[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M71DCSMPPQP1QN6DD9PS3BF3":3,"skill-same:01M71DCSMPPQP1QN6DD9PS3BF3":61},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":18,"publishedAt":29,"linkOnly":30,"markdownContent":31,"markdownBody":32,"frontMatter":33,"refName":34,"commitSha":35,"skillDirectory":36,"forksCount":14,"repositoryHtmlUrl":37,"repositoryHomepageUrl":6,"ownerHtmlUrl":38,"ownerBlogUrl":6,"ownerDescription":39,"updatedAt":40,"install":41,"resources":54},"01M71DCSMPPQP1QN6DD9PS3BF3","ics-architecture-purdue-configure",null,"| | Purdue Model (PERA) | Hierarchical reference architecture organizing industrial networks into levels 0-5 based on function and trust | | Level 3.","DCx7C5\u002Fai-marketplace","DCx7C5","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F42419559?v=4","01M71C01G2AZV3NTNGWAWSHJPP","DC","01M71C01GQW6G50S2BYMS7PP3E",0,"MIT","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fics-architecture-purdue-configure\u002FSKILL.md",[],[19,20,21,22,23,24,25,26,27,28],"ics architecture purdue configure","configure","ics","architecture","trust","industrial networks","model","networks","reference","cybersecurity","2026-11-10 10:12:30",false,"---\nname: ics-architecture-purdue-configure\ndescription: \"| | Purdue Model (PERA) | Hierarchical reference architecture organizing industrial networks into levels 0-5 based on function and trust | | Level 3.\"\ndomain: cybersecurity\n---\n\n|\n| Purdue Model (PERA) | Hierarchical reference architecture organizing industrial networks into levels 0-5 based on function and trust |\n| Level 3.5 DMZ | Demilitarized zone between IT (Level 4) and OT (Level 3), where all cross-boundary data exchange occurs |\n| Defense in Depth | Layered security approach requiring attackers to breach multiple boundaries to reach critical control systems |\n| Data Diode | Hardware-enforced unidirectional communication device ensuring data flows only from OT to IT, never reverse |\n| Zone | Logical grouping of assets sharing common security requirements as defined by IEC 62443 |\n| Conduit | Controlled communication path between zones with defined security policies |\n\n## Common Scenarios\n\n### Scenario: Flat OT Network Remediation\n\n**Context**: An audit reveals that enterprise IT systems can directly communicate with PLCs on the control network. There is no DMZ and no firewall between IT and OT.\n\n**Approach**:\n1. Perform full traffic analysis to identify all legitimate data flows crossing IT\u002FOT boundary\n2. Design DMZ architecture with historian replica, jump server, and patch staging\n3. Deploy industrial firewall between IT and DMZ (north firewall) and between DMZ and OT (south firewall)\n4. Migrate data flows one at a time: start with historian replication through DMZ\n5. Implement jump server for remote access, deprecating direct RDP to OT systems\n6. Block direct IT-to-OT traffic on the north firewall after all flows migrate through DMZ\n7. Validate with penetration test from IT network confirming no direct path to Level 1 controllers\n\n**Pitfalls**: Do not cut over all traffic simultaneously -- migrate flow by flow with rollback plans. Legacy OT systems may use protocols that cannot traverse firewalls doing DPI; test thoroughly in a lab first. Never deploy the DMZ during active production without an agreed maintenance window.\n\n## Output Format\n\n```\nPURDUE MODEL SEGMENTATION REPORT\n====================================\nAssessment Date: YYYY-MM-DD\nFacility: [Plant Name]\n\nCURRENT STATE:\n  Network Type: [Flat\u002FPartially segmented\u002FFully segmented]\n  IT-OT Boundary: [None\u002FFirewall\u002FDMZ with dual firewall]\n  Direct IT-to-PLC paths: [count]\n\nRECOMMENDED ARCHITECTURE:\n  Level 0-1: VLAN 110 (Control Network)\n  Level 2:   VLAN 120 (Supervisory Network)\n  Level 3:   VLAN 130 (Operations Network)\n  Level 3.5: VLAN 150 (IT\u002FOT DMZ)\n  Level 4-5: VLAN 200+ (Enterprise)\n\nDMZ COMPONENTS:\n  - Historian Replica Server\n  - Jump Server (MFA-enabled)\n  - Patch Staging Server\n  - AV Relay Server\n\nFIREWALL RULES: [count] rules generated\nMIGRATION STEPS: [count] phases planned\n```\n","|\n| Purdue Model (PERA) | Hierarchical reference architecture organizing industrial networks into levels 0-5 based on function and trust |\n| Level 3.5 DMZ | Demilitarized zone between IT (Level 4) and OT (Level 3), where all cross-boundary data exchange occurs |\n| Defense in Depth | Layered security approach requiring attackers to breach multiple boundaries to reach critical control systems |\n| Data Diode | Hardware-enforced unidirectional communication device ensuring data flows only from OT to IT, never reverse |\n| Zone | Logical grouping of assets sharing common security requirements as defined by IEC 62443 |\n| Conduit | Controlled communication path between zones with defined security policies |\n\n## Common Scenarios\n\n### Scenario: Flat OT Network Remediation\n\n**Context**: An audit reveals that enterprise IT systems can directly communicate with PLCs on the control network. There is no DMZ and no firewall between IT and OT.\n\n**Approach**:\n1. Perform full traffic analysis to identify all legitimate data flows crossing IT\u002FOT boundary\n2. Design DMZ architecture with historian replica, jump server, and patch staging\n3. Deploy industrial firewall between IT and DMZ (north firewall) and between DMZ and OT (south firewall)\n4. Migrate data flows one at a time: start with historian replication through DMZ\n5. Implement jump server for remote access, deprecating direct RDP to OT systems\n6. Block direct IT-to-OT traffic on the north firewall after all flows migrate through DMZ\n7. Validate with penetration test from IT network confirming no direct path to Level 1 controllers\n\n**Pitfalls**: Do not cut over all traffic simultaneously -- migrate flow by flow with rollback plans. Legacy OT systems may use protocols that cannot traverse firewalls doing DPI; test thoroughly in a lab first. Never deploy the DMZ during active production without an agreed maintenance window.\n\n## Output Format\n\n```\nPURDUE MODEL SEGMENTATION REPORT\n====================================\nAssessment Date: YYYY-MM-DD\nFacility: [Plant Name]\n\nCURRENT STATE:\n  Network Type: [Flat\u002FPartially segmented\u002FFully segmented]\n  IT-OT Boundary: [None\u002FFirewall\u002FDMZ with dual firewall]\n  Direct IT-to-PLC paths: [count]\n\nRECOMMENDED ARCHITECTURE:\n  Level 0-1: VLAN 110 (Control Network)\n  Level 2:   VLAN 120 (Supervisory Network)\n  Level 3:   VLAN 130 (Operations Network)\n  Level 3.5: VLAN 150 (IT\u002FOT DMZ)\n  Level 4-5: VLAN 200+ (Enterprise)\n\nDMZ COMPONENTS:\n  - Historian Replica Server\n  - Jump Server (MFA-enabled)\n  - Patch Staging Server\n  - AV Relay Server\n\nFIREWALL RULES: [count] rules generated\nMIGRATION STEPS: [count] phases planned\n```\n",{"name":5,"domain":28,"description":7},"main","a91f1293287ffa9f4f1b8f486cd6e835a1568c84","skills\u002Fics-architecture-purdue-configure","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace","https:\u002F\u002Fgithub.com\u002FDCx7C5","#Python","2026-09-01 11:21:00",{"source":8,"skillName":5,"commands":42,"prompt":52,"zipAvailable":53},[43,46,49],{"tool":44,"command":45},"npx","npx skills add DCx7C5\u002Fai-marketplace --skill ics-architecture-purdue-configure",{"tool":47,"command":48},"bunx","bunx skills add DCx7C5\u002Fai-marketplace --skill ics-architecture-purdue-configure",{"tool":50,"command":51},"pnpm","pnpm dlx skills add DCx7C5\u002Fai-marketplace --skill ics-architecture-purdue-configure","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fics-architecture-purdue-configure\u002FSKILL.md",true,[55],{"path":56,"resourceType":57,"resourceTypeDesc":58,"sizeBytes":59,"sourceHtmlUrl":60},"index.json","REFERENCE","参考文档",647,"https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fics-architecture-purdue-configure\u002Findex.json",[62,87,110,132,154,170],{"skillNo":63,"name":64,"nameZh":6,"description":65,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":66,"categories":67,"keywords":68,"publishedAt":29},"01M71HAPZ01KQ30RKTB0FFSQ05","services-wmi-persistence-detect","Detect WMI event subscription persistence by enumerating ActiveScriptEventConsumer, CommandLineEventConsumer, and permanent subscriptions in the WMI repository.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fservices\u002Fwmi\u002Fpersistence\u002Fdetect\u002FSKILL.md",[],[69,70,71,72,73,74,75,76,77,78,79,80,81,82,83,84,85,28,86],"services","detect","services wmi persistence detect","wmi","persistence","de","cm","process","activescript","event","subscriptions","commandline-consumer","repository","subscription","event-subscription","t1546.003","forensics","process-forensics",{"skillNo":88,"name":89,"nameZh":6,"description":90,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":91,"categories":92,"keywords":93,"publishedAt":29},"01M71HAK6JTTTS229T17WJMMCG","services-wmi-exec-exploit","Perform lateral movement across Windows networks using WMI-based remote execution techniques including Impacket wmiexec.py, CrackMapExec, and native WMI commands for stealthy post-exploitation during red team engagements.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fservices\u002Fwmi\u002Fexec\u002Fexploit\u002FSKILL.md",[],[94,69,95,72,96,97,98,28,99,100,101,102,103,104,74,105,106,107,108,109],"exploit","services wmi exec exploit","exec","remote","traffic","Bash","analysis","team","across","crackmapexec","native","command","lateral movement","read","lateral-movement","Impacket",{"skillNo":111,"name":112,"nameZh":6,"description":113,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":114,"categories":115,"keywords":116,"publishedAt":29},"01M71HAG6MHKNQV8KDZKMT4886","registry-artifact-extract","Extract and analyze Windows Registry hives to uncover user activity, installed software, autostart entries, and evidence of system compromise.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fregistry\u002Fartifact\u002Fextract\u002FSKILL.md",[],[117,118,119,120,121,122,28,99,123,100,124,125,74,107,126,127,128,129,130,131],"artifact","registry","registry artifact extract","extract","evidence-collection","artifact-analysis","collection","analyze","uncover","software","activity","digital-forensics","windows-registry","regripper","sonnet",{"skillNo":133,"name":134,"nameZh":6,"description":135,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":136,"categories":137,"keywords":138,"publishedAt":29},"01M71HACR4A8XTWTTSXK4124AA","processes-token-impersonate-detect","Detect Windows token impersonation and privilege abuse including SeImpersonatePrivilege exploitation via Potato attacks and token stealing techniques.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fprocesses\u002Ftoken\u002Fimpersonate\u002Fdetect\u002FSKILL.md",[],[70,139,140,141,142,143,144,75,145,28,86,146,147,148,149,150,151,152,153,74],"processes token impersonate detect","token","processes","attacks","windows","escalation","techniques","privilege-escalation","seimpersonate","token-impersonation","printspoofer","exploitation","potato","impersonation","via",{"skillNo":155,"name":156,"nameZh":6,"description":157,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":158,"categories":159,"keywords":160,"publishedAt":29},"01M71HAABSB4Z6QFSXEG00R4RK","processes-thread-injection-detect","Detect Windows thread injection techniques including CreateRemoteThread, QueueUserAPC, NtCreateThreadEx, and thread hijacking via process memory analysis.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fprocesses\u002Fthread\u002Finjection\u002Fdetect\u002FSKILL.md",[],[161,162,70,163,141,143,164,75,165,145,28,86,100,166,167,168,169,153,74,76],"thread","processes thread injection detect","injection","memory","process-injection","api","apc-injection","thread-injection","nt-api",{"skillNo":171,"name":172,"nameZh":6,"description":173,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":174,"categories":175,"keywords":176,"publishedAt":29},"01M71HA7H311V5G14WMX58HQSS","processes-hollow-technique-detect","Detect process hollowing (RunPE) by identifying processes with mismatched image paths between PEB and VAD tree, or unmapped PE headers in memory.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fprocesses\u002Fhollow\u002Ftechnique\u002Fdetect\u002FSKILL.md",[],[177,70,141,178,164,75,179,180,28,86,181,182,183,184,185,186,74,76,187,188],"processes hollow technique detect","tree","memory-forensics","process-hollow","peb","runpe","image","pe-header","in memory","with","mismatched","headers"]