[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M71DC3JGR9VDCGPD387DP8SM":3,"skill-same:01M71DC3JGR9VDCGPD387DP8SM":99},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":18,"publishedAt":39,"linkOnly":40,"markdownContent":41,"markdownBody":42,"frontMatter":43,"refName":72,"commitSha":73,"skillDirectory":74,"forksCount":14,"repositoryHtmlUrl":75,"repositoryHomepageUrl":6,"ownerHtmlUrl":76,"ownerBlogUrl":6,"ownerDescription":77,"updatedAt":78,"install":79,"resources":92},"01M71DC3JGR9VDCGPD387DP8SM","phishing-spearphish-exploit",null,"Spearphishing simulation is a targeted social engineering attack vector used by red teams to gain initial access. Unlike broad phishing campaigns, spearphishing uses OSINT-derived intelligence to craf","DCx7C5\u002Fai-marketplace","DCx7C5","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F42419559?v=4","01M71C01G2AZV3NTNGWAWSHJPP","DC","01M71C01GQW6G50S2BYMS7PP3E",0,"MIT","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Femail\u002Fphishing\u002Fspearphish\u002Fexploit\u002FSKILL.md",[],[19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38],"exploit","phishing","phishing spearphish exploit","read","command","de","message","simulation","mitre-attack","conversion","team","analysis","Bash","access","cybersecurity","adversary-simulation","social","vector","spearphishing","t1566","2026-11-10 10:12:30",false,"---\nname: phishing-spearphish-exploit\ndescription: Spearphishing simulation is a targeted social engineering attack vector used by red teams to gain initial access. Unlike broad phishing campaigns, spearphishing uses OSINT-derived intelligence to craf\ndomain: cybersecurity\nsubdomain: red-teaming\ntags:\n- red-team\n- adversary-simulation\n- mitre-attack\n- exploitation\n- post-exploitation\n- spearphishing\n- social-engineering\nd3fend_techniques:\n- File Metadata Consistency Validation\n- Application Protocol Command Analysis\n- Identifier Analysis\n- Content Format Conversion\n- Message Analysis\nnist_csf:\n- ID.RA-01\n- GV.OV-02\n- DE.AE-07\nmodel: sonnet\nmaxTurns: 20\ntools: [Read, Bash, Glob, Grep]\nmitre_attack:\n- T1071\n- T1566\n- T1566.001\n- T1593\ncapec: []\n---\n\n# Conducting Spearphishing Simulation Campaign\n\n\n> **Legal Notice:** This skill is for authorized security testing and educational purposes only. Unauthorized use against systems you do not own or have written permission to test is illegal and may violate computer fraud laws.\n\n## Overview\n\nSpearphishing simulation is a targeted social engineering attack vector used by red teams to gain initial access. Unlike broad phishing campaigns, spearphishing uses OSINT-derived intelligence to craft highly personalized messages targeting specific individuals. This skill covers developing pretexts, building payloads, setting up email infrastructure, executing the campaign, and tracking results.\n\n\n## When to Use\n\n- When conducting security assessments that involve conducting spearphishing simulation campaign\n- When following incident response procedures for related security events\n- When performing scheduled security testing or auditing activities\n- When validating security controls through hands-on testing\n\n## Prerequisites\n\n- Familiarity with red teaming concepts and tools\n- Access to a test or lab environment for safe execution\n- Python 3.8+ with required dependencies installed\n- Appropriate authorization for any testing activities\n\n## Objectives\n\n- Develop convincing pretexts tailored to specific target personnel\n- Create weaponized payloads that bypass email security controls\n- Set up email delivery infrastructure with proper SPF\u002FDKIM\u002FDMARC configuration\n- Execute phishing campaigns with real-time tracking and metrics\n- Document results for engagement reporting and security awareness improvement\n\n## MITRE ATT&CK Mapping\n\n- **T1566.001** - Phishing: Spearphishing Attachment\n- **T1566.002** - Phishing: Spearphishing Link\n- **T1566.003** - Phishing: Spearphishing via Service\n- **T1598.003** - Phishing for Information: Spearphishing Link\n- **T1204.001** - User Execution: Malicious Link\n- **T1204.002** - User Execution: Malicious File\n- **T1608.001** - Stage Capabilities: Upload Malware\n- **T1608.005** - Stage Capabilities: Link Target\n- **T1583.001** - Acquire Infrastructure: Domains\n- **T1585.002** - Establish Accounts: Email Accounts\n\n## Workflow\n\n### Phase 1: Pretext Development\n1. Review OSINT findings for target personnel profiles\n2. Identify current organizational events (mergers, projects, new hires)\n3. Select pretext theme (IT helpdesk, HR benefits, vendor communication, executive request)\n4. Craft email templates with appropriate urgency and authority cues\n5. Create landing pages that mirror target organization's branding\n\n### Phase 2: Payload Development\n1. Select payload type based on target security controls:\n   - HTML smuggling for email gateway bypass\n   - Macro-enabled documents (if macros not blocked)\n   - ISO\u002FIMG files containing LNK payloads\n   - OneNote files with embedded scripts\n   - QR codes linking to credential harvesting pages\n2. Test payload against target's known security stack\n3. Implement payload obfuscation techniques\n4. Configure callback to C2 infrastructure\n\n### Phase 3: Infrastructure Setup\n1. Register convincing look-alike domain\n2. Age domain and build reputation (minimum 2 weeks recommended)\n3. Configure SPF, DKIM, and DMARC records\n4. Set up SMTP relay with GoPhish or custom mail server\n5. Deploy credential harvesting pages with SSL certificates\n6. Configure tracking pixels and click tracking\n\n### Phase 4: Campaign Execution\n1. Send test emails to verify delivery and rendering\n2. Launch campaign in waves (avoid mass sending)\n3. Monitor email delivery rates and opens in real-time\n4. Track link clicks and credential submissions\n5. Deploy payloads to users who interact with phishing emails\n6. Capture screenshots and evidence for reporting\n\n### Phase 5: Post-Campaign Analysis\n1. Calculate campaign metrics (delivery rate, open rate, click rate, credential capture rate)\n2. Identify users who reported phishing to SOC\n3. Document bypass of email security controls\n4. Map successful compromises to MITRE ATT&CK\n5. Compile findings for engagement report\n\n## Tools and Resources\n\n| Tool | Purpose | License |\n|------|---------|---------|\n| GoPhish | Phishing campaign management | Open Source |\n| Evilginx2 | Real-time credential harvesting with MFA bypass | Open Source |\n| King Phisher | Phishing campaign toolkit | Open Source |\n| SET (Social Engineering Toolkit) | Multi-vector social engineering | Open Source |\n| Modlishka | Reverse proxy phishing | Open Source |\n| CredSniper | Credential harvesting framework | Open Source |\n| Fierce Phish | Phishing framework | Open Source |\n\n## Validation Criteria\n\n- [ ] Pretext tailored to specific targets with OSINT data\n- [ ] Payload tested against email security controls\n- [ ] Infrastructure configured with proper email authentication\n- [ ] Campaign tracked with delivery and interaction metrics\n- [ ] Evidence collected for engagement report\n- [ ] Cleanup performed on infrastructure post-campaign\n","# Conducting Spearphishing Simulation Campaign\n\n\n> **Legal Notice:** This skill is for authorized security testing and educational purposes only. Unauthorized use against systems you do not own or have written permission to test is illegal and may violate computer fraud laws.\n\n## Overview\n\nSpearphishing simulation is a targeted social engineering attack vector used by red teams to gain initial access. Unlike broad phishing campaigns, spearphishing uses OSINT-derived intelligence to craft highly personalized messages targeting specific individuals. This skill covers developing pretexts, building payloads, setting up email infrastructure, executing the campaign, and tracking results.\n\n\n## When to Use\n\n- When conducting security assessments that involve conducting spearphishing simulation campaign\n- When following incident response procedures for related security events\n- When performing scheduled security testing or auditing activities\n- When validating security controls through hands-on testing\n\n## Prerequisites\n\n- Familiarity with red teaming concepts and tools\n- Access to a test or lab environment for safe execution\n- Python 3.8+ with required dependencies installed\n- Appropriate authorization for any testing activities\n\n## Objectives\n\n- Develop convincing pretexts tailored to specific target personnel\n- Create weaponized payloads that bypass email security controls\n- Set up email delivery infrastructure with proper SPF\u002FDKIM\u002FDMARC configuration\n- Execute phishing campaigns with real-time tracking and metrics\n- Document results for engagement reporting and security awareness improvement\n\n## MITRE ATT&CK Mapping\n\n- **T1566.001** - Phishing: Spearphishing Attachment\n- **T1566.002** - Phishing: Spearphishing Link\n- **T1566.003** - Phishing: Spearphishing via Service\n- **T1598.003** - Phishing for Information: Spearphishing Link\n- **T1204.001** - User Execution: Malicious Link\n- **T1204.002** - User Execution: Malicious File\n- **T1608.001** - Stage Capabilities: Upload Malware\n- **T1608.005** - Stage Capabilities: Link Target\n- **T1583.001** - Acquire Infrastructure: Domains\n- **T1585.002** - Establish Accounts: Email Accounts\n\n## Workflow\n\n### Phase 1: Pretext Development\n1. Review OSINT findings for target personnel profiles\n2. Identify current organizational events (mergers, projects, new hires)\n3. Select pretext theme (IT helpdesk, HR benefits, vendor communication, executive request)\n4. Craft email templates with appropriate urgency and authority cues\n5. Create landing pages that mirror target organization's branding\n\n### Phase 2: Payload Development\n1. Select payload type based on target security controls:\n   - HTML smuggling for email gateway bypass\n   - Macro-enabled documents (if macros not blocked)\n   - ISO\u002FIMG files containing LNK payloads\n   - OneNote files with embedded scripts\n   - QR codes linking to credential harvesting pages\n2. Test payload against target's known security stack\n3. Implement payload obfuscation techniques\n4. Configure callback to C2 infrastructure\n\n### Phase 3: Infrastructure Setup\n1. Register convincing look-alike domain\n2. Age domain and build reputation (minimum 2 weeks recommended)\n3. Configure SPF, DKIM, and DMARC records\n4. Set up SMTP relay with GoPhish or custom mail server\n5. Deploy credential harvesting pages with SSL certificates\n6. Configure tracking pixels and click tracking\n\n### Phase 4: Campaign Execution\n1. Send test emails to verify delivery and rendering\n2. Launch campaign in waves (avoid mass sending)\n3. Monitor email delivery rates and opens in real-time\n4. Track link clicks and credential submissions\n5. Deploy payloads to users who interact with phishing emails\n6. Capture screenshots and evidence for reporting\n\n### Phase 5: Post-Campaign Analysis\n1. Calculate campaign metrics (delivery rate, open rate, click rate, credential capture rate)\n2. Identify users who reported phishing to SOC\n3. Document bypass of email security controls\n4. Map successful compromises to MITRE ATT&CK\n5. Compile findings for engagement report\n\n## Tools and Resources\n\n| Tool | Purpose | License |\n|------|---------|---------|\n| GoPhish | Phishing campaign management | Open Source |\n| Evilginx2 | Real-time credential harvesting with MFA bypass | Open Source |\n| King Phisher | Phishing campaign toolkit | Open Source |\n| SET (Social Engineering Toolkit) | Multi-vector social engineering | Open Source |\n| Modlishka | Reverse proxy phishing | Open Source |\n| CredSniper | Credential harvesting framework | Open Source |\n| Fierce Phish | Phishing framework | Open Source |\n\n## Validation Criteria\n\n- [ ] Pretext tailored to specific targets with OSINT data\n- [ ] Payload tested against email security controls\n- [ ] Infrastructure configured with proper email authentication\n- [ ] Campaign tracked with delivery and interaction metrics\n- [ ] Evidence collected for engagement report\n- [ ] Cleanup performed on infrastructure post-campaign\n",{"name":5,"tags":44,"capec":49,"model":50,"tools":51,"domain":33,"maxTurns":55,"nist_csf":56,"subdomain":60,"description":7,"mitre_attack":61,"d3fend_techniques":66},[45,34,27,46,47,37,48],"red-team","exploitation","post-exploitation","social-engineering",[],"sonnet",[52,31,53,54],"Read","Glob","Grep",20,[57,58,59],"ID.RA-01","GV.OV-02","DE.AE-07","red-teaming",[62,63,64,65],"T1071","T1566","T1566.001","T1593",[67,68,69,70,71],"File Metadata Consistency Validation","Application Protocol Command Analysis","Identifier Analysis","Content Format Conversion","Message Analysis","main","a91f1293287ffa9f4f1b8f486cd6e835a1568c84","skills\u002Femail\u002Fphishing\u002Fspearphish\u002Fexploit","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace","https:\u002F\u002Fgithub.com\u002FDCx7C5","#Python","2026-09-01 11:21:00",{"source":8,"skillName":5,"commands":80,"prompt":90,"zipAvailable":91},[81,84,87],{"tool":82,"command":83},"npx","npx skills add DCx7C5\u002Fai-marketplace --skill phishing-spearphish-exploit",{"tool":85,"command":86},"bunx","bunx skills add DCx7C5\u002Fai-marketplace --skill phishing-spearphish-exploit",{"tool":88,"command":89},"pnpm","pnpm dlx skills add DCx7C5\u002Fai-marketplace --skill phishing-spearphish-exploit","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Femail\u002Fphishing\u002Fspearphish\u002Fexploit\u002FSKILL.md",true,[93],{"path":94,"resourceType":95,"resourceTypeDesc":96,"sizeBytes":97,"sourceHtmlUrl":98},"index.json","REFERENCE","参考文档",692,"https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Femail\u002Fphishing\u002Fspearphish\u002Fexploit\u002Findex.json",[100,124,141,162,183,199],{"skillNo":101,"name":102,"nameZh":6,"description":103,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":104,"categories":105,"keywords":106,"publishedAt":39},"01M71HAPZ01KQ30RKTB0FFSQ05","services-wmi-persistence-detect","Detect WMI event subscription persistence by enumerating ActiveScriptEventConsumer, CommandLineEventConsumer, and permanent subscriptions in the WMI repository.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fservices\u002Fwmi\u002Fpersistence\u002Fdetect\u002FSKILL.md",[],[107,108,109,110,111,24,112,113,114,115,116,117,118,119,120,121,122,33,123],"services","detect","services wmi persistence detect","wmi","persistence","cm","process","activescript","event","subscriptions","commandline-consumer","repository","subscription","event-subscription","t1546.003","forensics","process-forensics",{"skillNo":125,"name":126,"nameZh":6,"description":127,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":128,"categories":129,"keywords":130,"publishedAt":39},"01M71HAK6JTTTS229T17WJMMCG","services-wmi-exec-exploit","Perform lateral movement across Windows networks using WMI-based remote execution techniques including Impacket wmiexec.py, CrackMapExec, and native WMI commands for stealthy post-exploitation during red team engagements.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fservices\u002Fwmi\u002Fexec\u002Fexploit\u002FSKILL.md",[],[19,107,131,110,132,133,134,33,31,30,29,135,136,137,24,23,138,22,139,140],"services wmi exec exploit","exec","remote","traffic","across","crackmapexec","native","lateral movement","lateral-movement","Impacket",{"skillNo":142,"name":143,"nameZh":6,"description":144,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":145,"categories":146,"keywords":147,"publishedAt":39},"01M71HAG6MHKNQV8KDZKMT4886","registry-artifact-extract","Extract and analyze Windows Registry hives to uncover user activity, installed software, autostart entries, and evidence of system compromise.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fregistry\u002Fartifact\u002Fextract\u002FSKILL.md",[],[148,149,150,151,152,153,33,31,154,30,155,156,24,22,157,158,159,160,161,50],"artifact","registry","registry artifact extract","extract","evidence-collection","artifact-analysis","collection","analyze","uncover","software","activity","digital-forensics","windows-registry","regripper",{"skillNo":163,"name":164,"nameZh":6,"description":165,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":166,"categories":167,"keywords":168,"publishedAt":39},"01M71HACR4A8XTWTTSXK4124AA","processes-token-impersonate-detect","Detect Windows token impersonation and privilege abuse including SeImpersonatePrivilege exploitation via Potato attacks and token stealing techniques.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fprocesses\u002Ftoken\u002Fimpersonate\u002Fdetect\u002FSKILL.md",[],[108,169,170,171,172,173,174,112,175,33,123,176,177,178,179,46,180,181,182,24],"processes token impersonate detect","token","processes","attacks","windows","escalation","techniques","privilege-escalation","seimpersonate","token-impersonation","printspoofer","potato","impersonation","via",{"skillNo":184,"name":185,"nameZh":6,"description":186,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":187,"categories":188,"keywords":189,"publishedAt":39},"01M71HAABSB4Z6QFSXEG00R4RK","processes-thread-injection-detect","Detect Windows thread injection techniques including CreateRemoteThread, QueueUserAPC, NtCreateThreadEx, and thread hijacking via process memory analysis.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fprocesses\u002Fthread\u002Finjection\u002Fdetect\u002FSKILL.md",[],[190,191,108,192,171,173,193,112,194,175,33,123,30,195,196,197,198,182,24,113],"thread","processes thread injection detect","injection","memory","process-injection","api","apc-injection","thread-injection","nt-api",{"skillNo":200,"name":201,"nameZh":6,"description":202,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":203,"categories":204,"keywords":205,"publishedAt":39},"01M71HA7H311V5G14WMX58HQSS","processes-hollow-technique-detect","Detect process hollowing (RunPE) by identifying processes with mismatched image paths between PEB and VAD tree, or unmapped PE headers in memory.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fprocesses\u002Fhollow\u002Ftechnique\u002Fdetect\u002FSKILL.md",[],[206,108,171,207,193,112,208,209,33,123,210,211,212,213,214,215,24,113,216,217],"processes hollow technique detect","tree","memory-forensics","process-hollow","peb","runpe","image","pe-header","in memory","with","mismatched","headers"]