[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M71DFJSYTCQ0293H6P4VCMV0":3,"skill-same:01M71DFJSYTCQ0293H6P4VCMV0":56},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":18,"publishedAt":24,"linkOnly":25,"markdownContent":26,"markdownBody":27,"frontMatter":28,"refName":29,"commitSha":30,"skillDirectory":31,"forksCount":14,"repositoryHtmlUrl":32,"repositoryHomepageUrl":6,"ownerHtmlUrl":33,"ownerBlogUrl":6,"ownerDescription":34,"updatedAt":35,"install":36,"resources":49},"01M71DFJSYTCQ0293H6P4VCMV0","identity-insider-investigation",null,"Identity Insider Investigation.","DCx7C5\u002Fai-marketplace","DCx7C5","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F42419559?v=4","01M71C01G2AZV3NTNGWAWSHJPP","DC","01M71C01GQW6G50S2BYMS7PP3E",0,"MIT","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fidentity-insider-investigation\u002FSKILL.md",[],[19,20,21,22,23],"identity","investigation","insider","identity insider investigation","cybersecurity","2026-11-10 10:12:30",false,"---\nname: identity-insider-investigation\ndescription: \"Identity Insider Investigation.\"\ndomain: cybersecurity\n---\n\n|\n| **Insider Threat** | Risk posed by individuals with authorized access who intentionally or unintentionally cause harm to the organization |\n| **User Behavior Analytics (UBA)** | Technology that analyzes user activity patterns to detect anomalies indicating potential insider threats |\n| **Data Loss Prevention (DLP)** | Technology that monitors, detects, and blocks unauthorized transfer of sensitive data outside the organization |\n| **Legal Hold** | Directive to preserve all relevant evidence and suspend normal document destruction policies during an investigation |\n| **Need to Know** | Information access principle restricting insider threat investigation details to only authorized team members |\n| **Exfiltration Vector** | Method used to move data outside the organization: USB, email, cloud storage, print, screen capture, photography |\n\n## Tools & Systems\n\n- **Microsoft Purview (formerly Compliance Center)**: Insider risk management, DLP, eDiscovery, and content search\n- **Exabeam \u002F Securonix**: User and entity behavior analytics (UEBA) platforms for anomaly detection\n- **Digital Guardian**: DLP and insider threat detection platform with endpoint agent\n- **Magnet AXIOM**: Digital forensics platform supporting endpoint, cloud, and mobile evidence analysis\n- **Relativity**: eDiscovery platform for legal review of collected evidence in insider threat cases\n\n## Common Scenarios\n\n### Scenario: Departing Engineer Exfiltrating Source Code\n\n**Context**: A senior software engineer with access to critical repositories submits a two-week resignation notice. The engineering manager reports that the engineer has been working unusual hours and downloading large amounts of code.\n\n**Approach**:\n1. Obtain legal authorization to investigate before taking any action\n2. Pull Git access logs showing repository clones and downloads for the past 60 days\n3. Review DLP logs for USB device connections and large file transfers\n4. Check email gateway for messages with code attachments sent to personal accounts\n5. Analyze browser history for personal cloud storage uploads\n6. Image the workstation forensically before the employee's last day\n7. Present findings to legal and HR for determination of next steps\n\n**Pitfalls**:\n- Investigating without legal counsel authorization (may violate employee privacy rights)\n- Alerting the subject to the investigation before evidence is preserved\n- Not preserving the workstation before the employee's departure date\n- Assuming all after-hours access is malicious without comparing to the employee's historical baseline\n- Failing to check personal mobile devices that may have accessed corporate cloud services\n\n## Output Format\n\n```\nINSIDER THREAT INVESTIGATION REPORT\n=====================================\nCase ID:          INV-2025-042\nClassification:   CONFIDENTIAL - Need to Know Only\nSubject:          [Name Redacted] - Senior Engineer\nInvestigation Period: 2025-10-01 to 2025-10-28\nInvestigator:     [Name]\nLegal Counsel:    [Name]\nHR Liaison:       [Name]\n\nALLEGATION\nUnauthorized exfiltration of proprietary source code and customer\ndata following resignation submission.\n\nEVIDENCE SUMMARY\n1. Git logs: 47 repositories cloned (vs. baseline of 3)\n2. USB transfers: 4.6 GB across 3 unique devices over 12 sessions\n3. Email: 200+ emails with attachments forwarded to personal Gmail\n4. Cloud: Google Drive sync client installed, syncing corporate files\n5. Print: 847 pages including customer contact database\n6. Physical access: After-hours badge access on 8 of 12 workdays\n\nBEHAVIORAL ANALYSIS\n[Baseline vs. anomalous activity comparison]\n\nIMPACT ASSESSMENT\nData Classification:  Confidential (source code, customer PII)\nEstimated Volume:     7.2 GB exfiltrated\nRegulatory Impact:    Potential GDPR notification (customer PII)\nBusiness Impact:      Competitive advantage at risk\n\nTIMELINE\n[Chronological event listing]\n\nRECOMMENDATIONS\n1. [Legal\u002FHR decision on employment action]\n2. [Evidence preservation actions]\n3. [Regulatory notification assessment]\n4. [Access control improvements]\n```\n","|\n| **Insider Threat** | Risk posed by individuals with authorized access who intentionally or unintentionally cause harm to the organization |\n| **User Behavior Analytics (UBA)** | Technology that analyzes user activity patterns to detect anomalies indicating potential insider threats |\n| **Data Loss Prevention (DLP)** | Technology that monitors, detects, and blocks unauthorized transfer of sensitive data outside the organization |\n| **Legal Hold** | Directive to preserve all relevant evidence and suspend normal document destruction policies during an investigation |\n| **Need to Know** | Information access principle restricting insider threat investigation details to only authorized team members |\n| **Exfiltration Vector** | Method used to move data outside the organization: USB, email, cloud storage, print, screen capture, photography |\n\n## Tools & Systems\n\n- **Microsoft Purview (formerly Compliance Center)**: Insider risk management, DLP, eDiscovery, and content search\n- **Exabeam \u002F Securonix**: User and entity behavior analytics (UEBA) platforms for anomaly detection\n- **Digital Guardian**: DLP and insider threat detection platform with endpoint agent\n- **Magnet AXIOM**: Digital forensics platform supporting endpoint, cloud, and mobile evidence analysis\n- **Relativity**: eDiscovery platform for legal review of collected evidence in insider threat cases\n\n## Common Scenarios\n\n### Scenario: Departing Engineer Exfiltrating Source Code\n\n**Context**: A senior software engineer with access to critical repositories submits a two-week resignation notice. The engineering manager reports that the engineer has been working unusual hours and downloading large amounts of code.\n\n**Approach**:\n1. Obtain legal authorization to investigate before taking any action\n2. Pull Git access logs showing repository clones and downloads for the past 60 days\n3. Review DLP logs for USB device connections and large file transfers\n4. Check email gateway for messages with code attachments sent to personal accounts\n5. Analyze browser history for personal cloud storage uploads\n6. Image the workstation forensically before the employee's last day\n7. Present findings to legal and HR for determination of next steps\n\n**Pitfalls**:\n- Investigating without legal counsel authorization (may violate employee privacy rights)\n- Alerting the subject to the investigation before evidence is preserved\n- Not preserving the workstation before the employee's departure date\n- Assuming all after-hours access is malicious without comparing to the employee's historical baseline\n- Failing to check personal mobile devices that may have accessed corporate cloud services\n\n## Output Format\n\n```\nINSIDER THREAT INVESTIGATION REPORT\n=====================================\nCase ID:          INV-2025-042\nClassification:   CONFIDENTIAL - Need to Know Only\nSubject:          [Name Redacted] - Senior Engineer\nInvestigation Period: 2025-10-01 to 2025-10-28\nInvestigator:     [Name]\nLegal Counsel:    [Name]\nHR Liaison:       [Name]\n\nALLEGATION\nUnauthorized exfiltration of proprietary source code and customer\ndata following resignation submission.\n\nEVIDENCE SUMMARY\n1. Git logs: 47 repositories cloned (vs. baseline of 3)\n2. USB transfers: 4.6 GB across 3 unique devices over 12 sessions\n3. Email: 200+ emails with attachments forwarded to personal Gmail\n4. Cloud: Google Drive sync client installed, syncing corporate files\n5. Print: 847 pages including customer contact database\n6. Physical access: After-hours badge access on 8 of 12 workdays\n\nBEHAVIORAL ANALYSIS\n[Baseline vs. anomalous activity comparison]\n\nIMPACT ASSESSMENT\nData Classification:  Confidential (source code, customer PII)\nEstimated Volume:     7.2 GB exfiltrated\nRegulatory Impact:    Potential GDPR notification (customer PII)\nBusiness Impact:      Competitive advantage at risk\n\nTIMELINE\n[Chronological event listing]\n\nRECOMMENDATIONS\n1. [Legal\u002FHR decision on employment action]\n2. [Evidence preservation actions]\n3. [Regulatory notification assessment]\n4. [Access control improvements]\n```\n",{"name":5,"domain":23,"description":7},"main","a91f1293287ffa9f4f1b8f486cd6e835a1568c84","skills\u002Fidentity-insider-investigation","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace","https:\u002F\u002Fgithub.com\u002FDCx7C5","#Python","2026-09-01 11:21:00",{"source":8,"skillName":5,"commands":37,"prompt":47,"zipAvailable":48},[38,41,44],{"tool":39,"command":40},"npx","npx skills add DCx7C5\u002Fai-marketplace --skill identity-insider-investigation",{"tool":42,"command":43},"bunx","bunx skills add DCx7C5\u002Fai-marketplace --skill identity-insider-investigation",{"tool":45,"command":46},"pnpm","pnpm dlx skills add DCx7C5\u002Fai-marketplace --skill identity-insider-investigation","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fidentity-insider-investigation\u002FSKILL.md",true,[50],{"path":51,"resourceType":52,"resourceTypeDesc":53,"sizeBytes":54,"sourceHtmlUrl":55},"index.json","REFERENCE","参考文档",520,"https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fidentity-insider-investigation\u002Findex.json",[57,82,105,127,149,165],{"skillNo":58,"name":59,"nameZh":6,"description":60,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":61,"categories":62,"keywords":63,"publishedAt":24},"01M71HAPZ01KQ30RKTB0FFSQ05","services-wmi-persistence-detect","Detect WMI event subscription persistence by enumerating ActiveScriptEventConsumer, CommandLineEventConsumer, and permanent subscriptions in the WMI repository.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fservices\u002Fwmi\u002Fpersistence\u002Fdetect\u002FSKILL.md",[],[64,65,66,67,68,69,70,71,72,73,74,75,76,77,78,79,80,23,81],"services","detect","services wmi persistence detect","wmi","persistence","de","cm","process","activescript","event","subscriptions","commandline-consumer","repository","subscription","event-subscription","t1546.003","forensics","process-forensics",{"skillNo":83,"name":84,"nameZh":6,"description":85,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":86,"categories":87,"keywords":88,"publishedAt":24},"01M71HAK6JTTTS229T17WJMMCG","services-wmi-exec-exploit","Perform lateral movement across Windows networks using WMI-based remote execution techniques including Impacket wmiexec.py, CrackMapExec, and native WMI commands for stealthy post-exploitation during red team engagements.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fservices\u002Fwmi\u002Fexec\u002Fexploit\u002FSKILL.md",[],[89,64,90,67,91,92,93,23,94,95,96,97,98,99,69,100,101,102,103,104],"exploit","services wmi exec exploit","exec","remote","traffic","Bash","analysis","team","across","crackmapexec","native","command","lateral movement","read","lateral-movement","Impacket",{"skillNo":106,"name":107,"nameZh":6,"description":108,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":109,"categories":110,"keywords":111,"publishedAt":24},"01M71HAG6MHKNQV8KDZKMT4886","registry-artifact-extract","Extract and analyze Windows Registry hives to uncover user activity, installed software, autostart entries, and evidence of system compromise.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fregistry\u002Fartifact\u002Fextract\u002FSKILL.md",[],[112,113,114,115,116,117,23,94,118,95,119,120,69,102,121,122,123,124,125,126],"artifact","registry","registry artifact extract","extract","evidence-collection","artifact-analysis","collection","analyze","uncover","software","activity","digital-forensics","windows-registry","regripper","sonnet",{"skillNo":128,"name":129,"nameZh":6,"description":130,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":131,"categories":132,"keywords":133,"publishedAt":24},"01M71HACR4A8XTWTTSXK4124AA","processes-token-impersonate-detect","Detect Windows token impersonation and privilege abuse including SeImpersonatePrivilege exploitation via Potato attacks and token stealing techniques.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fprocesses\u002Ftoken\u002Fimpersonate\u002Fdetect\u002FSKILL.md",[],[65,134,135,136,137,138,139,70,140,23,81,141,142,143,144,145,146,147,148,69],"processes token impersonate detect","token","processes","attacks","windows","escalation","techniques","privilege-escalation","seimpersonate","token-impersonation","printspoofer","exploitation","potato","impersonation","via",{"skillNo":150,"name":151,"nameZh":6,"description":152,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":153,"categories":154,"keywords":155,"publishedAt":24},"01M71HAABSB4Z6QFSXEG00R4RK","processes-thread-injection-detect","Detect Windows thread injection techniques including CreateRemoteThread, QueueUserAPC, NtCreateThreadEx, and thread hijacking via process memory analysis.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fprocesses\u002Fthread\u002Finjection\u002Fdetect\u002FSKILL.md",[],[156,157,65,158,136,138,159,70,160,140,23,81,95,161,162,163,164,148,69,71],"thread","processes thread injection detect","injection","memory","process-injection","api","apc-injection","thread-injection","nt-api",{"skillNo":166,"name":167,"nameZh":6,"description":168,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":169,"categories":170,"keywords":171,"publishedAt":24},"01M71HA7H311V5G14WMX58HQSS","processes-hollow-technique-detect","Detect process hollowing (RunPE) by identifying processes with mismatched image paths between PEB and VAD tree, or unmapped PE headers in memory.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fprocesses\u002Fhollow\u002Ftechnique\u002Fdetect\u002FSKILL.md",[],[172,65,136,173,159,70,174,175,23,81,176,177,178,179,180,181,69,71,182,183],"processes hollow technique detect","tree","memory-forensics","process-hollow","peb","runpe","image","pe-header","in memory","with","mismatched","headers"]