[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M71CM8MADW091F4554SFQRVW":3,"skill-same:01M71CM8MADW091F4554SFQRVW":94},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":23,"publishedAt":44,"linkOnly":45,"markdownContent":46,"markdownBody":47,"frontMatter":48,"refName":67,"commitSha":68,"skillDirectory":69,"forksCount":14,"repositoryHtmlUrl":70,"repositoryHomepageUrl":6,"ownerHtmlUrl":71,"ownerBlogUrl":6,"ownerDescription":72,"updatedAt":73,"install":74,"resources":87},"01M71CM8MADW091F4554SFQRVW","kubernetes-network-kubernetes-analyze",null,"Implement Kubernetes network segmentation using Calico NetworkPolicy and GlobalNetworkPolicy for zero-trust pod-to-pod communication.","DCx7C5\u002Fai-marketplace","DCx7C5","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F42419559?v=4","01M71C01G2AZV3NTNGWAWSHJPP","DC","01M71C01GQW6G50S2BYMS7PP3E",0,"MIT","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fcloud\u002Fkubernetes\u002Fnetwork\u002Fkubernetes\u002Fanalyze\u002FSKILL.md",[18],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000011","运维与部署","SCENARIO","使用场景",[24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43],"network","kubernetes","kubernetes network kubernetes analyze","analyze","for","ZeRO","pr","trust","sonnet","security","read","container-security","de","communication","zero-trust","Bash","cybersecurity","network segmentation","cm","segmentation","2026-11-10 10:12:30",false,"---\nname: kubernetes-network-kubernetes-analyze\ndescription: Implement Kubernetes network segmentation using Calico NetworkPolicy and GlobalNetworkPolicy for zero-trust pod-to-pod communication.\ndomain: cybersecurity\nsubdomain: container-security\ntags:\n- calico\n- kubernetes\n- network-policy\n- network-segmentation\n- zero-trust\n- cni\nnist_csf:\n- PR.PS-01\n- PR.IR-01\n- ID.AM-08\n- DE.CM-01\nmodel: sonnet\nmaxTurns: 20\ntools: [Read, Bash, Glob, Grep]\nmitre_attack:\n- T1610\ncapec: []\n---\n\n# Implementing Kubernetes Network Policy with Calico\n\n## Overview\n\nCalico is an open-source CNI plugin that provides fine-grained network policy enforcement for Kubernetes clusters. It implements the full Kubernetes NetworkPolicy API and extends it with Calico-specific GlobalNetworkPolicy, supporting policy ordering, deny rules, and service-account-based selectors.\n\n\n## When to Use\n\n- When deploying or configuring implementing kubernetes network policy with calico capabilities in your environment\n- When establishing security controls aligned to compliance requirements\n- When building or improving security architecture for this domain\n- When conducting security assessments that require this implementation\n\n## Prerequisites\n\n- Kubernetes cluster (v1.24+)\n- Calico CNI installed (v3.26+)\n- `kubectl` and `calicoctl` CLI tools\n- Cluster admin RBAC permissions\n\n## Installing Calico\n\n### Operator-based Installation (Recommended)\n\n```bash\n# Install the Tigera operator\nkubectl create -f https:\u002F\u002Fraw.githubusercontent.com\u002Fprojectcalico\u002Fcalico\u002Fv3.27.0\u002Fmanifests\u002Ftigera-operator.yaml\n\n# Install Calico custom resources\nkubectl create -f https:\u002F\u002Fraw.githubusercontent.com\u002Fprojectcalico\u002Fcalico\u002Fv3.27.0\u002Fmanifests\u002Fcustom-resources.yaml\n\n# Verify installation\nkubectl get pods -n calico-system\nwatch kubectl get pods -n calico-system\n\n# Install calicoctl\nkubectl apply -f https:\u002F\u002Fraw.githubusercontent.com\u002Fprojectcalico\u002Fcalico\u002Fv3.27.0\u002Fmanifests\u002Fcalicoctl.yaml\n```\n\n### Verify Calico is Running\n\n```bash\n# Check Calico pods\nkubectl get pods -n calico-system\n\n# Check Calico node status\nkubectl exec -n calico-system calicoctl -- calicoctl node status\n\n# Check IP pools\nkubectl exec -n calico-system calicoctl -- calicoctl get ippool -o wide\n```\n\n## Kubernetes NetworkPolicy\n\n### Default Deny All Traffic\n\n```yaml\n# deny-all-ingress.yaml\napiVersion: networking.k8s.io\u002Fv1\nkind: NetworkPolicy\nmetadata:\n  name: default-deny-ingress\n  namespace: production\nspec:\n  podSelector: {}\n  policyTypes:\n    - Ingress\n\n---\n# deny-all-egress.yaml\napiVersion: networking.k8s.io\u002Fv1\nkind: NetworkPolicy\nmetadata:\n  name: default-deny-egress\n  namespace: production\nspec:\n  podSelector: {}\n  policyTypes:\n    - Egress\n```\n\n### Allow Specific Pod-to-Pod Communication\n\n```yaml\n# allow-frontend-to-backend.yaml\napiVersion: networking.k8s.io\u002Fv1\nkind: NetworkPolicy\nmetadata:\n  name: allow-frontend-to-backend\n  namespace: production\nspec:\n  podSelector:\n    matchLabels:\n      app: backend\n  policyTypes:\n    - Ingress\n  ingress:\n    - from:\n        - podSelector:\n            matchLabels:\n              app: frontend\n      ports:\n        - protocol: TCP\n          port: 8080\n```\n\n### Allow DNS Egress\n\n```yaml\n# allow-dns-egress.yaml\napiVersion: networking.k8s.io\u002Fv1\nkind: NetworkPolicy\nmetadata:\n  name: allow-dns-egress\n  namespace: production\nspec:\n  podSelector: {}\n  policyTypes:\n    - Egress\n  egress:\n    - to:\n        - namespaceSelector: {}\n      ports:\n        - protocol: UDP\n          port: 53\n        - protocol: TCP\n          port: 53\n```\n\n### Namespace Isolation\n\n```yaml\n# allow-same-namespace.yaml\napiVersion: networking.k8s.io\u002Fv1\nkind: NetworkPolicy\nmetadata:\n  name: allow-same-namespace\n  namespace: production\nspec:\n  podSelector: {}\n  policyTypes:\n    - Ingress\n  ingress:\n    - from:\n        - podSelector: {}\n```\n\n## Calico-Specific Policies\n\n### GlobalNetworkPolicy (Cluster-Wide)\n\n```yaml\n# global-deny-external.yaml\napiVersion: projectcalico.org\u002Fv3\nkind: GlobalNetworkPolicy\nmetadata:\n  name: deny-external-ingress\nspec:\n  order: 100\n  selector: \"projectcalico.org\u002Fnamespace != 'ingress-nginx'\"\n  types:\n    - Ingress\n  ingress:\n    - action: Deny\n      source:\n        nets:\n          - 0.0.0.0\u002F0\n      destination: {}\n```\n\n### Calico NetworkPolicy with Deny Rules\n\n```yaml\n# calico-deny-policy.yaml\napiVersion: projectcalico.org\u002Fv3\nkind: NetworkPolicy\nmetadata:\n  name: deny-database-from-frontend\n  namespace: production\nspec:\n  order: 10\n  selector: app == 'database'\n  types:\n    - Ingress\n  ingress:\n    - action: Deny\n      source:\n        selector: app == 'frontend'\n    - action: Allow\n      source:\n        selector: app == 'backend'\n      destination:\n        ports:\n          - 5432\n```\n\n### Service Account Based Policy\n\n```yaml\n# sa-based-policy.yaml\napiVersion: projectcalico.org\u002Fv3\nkind: NetworkPolicy\nmetadata:\n  name: allow-by-service-account\n  namespace: production\nspec:\n  selector: app == 'api'\n  ingress:\n    - action: Allow\n      source:\n        serviceAccounts:\n          names:\n            - frontend-sa\n            - monitoring-sa\n  egress:\n    - action: Allow\n      destination:\n        serviceAccounts:\n          names:\n            - database-sa\n```\n\n### Host Endpoint Protection\n\n```yaml\n# host-endpoint-policy.yaml\napiVersion: projectcalico.org\u002Fv3\nkind: GlobalNetworkPolicy\nmetadata:\n  name: restrict-host-ssh\nspec:\n  order: 10\n  selector: \"has(kubernetes.io\u002Fhostname)\"\n  applyOnForward: false\n  types:\n    - Ingress\n  ingress:\n    - action: Allow\n      protocol: TCP\n      source:\n        nets:\n          - 10.0.0.0\u002F8\n      destination:\n        ports:\n          - 22\n    - action: Deny\n      protocol: TCP\n      destination:\n        ports:\n          - 22\n```\n\n## Calico Policy Tiers\n\n```yaml\n# security-tier.yaml\napiVersion: projectcalico.org\u002Fv3\nkind: Tier\nmetadata:\n  name: security\nspec:\n  order: 100\n\n---\n# platform-tier.yaml\napiVersion: projectcalico.org\u002Fv3\nkind: Tier\nmetadata:\n  name: platform\nspec:\n  order: 200\n```\n\n## Monitoring and Troubleshooting\n\n```bash\n# List all network policies\nkubectl get networkpolicy --all-namespaces\n\n# List Calico-specific policies\nkubectl exec -n calico-system calicoctl -- calicoctl get networkpolicy --all-namespaces -o wide\nkubectl exec -n calico-system calicoctl -- calicoctl get globalnetworkpolicy -o wide\n\n# Check policy evaluation for a specific endpoint\nkubectl exec -n calico-system calicoctl -- calicoctl get workloadendpoint -n production -o yaml\n\n# View Calico logs\nkubectl logs -n calico-system -l k8s-app=calico-node --tail=100\n\n# Test connectivity\nkubectl exec -n production frontend-pod -- wget -qO- --timeout=2 http:\u002F\u002Fbackend-svc:8080\u002Fhealth\n```\n\n## Best Practices\n\n1. **Start with default deny** - Apply deny-all policies to every namespace, then allow specific traffic\n2. **Use labels consistently** - Define a labeling standard for app, tier, environment\n3. **Order policies** - Use Calico policy ordering (`order` field) to control evaluation precedence\n4. **Allow DNS first** - Always create DNS egress rules before applying egress deny policies\n5. **Use GlobalNetworkPolicy** for cluster-wide security baselines\n6. **Test policies in staging** - Validate network connectivity after applying policies\n7. **Monitor denied traffic** - Enable Calico flow logs for visibility into blocked connections\n8. **Use tiers** - Organize policies into security, platform, and application tiers\n","# Implementing Kubernetes Network Policy with Calico\n\n## Overview\n\nCalico is an open-source CNI plugin that provides fine-grained network policy enforcement for Kubernetes clusters. It implements the full Kubernetes NetworkPolicy API and extends it with Calico-specific GlobalNetworkPolicy, supporting policy ordering, deny rules, and service-account-based selectors.\n\n\n## When to Use\n\n- When deploying or configuring implementing kubernetes network policy with calico capabilities in your environment\n- When establishing security controls aligned to compliance requirements\n- When building or improving security architecture for this domain\n- When conducting security assessments that require this implementation\n\n## Prerequisites\n\n- Kubernetes cluster (v1.24+)\n- Calico CNI installed (v3.26+)\n- `kubectl` and `calicoctl` CLI tools\n- Cluster admin RBAC permissions\n\n## Installing Calico\n\n### Operator-based Installation (Recommended)\n\n```bash\n# Install the Tigera operator\nkubectl create -f https:\u002F\u002Fraw.githubusercontent.com\u002Fprojectcalico\u002Fcalico\u002Fv3.27.0\u002Fmanifests\u002Ftigera-operator.yaml\n\n# Install Calico custom resources\nkubectl create -f https:\u002F\u002Fraw.githubusercontent.com\u002Fprojectcalico\u002Fcalico\u002Fv3.27.0\u002Fmanifests\u002Fcustom-resources.yaml\n\n# Verify installation\nkubectl get pods -n calico-system\nwatch kubectl get pods -n calico-system\n\n# Install calicoctl\nkubectl apply -f https:\u002F\u002Fraw.githubusercontent.com\u002Fprojectcalico\u002Fcalico\u002Fv3.27.0\u002Fmanifests\u002Fcalicoctl.yaml\n```\n\n### Verify Calico is Running\n\n```bash\n# Check Calico pods\nkubectl get pods -n calico-system\n\n# Check Calico node status\nkubectl exec -n calico-system calicoctl -- calicoctl node status\n\n# Check IP pools\nkubectl exec -n calico-system calicoctl -- calicoctl get ippool -o wide\n```\n\n## Kubernetes NetworkPolicy\n\n### Default Deny All Traffic\n\n```yaml\n# deny-all-ingress.yaml\napiVersion: networking.k8s.io\u002Fv1\nkind: NetworkPolicy\nmetadata:\n  name: default-deny-ingress\n  namespace: production\nspec:\n  podSelector: {}\n  policyTypes:\n    - Ingress\n\n---\n# deny-all-egress.yaml\napiVersion: networking.k8s.io\u002Fv1\nkind: NetworkPolicy\nmetadata:\n  name: default-deny-egress\n  namespace: production\nspec:\n  podSelector: {}\n  policyTypes:\n    - Egress\n```\n\n### Allow Specific Pod-to-Pod Communication\n\n```yaml\n# allow-frontend-to-backend.yaml\napiVersion: networking.k8s.io\u002Fv1\nkind: NetworkPolicy\nmetadata:\n  name: allow-frontend-to-backend\n  namespace: production\nspec:\n  podSelector:\n    matchLabels:\n      app: backend\n  policyTypes:\n    - Ingress\n  ingress:\n    - from:\n        - podSelector:\n            matchLabels:\n              app: frontend\n      ports:\n        - protocol: TCP\n          port: 8080\n```\n\n### Allow DNS Egress\n\n```yaml\n# allow-dns-egress.yaml\napiVersion: networking.k8s.io\u002Fv1\nkind: NetworkPolicy\nmetadata:\n  name: allow-dns-egress\n  namespace: production\nspec:\n  podSelector: {}\n  policyTypes:\n    - Egress\n  egress:\n    - to:\n        - namespaceSelector: {}\n      ports:\n        - protocol: UDP\n          port: 53\n        - protocol: TCP\n          port: 53\n```\n\n### Namespace Isolation\n\n```yaml\n# allow-same-namespace.yaml\napiVersion: networking.k8s.io\u002Fv1\nkind: NetworkPolicy\nmetadata:\n  name: allow-same-namespace\n  namespace: production\nspec:\n  podSelector: {}\n  policyTypes:\n    - Ingress\n  ingress:\n    - from:\n        - podSelector: {}\n```\n\n## Calico-Specific Policies\n\n### GlobalNetworkPolicy (Cluster-Wide)\n\n```yaml\n# global-deny-external.yaml\napiVersion: projectcalico.org\u002Fv3\nkind: GlobalNetworkPolicy\nmetadata:\n  name: deny-external-ingress\nspec:\n  order: 100\n  selector: \"projectcalico.org\u002Fnamespace != 'ingress-nginx'\"\n  types:\n    - Ingress\n  ingress:\n    - action: Deny\n      source:\n        nets:\n          - 0.0.0.0\u002F0\n      destination: {}\n```\n\n### Calico NetworkPolicy with Deny Rules\n\n```yaml\n# calico-deny-policy.yaml\napiVersion: projectcalico.org\u002Fv3\nkind: NetworkPolicy\nmetadata:\n  name: deny-database-from-frontend\n  namespace: production\nspec:\n  order: 10\n  selector: app == 'database'\n  types:\n    - Ingress\n  ingress:\n    - action: Deny\n      source:\n        selector: app == 'frontend'\n    - action: Allow\n      source:\n        selector: app == 'backend'\n      destination:\n        ports:\n          - 5432\n```\n\n### Service Account Based Policy\n\n```yaml\n# sa-based-policy.yaml\napiVersion: projectcalico.org\u002Fv3\nkind: NetworkPolicy\nmetadata:\n  name: allow-by-service-account\n  namespace: production\nspec:\n  selector: app == 'api'\n  ingress:\n    - action: Allow\n      source:\n        serviceAccounts:\n          names:\n            - frontend-sa\n            - monitoring-sa\n  egress:\n    - action: Allow\n      destination:\n        serviceAccounts:\n          names:\n            - database-sa\n```\n\n### Host Endpoint Protection\n\n```yaml\n# host-endpoint-policy.yaml\napiVersion: projectcalico.org\u002Fv3\nkind: GlobalNetworkPolicy\nmetadata:\n  name: restrict-host-ssh\nspec:\n  order: 10\n  selector: \"has(kubernetes.io\u002Fhostname)\"\n  applyOnForward: false\n  types:\n    - Ingress\n  ingress:\n    - action: Allow\n      protocol: TCP\n      source:\n        nets:\n          - 10.0.0.0\u002F8\n      destination:\n        ports:\n          - 22\n    - action: Deny\n      protocol: TCP\n      destination:\n        ports:\n          - 22\n```\n\n## Calico Policy Tiers\n\n```yaml\n# security-tier.yaml\napiVersion: projectcalico.org\u002Fv3\nkind: Tier\nmetadata:\n  name: security\nspec:\n  order: 100\n\n---\n# platform-tier.yaml\napiVersion: projectcalico.org\u002Fv3\nkind: Tier\nmetadata:\n  name: platform\nspec:\n  order: 200\n```\n\n## Monitoring and Troubleshooting\n\n```bash\n# List all network policies\nkubectl get networkpolicy --all-namespaces\n\n# List Calico-specific policies\nkubectl exec -n calico-system calicoctl -- calicoctl get networkpolicy --all-namespaces -o wide\nkubectl exec -n calico-system calicoctl -- calicoctl get globalnetworkpolicy -o wide\n\n# Check policy evaluation for a specific endpoint\nkubectl exec -n calico-system calicoctl -- calicoctl get workloadendpoint -n production -o yaml\n\n# View Calico logs\nkubectl logs -n calico-system -l k8s-app=calico-node --tail=100\n\n# Test connectivity\nkubectl exec -n production frontend-pod -- wget -qO- --timeout=2 http:\u002F\u002Fbackend-svc:8080\u002Fhealth\n```\n\n## Best Practices\n\n1. **Start with default deny** - Apply deny-all policies to every namespace, then allow specific traffic\n2. **Use labels consistently** - Define a labeling standard for app, tier, environment\n3. **Order policies** - Use Calico policy ordering (`order` field) to control evaluation precedence\n4. **Allow DNS first** - Always create DNS egress rules before applying egress deny policies\n5. **Use GlobalNetworkPolicy** for cluster-wide security baselines\n6. **Test policies in staging** - Validate network connectivity after applying policies\n7. **Monitor denied traffic** - Enable Calico flow logs for visibility into blocked connections\n8. **Use tiers** - Organize policies into security, platform, and application tiers\n",{"name":5,"tags":49,"capec":54,"model":32,"tools":55,"domain":40,"maxTurns":59,"nist_csf":60,"subdomain":35,"description":7,"mitre_attack":65},[50,25,51,52,38,53],"calico","network-policy","network-segmentation","cni",[],[56,39,57,58],"Read","Glob","Grep",20,[61,62,63,64],"PR.PS-01","PR.IR-01","ID.AM-08","DE.CM-01",[66],"T1610","main","a91f1293287ffa9f4f1b8f486cd6e835a1568c84","skills\u002Fcloud\u002Fkubernetes\u002Fnetwork\u002Fkubernetes\u002Fanalyze","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace","https:\u002F\u002Fgithub.com\u002FDCx7C5","#Python","2026-09-01 11:21:00",{"source":8,"skillName":5,"commands":75,"prompt":85,"zipAvailable":86},[76,79,82],{"tool":77,"command":78},"npx","npx skills add DCx7C5\u002Fai-marketplace --skill kubernetes-network-kubernetes-analyze",{"tool":80,"command":81},"bunx","bunx skills add DCx7C5\u002Fai-marketplace --skill kubernetes-network-kubernetes-analyze",{"tool":83,"command":84},"pnpm","pnpm dlx skills add DCx7C5\u002Fai-marketplace --skill kubernetes-network-kubernetes-analyze","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fcloud\u002Fkubernetes\u002Fnetwork\u002Fkubernetes\u002Fanalyze\u002FSKILL.md",true,[88],{"path":89,"resourceType":90,"resourceTypeDesc":91,"sizeBytes":92,"sourceHtmlUrl":93},"index.json","REFERENCE","参考文档",655,"https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fcloud\u002Fkubernetes\u002Fnetwork\u002Fkubernetes\u002Fanalyze\u002Findex.json",[95,118,139,159,181,197],{"skillNo":96,"name":97,"nameZh":6,"description":98,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":99,"categories":100,"keywords":101,"publishedAt":44},"01M71HAPZ01KQ30RKTB0FFSQ05","services-wmi-persistence-detect","Detect WMI event subscription persistence by enumerating ActiveScriptEventConsumer, CommandLineEventConsumer, and permanent subscriptions in the WMI repository.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fservices\u002Fwmi\u002Fpersistence\u002Fdetect\u002FSKILL.md",[],[102,103,104,105,106,36,42,107,108,109,110,111,112,113,114,115,116,40,117],"services","detect","services wmi persistence detect","wmi","persistence","process","activescript","event","subscriptions","commandline-consumer","repository","subscription","event-subscription","t1546.003","forensics","process-forensics",{"skillNo":119,"name":120,"nameZh":6,"description":121,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":122,"categories":123,"keywords":124,"publishedAt":44},"01M71HAK6JTTTS229T17WJMMCG","services-wmi-exec-exploit","Perform lateral movement across Windows networks using WMI-based remote execution techniques including Impacket wmiexec.py, CrackMapExec, and native WMI commands for stealthy post-exploitation during red team engagements.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fservices\u002Fwmi\u002Fexec\u002Fexploit\u002FSKILL.md",[],[125,102,126,105,127,128,129,40,39,130,131,132,133,134,36,135,136,34,137,138],"exploit","services wmi exec exploit","exec","remote","traffic","analysis","team","across","crackmapexec","native","command","lateral movement","lateral-movement","Impacket",{"skillNo":140,"name":141,"nameZh":6,"description":142,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":143,"categories":144,"keywords":145,"publishedAt":44},"01M71HAG6MHKNQV8KDZKMT4886","registry-artifact-extract","Extract and analyze Windows Registry hives to uncover user activity, installed software, autostart entries, and evidence of system compromise.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fregistry\u002Fartifact\u002Fextract\u002FSKILL.md",[],[146,147,148,149,150,151,40,39,152,130,27,153,36,34,154,155,156,157,158,32],"artifact","registry","registry artifact extract","extract","evidence-collection","artifact-analysis","collection","uncover","software","activity","digital-forensics","windows-registry","regripper",{"skillNo":160,"name":161,"nameZh":6,"description":162,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":163,"categories":164,"keywords":165,"publishedAt":44},"01M71HACR4A8XTWTTSXK4124AA","processes-token-impersonate-detect","Detect Windows token impersonation and privilege abuse including SeImpersonatePrivilege exploitation via Potato attacks and token stealing techniques.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fprocesses\u002Ftoken\u002Fimpersonate\u002Fdetect\u002FSKILL.md",[],[103,166,167,168,169,170,171,42,172,40,117,173,174,175,176,177,178,179,180,36],"processes token impersonate detect","token","processes","attacks","windows","escalation","techniques","privilege-escalation","seimpersonate","token-impersonation","printspoofer","exploitation","potato","impersonation","via",{"skillNo":182,"name":183,"nameZh":6,"description":184,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":185,"categories":186,"keywords":187,"publishedAt":44},"01M71HAABSB4Z6QFSXEG00R4RK","processes-thread-injection-detect","Detect Windows thread injection techniques including CreateRemoteThread, QueueUserAPC, NtCreateThreadEx, and thread hijacking via process memory analysis.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fprocesses\u002Fthread\u002Finjection\u002Fdetect\u002FSKILL.md",[],[188,189,103,190,168,170,191,42,192,172,40,117,130,193,194,195,196,180,36,107],"thread","processes thread injection detect","injection","memory","process-injection","api","apc-injection","thread-injection","nt-api",{"skillNo":198,"name":199,"nameZh":6,"description":200,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":201,"categories":202,"keywords":203,"publishedAt":44},"01M71HA7H311V5G14WMX58HQSS","processes-hollow-technique-detect","Detect process hollowing (RunPE) by identifying processes with mismatched image paths between PEB and VAD tree, or unmapped PE headers in memory.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fprocesses\u002Fhollow\u002Ftechnique\u002Fdetect\u002FSKILL.md",[],[204,103,168,205,191,42,206,207,40,117,208,209,210,211,212,213,36,107,214,215],"processes hollow technique detect","tree","memory-forensics","process-hollow","peb","runpe","image","pe-header","in memory","with","mismatched","headers"]