployment - ticket INC-12345\"\nspec:\n  containers:\n    - name: emergency\n      image: gcr.io\u002FPROJECT_ID\u002Femergency-fix:latest\n```\n\n## References\n\n- GCP Binary Authorization: https:\u002F\u002Fcloud.google.com\u002Fbinary-authorization\u002Fdocs\n- SLSA Framework: https:\u002F\u002Fslsa.dev\n- Sigstore\u002FCosign for container signing\n- Google Software Supply Chain Security Best Practices\n",{"name":5,"tags":49,"capec":54,"model":55,"tools":56,"domain":34,"maxTurns":60,"nist_csf":61,"subdomain":39,"description":7,"mitre_attack":66},[28,50,35,51,29,52,32,53],"binary-authorization","supply-chain","cloud-run","software-integrity",[],"sonnet",[57,33,58,59],"Read","Glob","Grep",20,[62,63,64,65],"PR.IR-01","ID.AM-08","GV.SC-06","DE.CM-01",[67,68,69],"T1078.004","T1195","T1610","main","a91f1293287ffa9f4f1b8f486cd6e835a1568c84","skills\u002Fcloud\u002Fgcp\u002Fgeneral\u002Foverview\u002Fanalyze","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace","https:\u002F\u002Fgithub.com\u002FDCx7C5","#Python","2026-09-01 11:21:00",{"source":8,"skillName":5,"commands":78,"prompt":88,"zipAvailable":89},[79,82,85],{"tool":80,"command":81},"npx","npx skills add DCx7C5\u002Fai-marketplace --skill gcp-general-overview-analyze",{"tool":83,"command":84},"bunx","bunx skills add DCx7C5\u002Fai-marketplace --skill gcp-general-overview-analyze",{"tool":86,"command":87},"pnpm","pnpm dlx skills add DCx7C5\u002Fai-marketplace --skill gcp-general-overview-analyze","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fcloud\u002Fgcp\u002Fgeneral\u002Foverview\u002Fanalyze\u002FSKILL.md",true,[91],{"path":92,"resourceType":93,"resourceTypeDesc":94,"sizeBytes":95,"sourceHtmlUrl":96},"index.json","REFERENCE","参考文档",678,"https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fcloud\u002Fgcp\u002Fgeneral\u002Foverview\u002Fanalyze\u002Findex.json",[98,121,143,163,185,201],{"skillNo":99,"name":100,"nameZh":6,"description":101,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":102,"categories":103,"keywords":104,"publishedAt":44},"01M71HAPZ01KQ30RKTB0FFSQ05","services-wmi-persistence-detect","Detect WMI event subscription persistence by enumerating ActiveScriptEventConsumer, CommandLineEventConsumer, and permanent subscriptions in the WMI repository.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fservices\u002Fwmi\u002Fpersistence\u002Fdetect\u002FSKILL.md",[],[105,106,107,108,109,42,37,110,111,112,113,114,115,116,117,118,119,34,120],"services","detect","services wmi persistence detect","wmi","persistence","process","activescript","event","subscriptions","commandline-consumer","repository","subscription","event-subscription","t1546.003","forensics","process-forensics",{"skillNo":122,"name":123,"nameZh":6,"description":124,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":125,"categories":126,"keywords":127,"publishedAt":44},"01M71HAK6JTTTS229T17WJMMCG","services-wmi-exec-exploit","Perform lateral movement across Windows networks using WMI-based remote execution techniques including Impacket wmiexec.py, CrackMapExec, and native WMI commands for stealthy post-exploitation during red team engagements.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fservices\u002Fwmi\u002Fexec\u002Fexploit\u002FSKILL.md",[],[128,105,129,108,130,131,132,34,33,133,134,135,136,137,42,138,139,140,141,142],"exploit","services wmi exec exploit","exec","remote","traffic","analysis","team","across","crackmapexec","native","command","lateral movement","read","lateral-movement","Impacket",{"skillNo":144,"name":145,"nameZh":6,"description":146,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":147,"categories":148,"keywords":149,"publishedAt":44},"01M71HAG6MHKNQV8KDZKMT4886","registry-artifact-extract","Extract and analyze Windows Registry hives to uncover user activity, installed software, autostart entries, and evidence of system compromise.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fregistry\u002Fartifact\u002Fextract\u002FSKILL.md",[],[150,151,152,153,154,155,34,33,156,133,24,157,42,140,158,159,160,161,162,55],"artifact","registry","registry artifact extract","extract","evidence-collection","artifact-analysis","collection","uncover","software","activity","digital-forensics","windows-registry","regripper",{"skillNo":164,"name":165,"nameZh":6,"description":166,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":167,"categories":168,"keywords":169,"publishedAt":44},"01M71HACR4A8XTWTTSXK4124AA","processes-token-impersonate-detect","Detect Windows token impersonation and privilege abuse including SeImpersonatePrivilege exploitation via Potato attacks and token stealing techniques.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fprocesses\u002Ftoken\u002Fimpersonate\u002Fdetect\u002FSKILL.md",[],[106,170,171,172,173,174,175,37,176,34,120,177,178,179,180,181,182,183,184,42],"processes token impersonate detect","token","processes","attacks","windows","escalation","techniques","privilege-escalation","seimpersonate","token-impersonation","printspoofer","exploitation","potato","impersonation","via",{"skillNo":186,"name":187,"nameZh":6,"description":188,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":189,"categories":190,"keywords":191,"publishedAt":44},"01M71HAABSB4Z6QFSXEG00R4RK","processes-thread-injection-detect","Detect Windows thread injection techniques including CreateRemoteThread, QueueUserAPC, NtCreateThreadEx, and thread hijacking via process memory analysis.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fprocesses\u002Fthread\u002Finjection\u002Fdetect\u002FSKILL.md",[],[192,193,106,194,172,174,195,37,196,176,34,120,133,197,198,199,200,184,42,110],"thread","processes thread injection detect","injection","memory","process-injection","api","apc-injection","thread-injection","nt-api",{"skillNo":202,"name":203,"nameZh":6,"description":204,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":205,"categories":206,"keywords":207,"publishedAt":44},"01M71HA7H311V5G14WMX58HQSS","processes-hollow-technique-detect","Detect process hollowing (RunPE) by identifying processes with mismatched image paths between PEB and VAD tree, or unmapped PE headers in memory.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fprocesses\u002Fhollow\u002Ftechnique\u002Fdetect\u002FSKILL.md",[],[208,106,172,209,195,37,210,211,34,120,212,213,214,215,216,217,42,110,218,219],"processes hollow technique detect","tree","memory-forensics","process-hollow","peb","runpe","image","pe-header","in memory","with","mismatched","headers"]