[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M71CKXNBWCC7Q2AT1D0FDCE6":3,"skill-same:01M71CKXNBWCC7Q2AT1D0FDCE6":92},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":23,"publishedAt":44,"linkOnly":45,"markdownContent":46,"markdownBody":47,"frontMatter":48,"refName":65,"commitSha":66,"skillDirectory":67,"forksCount":14,"repositoryHtmlUrl":68,"repositoryHomepageUrl":6,"ownerHtmlUrl":69,"ownerBlogUrl":6,"ownerDescription":70,"updatedAt":71,"install":72,"resources":85},"01M71CKXNBWCC7Q2AT1D0FDCE6","kubernetes-hardening-podsecurity-exploit",null,"Pod Security Standards (PSS) define three levels of security policies -- Privileged, Baseline, and Restricted -- enforced by the Pod Security Admission (PSA) controller built into Kubernetes 1.25+. PS","DCx7C5\u002Fai-marketplace","DCx7C5","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F42419559?v=4","01M71C01G2AZV3NTNGWAWSHJPP","DC","01M71C01GQW6G50S2BYMS7PP3E",0,"MIT","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fcloud\u002Fkubernetes\u002Fhardening\u002Fpodsecurity\u002Fexploit\u002FSKILL.md",[18],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000011","运维与部署","SCENARIO","使用场景",[24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43],"exploit","kubernetes","kubernetes hardening podsecurity exploit","hardening","kubernetes hardening","container","containers","three","pr","standards","sonnet","security","read","container-security","de","controller","Bash","cybersecurity","security standards","cm","2026-11-10 10:12:30",false,"---\nname: kubernetes-hardening-podsecurity-exploit\ndescription: Pod Security Standards (PSS) define three levels of security policies -- Privileged, Baseline, and Restricted -- enforced by the Pod Security Admission (PSA) controller built into Kubernetes 1.25+. PS\ndomain: cybersecurity\nsubdomain: container-security\ntags:\n- containers\n- kubernetes\n- security\n- pod-security\n- PSA\nnist_csf:\n- PR.PS-01\n- PR.IR-01\n- ID.AM-08\n- DE.CM-01\nmodel: sonnet\nmaxTurns: 20\ntools: [Read, Bash, Glob, Grep]\nmitre_attack:\n- T1610\ncapec: []\n---\n\n# Implementing Kubernetes Pod Security Standards\n\n## Overview\n\nPod Security Standards (PSS) define three levels of security policies -- Privileged, Baseline, and Restricted -- enforced by the Pod Security Admission (PSA) controller built into Kubernetes 1.25+. PSA replaces the deprecated PodSecurityPolicy and provides namespace-level enforcement with three modes: enforce, audit, and warn.\n\n\n## When to Use\n\n- When deploying or configuring implementing kubernetes pod security standards capabilities in your environment\n- When establishing security controls aligned to compliance requirements\n- When building or improving security architecture for this domain\n- When conducting security assessments that require this implementation\n\n## Prerequisites\n\n- Kubernetes cluster 1.25+ (PSA GA)\n- kubectl configured with cluster-admin access\n- Understanding of Linux capabilities and security contexts\n\n## Core Concepts\n\n### Three Security Profiles\n\n| Profile | Purpose | Restrictions |\n|---------|---------|-------------|\n| **Privileged** | Unrestricted, system workloads | None |\n| **Baseline** | Prevents known escalations | No hostNetwork, hostPID, hostIPC, privileged containers, dangerous capabilities |\n| **Restricted** | Hardened best practices | Non-root, drop ALL caps, seccomp required, read-only rootfs recommended |\n\n### Three Enforcement Modes\n\n| Mode | Behavior |\n|------|----------|\n| **enforce** | Rejects pods that violate the policy |\n| **audit** | Logs violations in audit log but allows pod |\n| **warn** | Returns warning to user but allows pod |\n\n## Workflow\n\n### Step 1: Label Namespaces for PSA\n\n```yaml\n# Restricted namespace - production workloads\napiVersion: v1\nkind: Namespace\nmetadata:\n  name: production\n  labels:\n    pod-security.kubernetes.io\u002Fenforce: restricted\n    pod-security.kubernetes.io\u002Fenforce-version: latest\n    pod-security.kubernetes.io\u002Faudit: restricted\n    pod-security.kubernetes.io\u002Faudit-version: latest\n    pod-security.kubernetes.io\u002Fwarn: restricted\n    pod-security.kubernetes.io\u002Fwarn-version: latest\n```\n\n```yaml\n# Baseline namespace - general workloads\napiVersion: v1\nkind: Namespace\nmetadata:\n  name: staging\n  labels:\n    pod-security.kubernetes.io\u002Fenforce: baseline\n    pod-security.kubernetes.io\u002Fenforce-version: latest\n    pod-security.kubernetes.io\u002Faudit: restricted\n    pod-security.kubernetes.io\u002Faudit-version: latest\n    pod-security.kubernetes.io\u002Fwarn: restricted\n    pod-security.kubernetes.io\u002Fwarn-version: latest\n```\n\n```yaml\n# Privileged namespace - system components only\napiVersion: v1\nkind: Namespace\nmetadata:\n  name: kube-system\n  labels:\n    pod-security.kubernetes.io\u002Fenforce: privileged\n    pod-security.kubernetes.io\u002Fenforce-version: latest\n```\n\n### Step 2: Apply Labels to Existing Namespaces\n\n```bash\n# Apply restricted enforcement to production\nkubectl label namespace production \\\n  pod-security.kubernetes.io\u002Fenforce=restricted \\\n  pod-security.kubernetes.io\u002Faudit=restricted \\\n  pod-security.kubernetes.io\u002Fwarn=restricted \\\n  --overwrite\n\n# Apply baseline to staging with restricted warnings\nkubectl label namespace staging \\\n  pod-security.kubernetes.io\u002Fenforce=baseline \\\n  pod-security.kubernetes.io\u002Faudit=restricted \\\n  pod-security.kubernetes.io\u002Fwarn=restricted \\\n  --overwrite\n\n# Check labels on all namespaces\nkubectl get namespaces -L pod-security.kubernetes.io\u002Fenforce\n```\n\n### Step 3: Create Compliant Pod Specs\n\n```yaml\n# Restricted-compliant deployment\napiVersion: apps\u002Fv1\nkind: Deployment\nmetadata:\n  name: secure-app\n  namespace: production\nspec:\n  replicas: 3\n  selector:\n    matchLabels:\n      app: secure-app\n  template:\n    metadata:\n      labels:\n        app: secure-app\n    spec:\n      automountServiceAccountToken: false\n      securityContext:\n        runAsNonRoot: true\n        runAsUser: 65534\n        runAsGroup: 65534\n        fsGroup: 65534\n        seccompProfile:\n          type: RuntimeDefault\n      containers:\n        - name: app\n          image: myregistry.com\u002Fmyapp:v1.0.0@sha256:abc123\n          ports:\n            - containerPort: 8080\n              protocol: TCP\n          securityContext:\n            allowPrivilegeEscalation: false\n            readOnlyRootFilesystem: true\n            capabilities:\n              drop:\n                - ALL\n            runAsNonRoot: true\n            runAsUser: 65534\n          resources:\n            requests:\n              memory: \"64Mi\"\n              cpu: \"100m\"\n            limits:\n              memory: \"256Mi\"\n              cpu: \"500m\"\n          volumeMounts:\n            - name: tmp\n              mountPath: \u002Ftmp\n            - name: cache\n              mountPath: \u002Fvar\u002Fcache\n      volumes:\n        - name: tmp\n          emptyDir:\n            sizeLimit: 100Mi\n        - name: cache\n          emptyDir:\n            sizeLimit: 50Mi\n```\n\n### Step 4: Gradual Migration Strategy\n\n```bash\n# Phase 1: Audit mode - discover violations without blocking\nkubectl label namespace my-namespace \\\n  pod-security.kubernetes.io\u002Faudit=restricted \\\n  pod-security.kubernetes.io\u002Fwarn=restricted\n\n# Check audit logs for violations\nkubectl logs -n kube-system -l component=kube-apiserver | grep \"pod-security\"\n\n# Phase 2: Enforce baseline, warn on restricted\nkubectl label namespace my-namespace \\\n  pod-security.kubernetes.io\u002Fenforce=baseline \\\n  pod-security.kubernetes.io\u002Fwarn=restricted \\\n  --overwrite\n\n# Phase 3: Full restricted enforcement\nkubectl label namespace my-namespace \\\n  pod-security.kubernetes.io\u002Fenforce=restricted \\\n  --overwrite\n```\n\n### Step 5: Dry-Run Enforcement Testing\n\n```bash\n# Test what would happen with restricted enforcement\nkubectl label --dry-run=server --overwrite namespace my-namespace \\\n  pod-security.kubernetes.io\u002Fenforce=restricted\n\n# Example output:\n# Warning: existing pods in namespace \"my-namespace\" violate the new\n# PodSecurity enforce level \"restricted:latest\"\n# Warning: nginx-xxx: allowPrivilegeEscalation != false,\n#   unrestricted capabilities, runAsNonRoot != true, seccompProfile\n```\n\n## Baseline Profile Restrictions\n\n| Control | Restricted | Requirement |\n|---------|-----------|-------------|\n| HostProcess | Must not set | Pods cannot use Windows HostProcess |\n| Host Namespaces | Must not set | No hostNetwork, hostPID, hostIPC |\n| Privileged | Must not set | No privileged: true |\n| Capabilities | Baseline list only | Only NET_BIND_SERVICE, drop ALL for restricted |\n| HostPath Volumes | Must not use | No hostPath volume mounts |\n| Host Ports | Must not use | No hostPort in container spec |\n| AppArmor | Default\u002Fruntime | Cannot set to unconfined |\n| SELinux | Limited types | Only container_t, container_init_t, container_kvm_t |\n| \u002Fproc Mount Type | Default only | Must use Default proc mount |\n| Seccomp | RuntimeDefault or Localhost | Must specify seccomp profile (restricted) |\n| Sysctls | Safe set only | Limited to safe sysctls |\n\n## Validation Commands\n\n```bash\n# Verify namespace labels\nkubectl get ns --show-labels | grep pod-security\n\n# Test pod creation against policy\nkubectl run test-pod --image=nginx --namespace=production --dry-run=server\n\n# Check for violations in audit logs\nkubectl get events --field-selector reason=FailedCreate -A\n\n# Scan with Kubescape for PSS compliance\nkubescape scan framework nsa --namespace production\n```\n\n## References\n\n- [Pod Security Standards - Kubernetes](https:\u002F\u002Fkubernetes.io\u002Fdocs\u002Fconcepts\u002Fsecurity\u002Fpod-security-standards\u002F)\n- [Pod Security Admission - Kubernetes](https:\u002F\u002Fkubernetes.io\u002Fdocs\u002Fconcepts\u002Fsecurity\u002Fpod-security-admission\u002F)\n- [Migrate from PodSecurityPolicy](https:\u002F\u002Fkubernetes.io\u002Fdocs\u002Ftasks\u002Fconfigure-pod-container\u002Fmigrate-from-psp\u002F)\n- [Kubescape PSS Scanner](https:\u002F\u002Fgithub.com\u002Fkubescape\u002Fkubescape)\n","# Implementing Kubernetes Pod Security Standards\n\n## Overview\n\nPod Security Standards (PSS) define three levels of security policies -- Privileged, Baseline, and Restricted -- enforced by the Pod Security Admission (PSA) controller built into Kubernetes 1.25+. PSA replaces the deprecated PodSecurityPolicy and provides namespace-level enforcement with three modes: enforce, audit, and warn.\n\n\n## When to Use\n\n- When deploying or configuring implementing kubernetes pod security standards capabilities in your environment\n- When establishing security controls aligned to compliance requirements\n- When building or improving security architecture for this domain\n- When conducting security assessments that require this implementation\n\n## Prerequisites\n\n- Kubernetes cluster 1.25+ (PSA GA)\n- kubectl configured with cluster-admin access\n- Understanding of Linux capabilities and security contexts\n\n## Core Concepts\n\n### Three Security Profiles\n\n| Profile | Purpose | Restrictions |\n|---------|---------|-------------|\n| **Privileged** | Unrestricted, system workloads | None |\n| **Baseline** | Prevents known escalations | No hostNetwork, hostPID, hostIPC, privileged containers, dangerous capabilities |\n| **Restricted** | Hardened best practices | Non-root, drop ALL caps, seccomp required, read-only rootfs recommended |\n\n### Three Enforcement Modes\n\n| Mode | Behavior |\n|------|----------|\n| **enforce** | Rejects pods that violate the policy |\n| **audit** | Logs violations in audit log but allows pod |\n| **warn** | Returns warning to user but allows pod |\n\n## Workflow\n\n### Step 1: Label Namespaces for PSA\n\n```yaml\n# Restricted namespace - production workloads\napiVersion: v1\nkind: Namespace\nmetadata:\n  name: production\n  labels:\n    pod-security.kubernetes.io\u002Fenforce: restricted\n    pod-security.kubernetes.io\u002Fenforce-version: latest\n    pod-security.kubernetes.io\u002Faudit: restricted\n    pod-security.kubernetes.io\u002Faudit-version: latest\n    pod-security.kubernetes.io\u002Fwarn: restricted\n    pod-security.kubernetes.io\u002Fwarn-version: latest\n```\n\n```yaml\n# Baseline namespace - general workloads\napiVersion: v1\nkind: Namespace\nmetadata:\n  name: staging\n  labels:\n    pod-security.kubernetes.io\u002Fenforce: baseline\n    pod-security.kubernetes.io\u002Fenforce-version: latest\n    pod-security.kubernetes.io\u002Faudit: restricted\n    pod-security.kubernetes.io\u002Faudit-version: latest\n    pod-security.kubernetes.io\u002Fwarn: restricted\n    pod-security.kubernetes.io\u002Fwarn-version: latest\n```\n\n```yaml\n# Privileged namespace - system components only\napiVersion: v1\nkind: Namespace\nmetadata:\n  name: kube-system\n  labels:\n    pod-security.kubernetes.io\u002Fenforce: privileged\n    pod-security.kubernetes.io\u002Fenforce-version: latest\n```\n\n### Step 2: Apply Labels to Existing Namespaces\n\n```bash\n# Apply restricted enforcement to production\nkubectl label namespace production \\\n  pod-security.kubernetes.io\u002Fenforce=restricted \\\n  pod-security.kubernetes.io\u002Faudit=restricted \\\n  pod-security.kubernetes.io\u002Fwarn=restricted \\\n  --overwrite\n\n# Apply baseline to staging with restricted warnings\nkubectl label namespace staging \\\n  pod-security.kubernetes.io\u002Fenforce=baseline \\\n  pod-security.kubernetes.io\u002Faudit=restricted \\\n  pod-security.kubernetes.io\u002Fwarn=restricted \\\n  --overwrite\n\n# Check labels on all namespaces\nkubectl get namespaces -L pod-security.kubernetes.io\u002Fenforce\n```\n\n### Step 3: Create Compliant Pod Specs\n\n```yaml\n# Restricted-compliant deployment\napiVersion: apps\u002Fv1\nkind: Deployment\nmetadata:\n  name: secure-app\n  namespace: production\nspec:\n  replicas: 3\n  selector:\n    matchLabels:\n      app: secure-app\n  template:\n    metadata:\n      labels:\n        app: secure-app\n    spec:\n      automountServiceAccountToken: false\n      securityContext:\n        runAsNonRoot: true\n        runAsUser: 65534\n        runAsGroup: 65534\n        fsGroup: 65534\n        seccompProfile:\n          type: RuntimeDefault\n      containers:\n        - name: app\n          image: myregistry.com\u002Fmyapp:v1.0.0@sha256:abc123\n          ports:\n            - containerPort: 8080\n              protocol: TCP\n          securityContext:\n            allowPrivilegeEscalation: false\n            readOnlyRootFilesystem: true\n            capabilities:\n              drop:\n                - ALL\n            runAsNonRoot: true\n            runAsUser: 65534\n          resources:\n            requests:\n              memory: \"64Mi\"\n              cpu: \"100m\"\n            limits:\n              memory: \"256Mi\"\n              cpu: \"500m\"\n          volumeMounts:\n            - name: tmp\n              mountPath: \u002Ftmp\n            - name: cache\n              mountPath: \u002Fvar\u002Fcache\n      volumes:\n        - name: tmp\n          emptyDir:\n            sizeLimit: 100Mi\n        - name: cache\n          emptyDir:\n            sizeLimit: 50Mi\n```\n\n### Step 4: Gradual Migration Strategy\n\n```bash\n# Phase 1: Audit mode - discover violations without blocking\nkubectl label namespace my-namespace \\\n  pod-security.kubernetes.io\u002Faudit=restricted \\\n  pod-security.kubernetes.io\u002Fwarn=restricted\n\n# Check audit logs for violations\nkubectl logs -n kube-system -l component=kube-apiserver | grep \"pod-security\"\n\n# Phase 2: Enforce baseline, warn on restricted\nkubectl label namespace my-namespace \\\n  pod-security.kubernetes.io\u002Fenforce=baseline \\\n  pod-security.kubernetes.io\u002Fwarn=restricted \\\n  --overwrite\n\n# Phase 3: Full restricted enforcement\nkubectl label namespace my-namespace \\\n  pod-security.kubernetes.io\u002Fenforce=restricted \\\n  --overwrite\n```\n\n### Step 5: Dry-Run Enforcement Testing\n\n```bash\n# Test what would happen with restricted enforcement\nkubectl label --dry-run=server --overwrite namespace my-namespace \\\n  pod-security.kubernetes.io\u002Fenforce=restricted\n\n# Example output:\n# Warning: existing pods in namespace \"my-namespace\" violate the new\n# PodSecurity enforce level \"restricted:latest\"\n# Warning: nginx-xxx: allowPrivilegeEscalation != false,\n#   unrestricted capabilities, runAsNonRoot != true, seccompProfile\n```\n\n## Baseline Profile Restrictions\n\n| Control | Restricted | Requirement |\n|---------|-----------|-------------|\n| HostProcess | Must not set | Pods cannot use Windows HostProcess |\n| Host Namespaces | Must not set | No hostNetwork, hostPID, hostIPC |\n| Privileged | Must not set | No privileged: true |\n| Capabilities | Baseline list only | Only NET_BIND_SERVICE, drop ALL for restricted |\n| HostPath Volumes | Must not use | No hostPath volume mounts |\n| Host Ports | Must not use | No hostPort in container spec |\n| AppArmor | Default\u002Fruntime | Cannot set to unconfined |\n| SELinux | Limited types | Only container_t, container_init_t, container_kvm_t |\n| \u002Fproc Mount Type | Default only | Must use Default proc mount |\n| Seccomp | RuntimeDefault or Localhost | Must specify seccomp profile (restricted) |\n| Sysctls | Safe set only | Limited to safe sysctls |\n\n## Validation Commands\n\n```bash\n# Verify namespace labels\nkubectl get ns --show-labels | grep pod-security\n\n# Test pod creation against policy\nkubectl run test-pod --image=nginx --namespace=production --dry-run=server\n\n# Check for violations in audit logs\nkubectl get events --field-selector reason=FailedCreate -A\n\n# Scan with Kubescape for PSS compliance\nkubescape scan framework nsa --namespace production\n```\n\n## References\n\n- [Pod Security Standards - Kubernetes](https:\u002F\u002Fkubernetes.io\u002Fdocs\u002Fconcepts\u002Fsecurity\u002Fpod-security-standards\u002F)\n- [Pod Security Admission - Kubernetes](https:\u002F\u002Fkubernetes.io\u002Fdocs\u002Fconcepts\u002Fsecurity\u002Fpod-security-admission\u002F)\n- [Migrate from PodSecurityPolicy](https:\u002F\u002Fkubernetes.io\u002Fdocs\u002Ftasks\u002Fconfigure-pod-container\u002Fmigrate-from-psp\u002F)\n- [Kubescape PSS Scanner](https:\u002F\u002Fgithub.com\u002Fkubescape\u002Fkubescape)\n",{"name":5,"tags":49,"capec":52,"model":34,"tools":53,"domain":41,"maxTurns":57,"nist_csf":58,"subdomain":37,"description":7,"mitre_attack":63},[30,25,35,50,51],"pod-security","PSA",[],[54,40,55,56],"Read","Glob","Grep",20,[59,60,61,62],"PR.PS-01","PR.IR-01","ID.AM-08","DE.CM-01",[64],"T1610","main","a91f1293287ffa9f4f1b8f486cd6e835a1568c84","skills\u002Fcloud\u002Fkubernetes\u002Fhardening\u002Fpodsecurity\u002Fexploit","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace","https:\u002F\u002Fgithub.com\u002FDCx7C5","#Python","2026-09-01 11:21:00",{"source":8,"skillName":5,"commands":73,"prompt":83,"zipAvailable":84},[74,77,80],{"tool":75,"command":76},"npx","npx skills add DCx7C5\u002Fai-marketplace --skill kubernetes-hardening-podsecurity-exploit",{"tool":78,"command":79},"bunx","bunx skills add DCx7C5\u002Fai-marketplace --skill kubernetes-hardening-podsecurity-exploit",{"tool":81,"command":82},"pnpm","pnpm dlx skills add DCx7C5\u002Fai-marketplace --skill kubernetes-hardening-podsecurity-exploit","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fcloud\u002Fkubernetes\u002Fhardening\u002Fpodsecurity\u002Fexploit\u002FSKILL.md",true,[86],{"path":87,"resourceType":88,"resourceTypeDesc":89,"sizeBytes":90,"sourceHtmlUrl":91},"index.json","REFERENCE","参考文档",731,"https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fcloud\u002Fkubernetes\u002Fhardening\u002Fpodsecurity\u002Fexploit\u002Findex.json",[93,116,136,157,179,195],{"skillNo":94,"name":95,"nameZh":6,"description":96,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":97,"categories":98,"keywords":99,"publishedAt":44},"01M71HAPZ01KQ30RKTB0FFSQ05","services-wmi-persistence-detect","Detect WMI event subscription persistence by enumerating ActiveScriptEventConsumer, CommandLineEventConsumer, and permanent subscriptions in the WMI repository.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fservices\u002Fwmi\u002Fpersistence\u002Fdetect\u002FSKILL.md",[],[100,101,102,103,104,38,43,105,106,107,108,109,110,111,112,113,114,41,115],"services","detect","services wmi persistence detect","wmi","persistence","process","activescript","event","subscriptions","commandline-consumer","repository","subscription","event-subscription","t1546.003","forensics","process-forensics",{"skillNo":117,"name":118,"nameZh":6,"description":119,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":120,"categories":121,"keywords":122,"publishedAt":44},"01M71HAK6JTTTS229T17WJMMCG","services-wmi-exec-exploit","Perform lateral movement across Windows networks using WMI-based remote execution techniques including Impacket wmiexec.py, CrackMapExec, and native WMI commands for stealthy post-exploitation during red team engagements.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fservices\u002Fwmi\u002Fexec\u002Fexploit\u002FSKILL.md",[],[24,100,123,103,124,125,126,41,40,127,128,129,130,131,38,132,133,36,134,135],"services wmi exec exploit","exec","remote","traffic","analysis","team","across","crackmapexec","native","command","lateral movement","lateral-movement","Impacket",{"skillNo":137,"name":138,"nameZh":6,"description":139,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":140,"categories":141,"keywords":142,"publishedAt":44},"01M71HAG6MHKNQV8KDZKMT4886","registry-artifact-extract","Extract and analyze Windows Registry hives to uncover user activity, installed software, autostart entries, and evidence of system compromise.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fregistry\u002Fartifact\u002Fextract\u002FSKILL.md",[],[143,144,145,146,147,148,41,40,149,127,150,151,38,36,152,153,154,155,156,34],"artifact","registry","registry artifact extract","extract","evidence-collection","artifact-analysis","collection","analyze","uncover","software","activity","digital-forensics","windows-registry","regripper",{"skillNo":158,"name":159,"nameZh":6,"description":160,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":161,"categories":162,"keywords":163,"publishedAt":44},"01M71HACR4A8XTWTTSXK4124AA","processes-token-impersonate-detect","Detect Windows token impersonation and privilege abuse including SeImpersonatePrivilege exploitation via Potato attacks and token stealing techniques.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fprocesses\u002Ftoken\u002Fimpersonate\u002Fdetect\u002FSKILL.md",[],[101,164,165,166,167,168,169,43,170,41,115,171,172,173,174,175,176,177,178,38],"processes token impersonate detect","token","processes","attacks","windows","escalation","techniques","privilege-escalation","seimpersonate","token-impersonation","printspoofer","exploitation","potato","impersonation","via",{"skillNo":180,"name":181,"nameZh":6,"description":182,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":183,"categories":184,"keywords":185,"publishedAt":44},"01M71HAABSB4Z6QFSXEG00R4RK","processes-thread-injection-detect","Detect Windows thread injection techniques including CreateRemoteThread, QueueUserAPC, NtCreateThreadEx, and thread hijacking via process memory analysis.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fprocesses\u002Fthread\u002Finjection\u002Fdetect\u002FSKILL.md",[],[186,187,101,188,166,168,189,43,190,170,41,115,127,191,192,193,194,178,38,105],"thread","processes thread injection detect","injection","memory","process-injection","api","apc-injection","thread-injection","nt-api",{"skillNo":196,"name":197,"nameZh":6,"description":198,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":199,"categories":200,"keywords":201,"publishedAt":44},"01M71HA7H311V5G14WMX58HQSS","processes-hollow-technique-detect","Detect process hollowing (RunPE) by identifying processes with mismatched image paths between PEB and VAD tree, or unmapped PE headers in memory.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fprocesses\u002Fhollow\u002Ftechnique\u002Fdetect\u002FSKILL.md",[],[202,101,166,203,189,43,204,205,41,115,206,207,208,209,210,211,38,105,212,213],"processes hollow technique detect","tree","memory-forensics","process-hollow","peb","runpe","image","pe-header","in memory","with","mismatched","headers"]