[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M71DC744RHNKVZ6EBSAV08WJ":3,"skill-same:01M71DC744RHNKVZ6EBSAV08WJ":91},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":18,"publishedAt":39,"linkOnly":40,"markdownContent":41,"markdownBody":42,"frontMatter":43,"refName":64,"commitSha":65,"skillDirectory":66,"forksCount":14,"repositoryHtmlUrl":67,"repositoryHomepageUrl":6,"ownerHtmlUrl":68,"ownerBlogUrl":6,"ownerDescription":69,"updatedAt":70,"install":71,"resources":84},"01M71DC744RHNKVZ6EBSAV08WJ","phishing-training-simulate",null,"Security awareness training is the human layer of phishing defense. An effective anti-phishing training program combines regular simulations, interactive learning modules, metric tracking, and positiv","DCx7C5\u002Fai-marketplace","DCx7C5","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F42419559?v=4","01M71C01G2AZV3NTNGWAWSHJPP","DC","01M71C01GQW6G50S2BYMS7PP3E",0,"MIT","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Femail\u002Fphishing\u002Ftraining\u002Fsimulate\u002FSKILL.md",[],[19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38],"phishing training simulate","phishing","simulate","training","dmarc","Simulations","read","at","co","human","de","program","Bash","cybersecurity","culture","social","training program","cm","t1566","modules","2026-11-10 10:12:30",false,"---\nname: phishing-training-simulate\ndescription: Security awareness training is the human layer of phishing defense. An effective anti-phishing training program combines regular simulations, interactive learning modules, metric tracking, and positiv\ndomain: cybersecurity\nsubdomain: phishing-defense\ntags:\n- phishing\n- email-security\n- social-engineering\n- dmarc\n- awareness\n- training\n- security-culture\nnist_csf:\n- PR.AT-01\n- DE.CM-09\n- RS.CO-02\n- DE.AE-02\nmodel: sonnet\nmaxTurns: 20\ntools: [Read, Bash, Glob, Grep]\nmitre_attack:\n- T1566\ncapec: []\n---\n\n# Implementing Anti-Phishing Training Program\n\n## Overview\nSecurity awareness training is the human layer of phishing defense. An effective anti-phishing training program combines regular simulations, interactive learning modules, metric tracking, and positive reinforcement to build a security-conscious culture. This skill covers designing, deploying, and measuring a comprehensive phishing awareness program using platforms like KnowBe4, Proofpoint Security Awareness, and open-source alternatives.\n\n\n## When to Use\n\n- When deploying or configuring implementing anti phishing training program capabilities in your environment\n- When establishing security controls aligned to compliance requirements\n- When building or improving security architecture for this domain\n- When conducting security assessments that require this implementation\n\n## Prerequisites\n- Management buy-in and budget approval\n- Security awareness training platform (KnowBe4, Proofpoint SAT, Cofense)\n- Employee email list and organizational structure\n- Baseline phishing susceptibility data (from initial simulation)\n- Learning management system (LMS) integration capability\n\n## Key Concepts\n\n### Training Program Pillars\n1. **Baseline Assessment**: Initial phishing simulation to measure current susceptibility\n2. **Interactive Training**: Role-based modules covering phishing identification\n3. **Regular Simulations**: Monthly\u002Fquarterly phishing tests with progressive difficulty\n4. **Just-in-Time Learning**: Immediate training after a user fails a simulation\n5. **Positive Reinforcement**: Recognition for reporting phishing correctly\n6. **Metrics & Reporting**: Track improvement over time by department and role\n\n### SANS Security Awareness Maturity Model\n- **Level 1**: Non-existent - No program\n- **Level 2**: Compliance-focused - Annual checkbox training\n- **Level 3**: Promoting Awareness - Engaging, regular content\n- **Level 4**: Long-term Sustainment - Continuous program with culture change\n- **Level 5**: Metrics Framework - Risk-based measurement and optimization\n\n## Workflow\n\n### Step 1: Establish Baseline\n- Run initial phishing simulation across all departments\n- Measure click rate, submit rate, and report rate\n- Identify high-risk departments and roles\n\n### Step 2: Design Curriculum\n- **General awareness**: Phishing identification basics for all employees\n- **Role-specific**: Finance (BEC\u002Fwire fraud), IT (credential phishing), Executives (whaling)\n- **Progressive difficulty**: Beginner, intermediate, advanced modules\n- **Micro-learning**: Short (3-5 minute) frequent sessions vs. annual marathon\n\n### Step 3: Deploy Training Platform\n- Configure KnowBe4\u002FProofpoint SAT with organizational groups\n- Set up automated enrollment workflows\n- Integrate with LMS for completion tracking\n- Configure reporting dashboards\n\n### Step 4: Run Continuous Simulations\n- Monthly simulations with varied scenarios\n- Increase difficulty based on organizational performance\n- Include diverse attack types: links, attachments, QR codes, BEC\n\n### Step 5: Measure and Optimize\nUse `scripts\u002Fprocess.py` to analyze training completion, simulation results, and program effectiveness over time.\n\n## Tools & Resources\n- **KnowBe4**: https:\u002F\u002Fwww.knowbe4.com\u002F\n- **Proofpoint Security Awareness**: https:\u002F\u002Fwww.proofpoint.com\u002Fus\u002Fproducts\u002Fsecurity-awareness-training\n- **Cofense PhishMe**: https:\u002F\u002Fcofense.com\u002F\n- **SANS Security Awareness**: https:\u002F\u002Fwww.sans.org\u002Fsecurity-awareness-training\u002F\n- **Terranova Security**: https:\u002F\u002Fterranovasecurity.com\u002F\n\n## Validation\n- 90%+ training completion rate across organization\n- Measurable reduction in phishing click rate over 6 months\n- Increase in user phishing report rate\n- Department-level improvement tracking\n","# Implementing Anti-Phishing Training Program\n\n## Overview\nSecurity awareness training is the human layer of phishing defense. An effective anti-phishing training program combines regular simulations, interactive learning modules, metric tracking, and positive reinforcement to build a security-conscious culture. This skill covers designing, deploying, and measuring a comprehensive phishing awareness program using platforms like KnowBe4, Proofpoint Security Awareness, and open-source alternatives.\n\n\n## When to Use\n\n- When deploying or configuring implementing anti phishing training program capabilities in your environment\n- When establishing security controls aligned to compliance requirements\n- When building or improving security architecture for this domain\n- When conducting security assessments that require this implementation\n\n## Prerequisites\n- Management buy-in and budget approval\n- Security awareness training platform (KnowBe4, Proofpoint SAT, Cofense)\n- Employee email list and organizational structure\n- Baseline phishing susceptibility data (from initial simulation)\n- Learning management system (LMS) integration capability\n\n## Key Concepts\n\n### Training Program Pillars\n1. **Baseline Assessment**: Initial phishing simulation to measure current susceptibility\n2. **Interactive Training**: Role-based modules covering phishing identification\n3. **Regular Simulations**: Monthly\u002Fquarterly phishing tests with progressive difficulty\n4. **Just-in-Time Learning**: Immediate training after a user fails a simulation\n5. **Positive Reinforcement**: Recognition for reporting phishing correctly\n6. **Metrics & Reporting**: Track improvement over time by department and role\n\n### SANS Security Awareness Maturity Model\n- **Level 1**: Non-existent - No program\n- **Level 2**: Compliance-focused - Annual checkbox training\n- **Level 3**: Promoting Awareness - Engaging, regular content\n- **Level 4**: Long-term Sustainment - Continuous program with culture change\n- **Level 5**: Metrics Framework - Risk-based measurement and optimization\n\n## Workflow\n\n### Step 1: Establish Baseline\n- Run initial phishing simulation across all departments\n- Measure click rate, submit rate, and report rate\n- Identify high-risk departments and roles\n\n### Step 2: Design Curriculum\n- **General awareness**: Phishing identification basics for all employees\n- **Role-specific**: Finance (BEC\u002Fwire fraud), IT (credential phishing), Executives (whaling)\n- **Progressive difficulty**: Beginner, intermediate, advanced modules\n- **Micro-learning**: Short (3-5 minute) frequent sessions vs. annual marathon\n\n### Step 3: Deploy Training Platform\n- Configure KnowBe4\u002FProofpoint SAT with organizational groups\n- Set up automated enrollment workflows\n- Integrate with LMS for completion tracking\n- Configure reporting dashboards\n\n### Step 4: Run Continuous Simulations\n- Monthly simulations with varied scenarios\n- Increase difficulty based on organizational performance\n- Include diverse attack types: links, attachments, QR codes, BEC\n\n### Step 5: Measure and Optimize\nUse `scripts\u002Fprocess.py` to analyze training completion, simulation results, and program effectiveness over time.\n\n## Tools & Resources\n- **KnowBe4**: https:\u002F\u002Fwww.knowbe4.com\u002F\n- **Proofpoint Security Awareness**: https:\u002F\u002Fwww.proofpoint.com\u002Fus\u002Fproducts\u002Fsecurity-awareness-training\n- **Cofense PhishMe**: https:\u002F\u002Fcofense.com\u002F\n- **SANS Security Awareness**: https:\u002F\u002Fwww.sans.org\u002Fsecurity-awareness-training\u002F\n- **Terranova Security**: https:\u002F\u002Fterranovasecurity.com\u002F\n\n## Validation\n- 90%+ training completion rate across organization\n- Measurable reduction in phishing click rate over 6 months\n- Increase in user phishing report rate\n- Department-level improvement tracking\n",{"name":5,"tags":44,"capec":49,"model":50,"tools":51,"domain":32,"maxTurns":55,"nist_csf":56,"subdomain":61,"description":7,"mitre_attack":62},[20,45,46,23,47,22,48],"email-security","social-engineering","awareness","security-culture",[],"sonnet",[52,31,53,54],"Read","Glob","Grep",20,[57,58,59,60],"PR.AT-01","DE.CM-09","RS.CO-02","DE.AE-02","phishing-defense",[63],"T1566","main","a91f1293287ffa9f4f1b8f486cd6e835a1568c84","skills\u002Femail\u002Fphishing\u002Ftraining\u002Fsimulate","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace","https:\u002F\u002Fgithub.com\u002FDCx7C5","#Python","2026-09-01 11:21:00",{"source":8,"skillName":5,"commands":72,"prompt":82,"zipAvailable":83},[73,76,79],{"tool":74,"command":75},"npx","npx skills add DCx7C5\u002Fai-marketplace --skill phishing-training-simulate",{"tool":77,"command":78},"bunx","bunx skills add DCx7C5\u002Fai-marketplace --skill phishing-training-simulate",{"tool":80,"command":81},"pnpm","pnpm dlx skills add DCx7C5\u002Fai-marketplace --skill phishing-training-simulate","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Femail\u002Fphishing\u002Ftraining\u002Fsimulate\u002FSKILL.md",true,[85],{"path":86,"resourceType":87,"resourceTypeDesc":88,"sizeBytes":89,"sourceHtmlUrl":90},"index.json","REFERENCE","参考文档",689,"https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Femail\u002Fphishing\u002Ftraining\u002Fsimulate\u002Findex.json",[92,115,136,157,179,195],{"skillNo":93,"name":94,"nameZh":6,"description":95,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":96,"categories":97,"keywords":98,"publishedAt":39},"01M71HAPZ01KQ30RKTB0FFSQ05","services-wmi-persistence-detect","Detect WMI event subscription persistence by enumerating ActiveScriptEventConsumer, CommandLineEventConsumer, and permanent subscriptions in the WMI repository.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fservices\u002Fwmi\u002Fpersistence\u002Fdetect\u002FSKILL.md",[],[99,100,101,102,103,29,36,104,105,106,107,108,109,110,111,112,113,32,114],"services","detect","services wmi persistence detect","wmi","persistence","process","activescript","event","subscriptions","commandline-consumer","repository","subscription","event-subscription","t1546.003","forensics","process-forensics",{"skillNo":116,"name":117,"nameZh":6,"description":118,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":119,"categories":120,"keywords":121,"publishedAt":39},"01M71HAK6JTTTS229T17WJMMCG","services-wmi-exec-exploit","Perform lateral movement across Windows networks using WMI-based remote execution techniques including Impacket wmiexec.py, CrackMapExec, and native WMI commands for stealthy post-exploitation during red team engagements.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fservices\u002Fwmi\u002Fexec\u002Fexploit\u002FSKILL.md",[],[122,99,123,102,124,125,126,32,31,127,128,129,130,131,29,132,133,25,134,135],"exploit","services wmi exec exploit","exec","remote","traffic","analysis","team","across","crackmapexec","native","command","lateral movement","lateral-movement","Impacket",{"skillNo":137,"name":138,"nameZh":6,"description":139,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":140,"categories":141,"keywords":142,"publishedAt":39},"01M71HAG6MHKNQV8KDZKMT4886","registry-artifact-extract","Extract and analyze Windows Registry hives to uncover user activity, installed software, autostart entries, and evidence of system compromise.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fregistry\u002Fartifact\u002Fextract\u002FSKILL.md",[],[143,144,145,146,147,148,32,31,149,127,150,151,29,25,152,153,154,155,156,50],"artifact","registry","registry artifact extract","extract","evidence-collection","artifact-analysis","collection","analyze","uncover","software","activity","digital-forensics","windows-registry","regripper",{"skillNo":158,"name":159,"nameZh":6,"description":160,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":161,"categories":162,"keywords":163,"publishedAt":39},"01M71HACR4A8XTWTTSXK4124AA","processes-token-impersonate-detect","Detect Windows token impersonation and privilege abuse including SeImpersonatePrivilege exploitation via Potato attacks and token stealing techniques.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fprocesses\u002Ftoken\u002Fimpersonate\u002Fdetect\u002FSKILL.md",[],[100,164,165,166,167,168,169,36,170,32,114,171,172,173,174,175,176,177,178,29],"processes token impersonate detect","token","processes","attacks","windows","escalation","techniques","privilege-escalation","seimpersonate","token-impersonation","printspoofer","exploitation","potato","impersonation","via",{"skillNo":180,"name":181,"nameZh":6,"description":182,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":183,"categories":184,"keywords":185,"publishedAt":39},"01M71HAABSB4Z6QFSXEG00R4RK","processes-thread-injection-detect","Detect Windows thread injection techniques including CreateRemoteThread, QueueUserAPC, NtCreateThreadEx, and thread hijacking via process memory analysis.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fprocesses\u002Fthread\u002Finjection\u002Fdetect\u002FSKILL.md",[],[186,187,100,188,166,168,189,36,190,170,32,114,127,191,192,193,194,178,29,104],"thread","processes thread injection detect","injection","memory","process-injection","api","apc-injection","thread-injection","nt-api",{"skillNo":196,"name":197,"nameZh":6,"description":198,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":199,"categories":200,"keywords":201,"publishedAt":39},"01M71HA7H311V5G14WMX58HQSS","processes-hollow-technique-detect","Detect process hollowing (RunPE) by identifying processes with mismatched image paths between PEB and VAD tree, or unmapped PE headers in memory.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fprocesses\u002Fhollow\u002Ftechnique\u002Fdetect\u002FSKILL.md",[],[202,100,166,203,189,36,204,205,32,114,206,207,208,209,210,211,29,104,212,213],"processes hollow technique detect","tree","memory-forensics","process-hollow","peb","runpe","image","pe-header","in memory","with","mismatched","headers"]