[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M71D9Y07CC8CRAPDFKBD6RKB":3,"skill-same:01M71D9Y07CC8CRAPDFKBD6RKB":61},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":23,"publishedAt":29,"linkOnly":30,"markdownContent":31,"markdownBody":32,"frontMatter":33,"refName":34,"commitSha":35,"skillDirectory":36,"forksCount":14,"repositoryHtmlUrl":37,"repositoryHomepageUrl":6,"ownerHtmlUrl":38,"ownerBlogUrl":6,"ownerDescription":39,"updatedAt":40,"install":41,"resources":54},"01M71D9Y07CC8CRAPDFKBD6RKB","email-phishing-ir-respond",null,"Email Phishing Ir Respond.","DCx7C5\u002Fai-marketplace","DCx7C5","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F42419559?v=4","01M71C01G2AZV3NTNGWAWSHJPP","DC","01M71C01GQW6G50S2BYMS7PP3E",0,"MIT","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Femail-phishing-ir-respond\u002FSKILL.md",[18],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000005","邮件与沟通","SCENARIO","使用场景",[24,25,26,27,28],"email","respond","email phishing ir respond","phishing","cybersecurity","2026-11-10 10:12:30",false,"---\nname: email-phishing-ir-respond\ndescription: \"Email Phishing Ir Respond.\"\ndomain: cybersecurity\n---\n\n|\n| **Spear Phishing** | Targeted phishing attack crafted for a specific individual or organization using personalized content |\n| **Credential Harvesting** | Phishing technique that mimics a legitimate login page to capture usernames and passwords |\n| **SPF (Sender Policy Framework)** | Email authentication protocol that specifies which mail servers are authorized to send email for a domain |\n| **DKIM (DomainKeys Identified Mail)** | Email authentication method using cryptographic signatures to verify that an email was not altered in transit |\n| **DMARC** | Policy framework that uses SPF and DKIM to determine email authenticity and instructs receivers on handling failures |\n| **OAuth Consent Phishing** | Attack that tricks users into granting malicious OAuth applications access to their email and data |\n| **Email Header** | Metadata embedded in every email containing routing, authentication, and sender information used for forensic analysis |\n\n## Tools & Systems\n\n- **Microsoft Defender for Office 365**: Email threat protection with Threat Explorer for investigation and automated purge\n- **Proofpoint TAP (Targeted Attack Protection)**: Email security platform with URL rewriting and attachment sandboxing\n- **URLscan.io**: Online service that scans URLs and captures screenshots of phishing pages for evidence\n- **PhishTool**: Phishing analysis platform that automates header analysis, URL inspection, and IOC extraction\n- **GoPhish**: Open-source phishing simulation platform for security awareness testing\n\n## Common Scenarios\n\n### Scenario: Microsoft 365 Credential Phishing via QR Code\n\n**Context**: Users report an email claiming to be from IT requiring MFA re-enrollment. The email contains a QR code that links to a convincing Microsoft 365 login page clone hosted on a compromised WordPress site.\n\n**Approach**:\n1. Scan the QR code in a sandbox to extract the URL\n2. Analyze the phishing page: captures credentials and MFA tokens (adversary-in-the-middle attack)\n3. Search email gateway for all recipients using message subject and sender as search criteria\n4. Cross-reference with proxy logs to identify users who visited the phishing URL\n5. Force password reset and revoke sessions for all users who visited the URL\n6. Purge the email from all mailboxes and block the sender domain\n7. Notify users about the specific campaign with visual examples of the phishing email\n\n**Pitfalls**:\n- Not checking for adversary-in-the-middle (AiTM) capability that captures session tokens even with MFA\n- Only resetting passwords without revoking active sessions (attacker retains access via stolen session cookies)\n- Not searching for mailbox forwarding rules created by the attacker after compromising an account\n- Missing QR code phishing (quishing) because URL scanning tools cannot decode QR code images\n\n## Output Format\n\n```\nPHISHING INCIDENT RESPONSE REPORT\n===================================\nIncident:          INC-2025-1602\nDate Reported:     2025-11-16T09:15:00Z\nReported By:       jdoe@corp.example.com\nClassification:    Credential Phishing (AiTM)\n\nEMAIL ANALYSIS\nSubject:       \"Action Required: MFA Re-enrollment\"\nSender:        it-support@corp-security[.]com (spoofed)\nSPF:           FAIL | DKIM: FAIL | DMARC: FAIL\nPhishing URL:  hxxps:\u002F\u002Fcompromised-site[.]com\u002Fms365\u002Flogin\nPhishing Type: Microsoft 365 AiTM credential harvester\n\nIMPACT ASSESSMENT\nRecipients:        47\nClicked Link:      8\nCredentials Entered: 3 (confirmed via proxy POST data)\n\nCONTAINMENT ACTIONS\n[x] Email purged from all 47 mailboxes\n[x] Phishing domain blocked at web proxy\n[x] Sender domain blocked at email gateway\n[x] 3 compromised accounts: passwords reset, sessions revoked\n[x] Mailbox forwarding rules reviewed (1 malicious rule removed)\n[x] OAuth app grants reviewed (no unauthorized grants found)\n\nIOCs EXTRACTED\nDomain:  corp-security[.]com\nURL:     hxxps:\u002F\u002Fcompromised-site[.]com\u002Fms365\u002Flogin\nIP:      104.21.x.x (Cloudflare-hosted)\nSender:  it-support@corp-security[.]com\n\nRECOMMENDATIONS\n1. Implement DMARC enforcement (p=reject) for corp domain\n2. Deploy QR code scanning in email gateway\n3. Send targeted awareness notification to all 47 recipients\n4. Request domain takedown via registrar abuse contact\n```\n","|\n| **Spear Phishing** | Targeted phishing attack crafted for a specific individual or organization using personalized content |\n| **Credential Harvesting** | Phishing technique that mimics a legitimate login page to capture usernames and passwords |\n| **SPF (Sender Policy Framework)** | Email authentication protocol that specifies which mail servers are authorized to send email for a domain |\n| **DKIM (DomainKeys Identified Mail)** | Email authentication method using cryptographic signatures to verify that an email was not altered in transit |\n| **DMARC** | Policy framework that uses SPF and DKIM to determine email authenticity and instructs receivers on handling failures |\n| **OAuth Consent Phishing** | Attack that tricks users into granting malicious OAuth applications access to their email and data |\n| **Email Header** | Metadata embedded in every email containing routing, authentication, and sender information used for forensic analysis |\n\n## Tools & Systems\n\n- **Microsoft Defender for Office 365**: Email threat protection with Threat Explorer for investigation and automated purge\n- **Proofpoint TAP (Targeted Attack Protection)**: Email security platform with URL rewriting and attachment sandboxing\n- **URLscan.io**: Online service that scans URLs and captures screenshots of phishing pages for evidence\n- **PhishTool**: Phishing analysis platform that automates header analysis, URL inspection, and IOC extraction\n- **GoPhish**: Open-source phishing simulation platform for security awareness testing\n\n## Common Scenarios\n\n### Scenario: Microsoft 365 Credential Phishing via QR Code\n\n**Context**: Users report an email claiming to be from IT requiring MFA re-enrollment. The email contains a QR code that links to a convincing Microsoft 365 login page clone hosted on a compromised WordPress site.\n\n**Approach**:\n1. Scan the QR code in a sandbox to extract the URL\n2. Analyze the phishing page: captures credentials and MFA tokens (adversary-in-the-middle attack)\n3. Search email gateway for all recipients using message subject and sender as search criteria\n4. Cross-reference with proxy logs to identify users who visited the phishing URL\n5. Force password reset and revoke sessions for all users who visited the URL\n6. Purge the email from all mailboxes and block the sender domain\n7. Notify users about the specific campaign with visual examples of the phishing email\n\n**Pitfalls**:\n- Not checking for adversary-in-the-middle (AiTM) capability that captures session tokens even with MFA\n- Only resetting passwords without revoking active sessions (attacker retains access via stolen session cookies)\n- Not searching for mailbox forwarding rules created by the attacker after compromising an account\n- Missing QR code phishing (quishing) because URL scanning tools cannot decode QR code images\n\n## Output Format\n\n```\nPHISHING INCIDENT RESPONSE REPORT\n===================================\nIncident:          INC-2025-1602\nDate Reported:     2025-11-16T09:15:00Z\nReported By:       jdoe@corp.example.com\nClassification:    Credential Phishing (AiTM)\n\nEMAIL ANALYSIS\nSubject:       \"Action Required: MFA Re-enrollment\"\nSender:        it-support@corp-security[.]com (spoofed)\nSPF:           FAIL | DKIM: FAIL | DMARC: FAIL\nPhishing URL:  hxxps:\u002F\u002Fcompromised-site[.]com\u002Fms365\u002Flogin\nPhishing Type: Microsoft 365 AiTM credential harvester\n\nIMPACT ASSESSMENT\nRecipients:        47\nClicked Link:      8\nCredentials Entered: 3 (confirmed via proxy POST data)\n\nCONTAINMENT ACTIONS\n[x] Email purged from all 47 mailboxes\n[x] Phishing domain blocked at web proxy\n[x] Sender domain blocked at email gateway\n[x] 3 compromised accounts: passwords reset, sessions revoked\n[x] Mailbox forwarding rules reviewed (1 malicious rule removed)\n[x] OAuth app grants reviewed (no unauthorized grants found)\n\nIOCs EXTRACTED\nDomain:  corp-security[.]com\nURL:     hxxps:\u002F\u002Fcompromised-site[.]com\u002Fms365\u002Flogin\nIP:      104.21.x.x (Cloudflare-hosted)\nSender:  it-support@corp-security[.]com\n\nRECOMMENDATIONS\n1. Implement DMARC enforcement (p=reject) for corp domain\n2. Deploy QR code scanning in email gateway\n3. Send targeted awareness notification to all 47 recipients\n4. Request domain takedown via registrar abuse contact\n```\n",{"name":5,"domain":28,"description":7},"main","a91f1293287ffa9f4f1b8f486cd6e835a1568c84","skills\u002Femail-phishing-ir-respond","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace","https:\u002F\u002Fgithub.com\u002FDCx7C5","#Python","2026-09-01 11:21:00",{"source":8,"skillName":5,"commands":42,"prompt":52,"zipAvailable":53},[43,46,49],{"tool":44,"command":45},"npx","npx skills add DCx7C5\u002Fai-marketplace --skill email-phishing-ir-respond",{"tool":47,"command":48},"bunx","bunx skills add DCx7C5\u002Fai-marketplace --skill email-phishing-ir-respond",{"tool":50,"command":51},"pnpm","pnpm dlx skills add DCx7C5\u002Fai-marketplace --skill email-phishing-ir-respond","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Femail-phishing-ir-respond\u002FSKILL.md",true,[55],{"path":56,"resourceType":57,"resourceTypeDesc":58,"sizeBytes":59,"sourceHtmlUrl":60},"index.json","REFERENCE","参考文档",500,"https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Femail-phishing-ir-respond\u002Findex.json",[62,87,110,132,154,170],{"skillNo":63,"name":64,"nameZh":6,"description":65,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":66,"categories":67,"keywords":68,"publishedAt":29},"01M71HAPZ01KQ30RKTB0FFSQ05","services-wmi-persistence-detect","Detect WMI event subscription persistence by enumerating ActiveScriptEventConsumer, CommandLineEventConsumer, and permanent subscriptions in the WMI repository.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fservices\u002Fwmi\u002Fpersistence\u002Fdetect\u002FSKILL.md",[],[69,70,71,72,73,74,75,76,77,78,79,80,81,82,83,84,85,28,86],"services","detect","services wmi persistence detect","wmi","persistence","de","cm","process","activescript","event","subscriptions","commandline-consumer","repository","subscription","event-subscription","t1546.003","forensics","process-forensics",{"skillNo":88,"name":89,"nameZh":6,"description":90,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":91,"categories":92,"keywords":93,"publishedAt":29},"01M71HAK6JTTTS229T17WJMMCG","services-wmi-exec-exploit","Perform lateral movement across Windows networks using WMI-based remote execution techniques including Impacket wmiexec.py, CrackMapExec, and native WMI commands for stealthy post-exploitation during red team engagements.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fservices\u002Fwmi\u002Fexec\u002Fexploit\u002FSKILL.md",[],[94,69,95,72,96,97,98,28,99,100,101,102,103,104,74,105,106,107,108,109],"exploit","services wmi exec exploit","exec","remote","traffic","Bash","analysis","team","across","crackmapexec","native","command","lateral movement","read","lateral-movement","Impacket",{"skillNo":111,"name":112,"nameZh":6,"description":113,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":114,"categories":115,"keywords":116,"publishedAt":29},"01M71HAG6MHKNQV8KDZKMT4886","registry-artifact-extract","Extract and analyze Windows Registry hives to uncover user activity, installed software, autostart entries, and evidence of system compromise.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fregistry\u002Fartifact\u002Fextract\u002FSKILL.md",[],[117,118,119,120,121,122,28,99,123,100,124,125,74,107,126,127,128,129,130,131],"artifact","registry","registry artifact extract","extract","evidence-collection","artifact-analysis","collection","analyze","uncover","software","activity","digital-forensics","windows-registry","regripper","sonnet",{"skillNo":133,"name":134,"nameZh":6,"description":135,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":136,"categories":137,"keywords":138,"publishedAt":29},"01M71HACR4A8XTWTTSXK4124AA","processes-token-impersonate-detect","Detect Windows token impersonation and privilege abuse including SeImpersonatePrivilege exploitation via Potato attacks and token stealing techniques.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fprocesses\u002Ftoken\u002Fimpersonate\u002Fdetect\u002FSKILL.md",[],[70,139,140,141,142,143,144,75,145,28,86,146,147,148,149,150,151,152,153,74],"processes token impersonate detect","token","processes","attacks","windows","escalation","techniques","privilege-escalation","seimpersonate","token-impersonation","printspoofer","exploitation","potato","impersonation","via",{"skillNo":155,"name":156,"nameZh":6,"description":157,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":158,"categories":159,"keywords":160,"publishedAt":29},"01M71HAABSB4Z6QFSXEG00R4RK","processes-thread-injection-detect","Detect Windows thread injection techniques including CreateRemoteThread, QueueUserAPC, NtCreateThreadEx, and thread hijacking via process memory analysis.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fprocesses\u002Fthread\u002Finjection\u002Fdetect\u002FSKILL.md",[],[161,162,70,163,141,143,164,75,165,145,28,86,100,166,167,168,169,153,74,76],"thread","processes thread injection detect","injection","memory","process-injection","api","apc-injection","thread-injection","nt-api",{"skillNo":171,"name":172,"nameZh":6,"description":173,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":174,"categories":175,"keywords":176,"publishedAt":29},"01M71HA7H311V5G14WMX58HQSS","processes-hollow-technique-detect","Detect process hollowing (RunPE) by identifying processes with mismatched image paths between PEB and VAD tree, or unmapped PE headers in memory.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fprocesses\u002Fhollow\u002Ftechnique\u002Fdetect\u002FSKILL.md",[],[177,70,141,178,164,75,179,180,28,86,181,182,183,184,185,186,74,76,187,188],"processes hollow technique detect","tree","memory-forensics","process-hollow","peb","runpe","image","pe-header","in memory","with","mismatched","headers"]