[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M71DDMDR6DPF0KN28BKB96W5":3,"skill-same:01M71DDMDR6DPF0KN28BKB96W5":73},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":18,"publishedAt":24,"linkOnly":25,"markdownContent":26,"markdownBody":27,"frontMatter":28,"refName":29,"commitSha":30,"skillDirectory":31,"forksCount":14,"repositoryHtmlUrl":32,"repositoryHomepageUrl":6,"ownerHtmlUrl":33,"ownerBlogUrl":6,"ownerDescription":34,"updatedAt":35,"install":36,"resources":49},"01M71DDMDR6DPF0KN28BKB96W5","ics-protocols-modbus",null,"Ics Ics Protocols Modbus.","DCx7C5\u002Fai-marketplace","DCx7C5","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F42419559?v=4","01M71C01G2AZV3NTNGWAWSHJPP","DC","01M71C01GQW6G50S2BYMS7PP3E",0,"MIT","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fics-protocols-modbus\u002FSKILL.md",[],[19,20,21,22,23],"protocols","ics","modbus","ics protocols modbus","cybersecurity","2026-11-10 10:12:30",false,"---\nname: ics-protocols-modbus\ndescription: \"Ics Ics Protocols Modbus.\"\ndomain: cybersecurity\n---\n\n|\n| Modbus TCP | Industrial protocol operating on TCP port 502, lacking authentication or encryption, making it vulnerable to command injection |\n| Function Code | Single byte in Modbus PDU specifying the operation (read coils, write registers, diagnostics); monitoring for unauthorized function codes is key to detection |\n| MBAP Header | Modbus Application Protocol header in TCP variant containing transaction ID, protocol ID, length, and unit ID |\n| FrostyGoop | First known malware using Modbus TCP for real-world operational impact, disrupted Ukrainian district heating in 2024 |\n| Unit ID | Address of the target Modbus slave device; Unit ID 0 is a broadcast affecting all slaves |\n| Register Range | Specific memory addresses in the PLC; legitimate operations access known ranges; out-of-range access indicates reconnaissance or manipulation |\n\n## Common Scenarios\n\n### Scenario: FrostyGoop-Style Heating Control Attack\n\n**Context**: A building automation system uses Modbus TCP to control HVAC equipment. Monitoring detects unexpected write commands to heating control registers from an IP not associated with any authorized BMS controller.\n\n**Approach**:\n1. Verify the source IP against the authorized Modbus master list\n2. Check if any authorized maintenance or configuration change is in progress\n3. Capture full Modbus transaction including register addresses and values being written\n4. Compare written values against safe operating ranges for the heating equipment\n5. If unauthorized, immediately block the source IP at the industrial firewall\n6. Inspect the source device for compromise indicators (malware, unauthorized remote access)\n7. Verify current setpoints on all affected controllers against known-good values\n8. Restore safe setpoints if manipulation is confirmed\n\n**Pitfalls**: Modbus lacks authentication, so the source IP is the only identifier -- attackers can spoof IPs if ARP protections are not in place. Do not assume all writes are malicious; legitimate SCADA operations include writes. Always verify against the change management log before escalating.\n\n## Output Format\n\n```\nMODBUS INJECTION DETECTION REPORT\n====================================\nAnalysis Period: [start] to [end]\nMonitoring Point: [interface\u002FSPAN description]\n\nTRAFFIC SUMMARY:\n  Total Modbus Packets: [count]\n  Read Operations: [count]\n  Write Operations: [count]\n  Unauthorized Writes Detected: [count]\n\nALERTS:\n  [CRITICAL] Unauthorized write from [IP] to PLC [IP]\n    Function: Write Multiple Registers (FC 16)\n    Registers: [start]-[end]\n    MITRE: T0855 - Unauthorized Command Message\n\nBASELINE DEVIATIONS:\n  New Modbus masters: [list]\n  Unusual function codes: [list]\n  Out-of-range register access: [list]\n\nRECOMMENDED ACTIONS:\n  1. Verify source [IP] authorization status\n  2. Block unauthorized sources at industrial firewall\n  3. Validate PLC register values against known-good state\n```\n","|\n| Modbus TCP | Industrial protocol operating on TCP port 502, lacking authentication or encryption, making it vulnerable to command injection |\n| Function Code | Single byte in Modbus PDU specifying the operation (read coils, write registers, diagnostics); monitoring for unauthorized function codes is key to detection |\n| MBAP Header | Modbus Application Protocol header in TCP variant containing transaction ID, protocol ID, length, and unit ID |\n| FrostyGoop | First known malware using Modbus TCP for real-world operational impact, disrupted Ukrainian district heating in 2024 |\n| Unit ID | Address of the target Modbus slave device; Unit ID 0 is a broadcast affecting all slaves |\n| Register Range | Specific memory addresses in the PLC; legitimate operations access known ranges; out-of-range access indicates reconnaissance or manipulation |\n\n## Common Scenarios\n\n### Scenario: FrostyGoop-Style Heating Control Attack\n\n**Context**: A building automation system uses Modbus TCP to control HVAC equipment. Monitoring detects unexpected write commands to heating control registers from an IP not associated with any authorized BMS controller.\n\n**Approach**:\n1. Verify the source IP against the authorized Modbus master list\n2. Check if any authorized maintenance or configuration change is in progress\n3. Capture full Modbus transaction including register addresses and values being written\n4. Compare written values against safe operating ranges for the heating equipment\n5. If unauthorized, immediately block the source IP at the industrial firewall\n6. Inspect the source device for compromise indicators (malware, unauthorized remote access)\n7. Verify current setpoints on all affected controllers against known-good values\n8. Restore safe setpoints if manipulation is confirmed\n\n**Pitfalls**: Modbus lacks authentication, so the source IP is the only identifier -- attackers can spoof IPs if ARP protections are not in place. Do not assume all writes are malicious; legitimate SCADA operations include writes. Always verify against the change management log before escalating.\n\n## Output Format\n\n```\nMODBUS INJECTION DETECTION REPORT\n====================================\nAnalysis Period: [start] to [end]\nMonitoring Point: [interface\u002FSPAN description]\n\nTRAFFIC SUMMARY:\n  Total Modbus Packets: [count]\n  Read Operations: [count]\n  Write Operations: [count]\n  Unauthorized Writes Detected: [count]\n\nALERTS:\n  [CRITICAL] Unauthorized write from [IP] to PLC [IP]\n    Function: Write Multiple Registers (FC 16)\n    Registers: [start]-[end]\n    MITRE: T0855 - Unauthorized Command Message\n\nBASELINE DEVIATIONS:\n  New Modbus masters: [list]\n  Unusual function codes: [list]\n  Out-of-range register access: [list]\n\nRECOMMENDED ACTIONS:\n  1. Verify source [IP] authorization status\n  2. Block unauthorized sources at industrial firewall\n  3. Validate PLC register values against known-good state\n```\n",{"name":5,"domain":23,"description":7},"main","a91f1293287ffa9f4f1b8f486cd6e835a1568c84","skills\u002Fics-protocols-modbus","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace","https:\u002F\u002Fgithub.com\u002FDCx7C5","#Python","2026-09-01 11:21:00",{"source":8,"skillName":5,"commands":37,"prompt":47,"zipAvailable":48},[38,41,44],{"tool":39,"command":40},"npx","npx skills add DCx7C5\u002Fai-marketplace --skill ics-protocols-modbus",{"tool":42,"command":43},"bunx","bunx skills add DCx7C5\u002Fai-marketplace --skill ics-protocols-modbus",{"tool":45,"command":46},"pnpm","pnpm dlx skills add DCx7C5\u002Fai-marketplace --skill ics-protocols-modbus","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fics-protocols-modbus\u002FSKILL.md",true,[50,56,60,64,70],{"path":51,"resourceType":52,"resourceTypeDesc":53,"sizeBytes":54,"sourceHtmlUrl":55},"index.json","REFERENCE","参考文档",1080,"https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fics-protocols-modbus\u002Findex.json",{"path":57,"resourceType":52,"resourceTypeDesc":53,"sizeBytes":58,"sourceHtmlUrl":59},"references\u002Fapi-reference.md",1636,"https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fics-protocols-modbus\u002Freferences\u002Fapi-reference.md",{"path":61,"resourceType":52,"resourceTypeDesc":53,"sizeBytes":62,"sourceHtmlUrl":63},"references\u002Findex.json",84,"https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fics-protocols-modbus\u002Freferences\u002Findex.json",{"path":65,"resourceType":66,"resourceTypeDesc":67,"sizeBytes":68,"sourceHtmlUrl":69},"scripts\u002Fagent.py","SCRIPT","脚本",5239,"https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fics-protocols-modbus\u002Fscripts\u002Fagent.py",{"path":71,"resourceType":66,"resourceTypeDesc":67,"sizeBytes":62,"sourceHtmlUrl":72},"scripts\u002Findex.json","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fics-protocols-modbus\u002Fscripts\u002Findex.json",[74,99,122,144,166,182],{"skillNo":75,"name":76,"nameZh":6,"description":77,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":78,"categories":79,"keywords":80,"publishedAt":24},"01M71HAPZ01KQ30RKTB0FFSQ05","services-wmi-persistence-detect","Detect WMI event subscription persistence by enumerating ActiveScriptEventConsumer, CommandLineEventConsumer, and permanent subscriptions in the WMI repository.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fservices\u002Fwmi\u002Fpersistence\u002Fdetect\u002FSKILL.md",[],[81,82,83,84,85,86,87,88,89,90,91,92,93,94,95,96,97,23,98],"services","detect","services wmi persistence detect","wmi","persistence","de","cm","process","activescript","event","subscriptions","commandline-consumer","repository","subscription","event-subscription","t1546.003","forensics","process-forensics",{"skillNo":100,"name":101,"nameZh":6,"description":102,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":103,"categories":104,"keywords":105,"publishedAt":24},"01M71HAK6JTTTS229T17WJMMCG","services-wmi-exec-exploit","Perform lateral movement across Windows networks using WMI-based remote execution techniques including Impacket wmiexec.py, CrackMapExec, and native WMI commands for stealthy post-exploitation during red team engagements.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fservices\u002Fwmi\u002Fexec\u002Fexploit\u002FSKILL.md",[],[106,81,107,84,108,109,110,23,111,112,113,114,115,116,86,117,118,119,120,121],"exploit","services wmi exec exploit","exec","remote","traffic","Bash","analysis","team","across","crackmapexec","native","command","lateral movement","read","lateral-movement","Impacket",{"skillNo":123,"name":124,"nameZh":6,"description":125,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":126,"categories":127,"keywords":128,"publishedAt":24},"01M71HAG6MHKNQV8KDZKMT4886","registry-artifact-extract","Extract and analyze Windows Registry hives to uncover user activity, installed software, autostart entries, and evidence of system compromise.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fregistry\u002Fartifact\u002Fextract\u002FSKILL.md",[],[129,130,131,132,133,134,23,111,135,112,136,137,86,119,138,139,140,141,142,143],"artifact","registry","registry artifact extract","extract","evidence-collection","artifact-analysis","collection","analyze","uncover","software","activity","digital-forensics","windows-registry","regripper","sonnet",{"skillNo":145,"name":146,"nameZh":6,"description":147,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":148,"categories":149,"keywords":150,"publishedAt":24},"01M71HACR4A8XTWTTSXK4124AA","processes-token-impersonate-detect","Detect Windows token impersonation and privilege abuse including SeImpersonatePrivilege exploitation via Potato attacks and token stealing techniques.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fprocesses\u002Ftoken\u002Fimpersonate\u002Fdetect\u002FSKILL.md",[],[82,151,152,153,154,155,156,87,157,23,98,158,159,160,161,162,163,164,165,86],"processes token impersonate detect","token","processes","attacks","windows","escalation","techniques","privilege-escalation","seimpersonate","token-impersonation","printspoofer","exploitation","potato","impersonation","via",{"skillNo":167,"name":168,"nameZh":6,"description":169,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":170,"categories":171,"keywords":172,"publishedAt":24},"01M71HAABSB4Z6QFSXEG00R4RK","processes-thread-injection-detect","Detect Windows thread injection techniques including CreateRemoteThread, QueueUserAPC, NtCreateThreadEx, and thread hijacking via process memory analysis.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fprocesses\u002Fthread\u002Finjection\u002Fdetect\u002FSKILL.md",[],[173,174,82,175,153,155,176,87,177,157,23,98,112,178,179,180,181,165,86,88],"thread","processes thread injection detect","injection","memory","process-injection","api","apc-injection","thread-injection","nt-api",{"skillNo":183,"name":184,"nameZh":6,"description":185,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":186,"categories":187,"keywords":188,"publishedAt":24},"01M71HA7H311V5G14WMX58HQSS","processes-hollow-technique-detect","Detect process hollowing (RunPE) by identifying processes with mismatched image paths between PEB and VAD tree, or unmapped PE headers in memory.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fprocesses\u002Fhollow\u002Ftechnique\u002Fdetect\u002FSKILL.md",[],[189,82,153,190,176,87,191,192,23,98,193,194,195,196,197,198,86,88,199,200],"processes hollow technique detect","tree","memory-forensics","process-hollow","peb","runpe","image","pe-header","in memory","with","mismatched","headers"]