[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M71DRVHW0BCBGHGE41PD7B6R":3,"skill-same:01M71DRVHW0BCBGHGE41PD7B6R":112},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":18,"publishedAt":39,"linkOnly":40,"markdownContent":41,"markdownBody":42,"frontMatter":43,"refName":68,"commitSha":69,"skillDirectory":70,"forksCount":14,"repositoryHtmlUrl":71,"repositoryHomepageUrl":6,"ownerHtmlUrl":72,"ownerBlogUrl":6,"ownerDescription":73,"updatedAt":74,"install":75,"resources":88},"01M71DRVHW0BCBGHGE41PD7B6R","ics-malware-stuxnet-detect",null,"This skill covers detecting sophisticated cyber-physical attacks that follow the Stuxnet attack pattern of modifying PLC logic while spoofing sensor readings to hide the manipulation from operators. It addresses PLC logic integrity monitoring, physics-based process anomaly detection, engineering workstation compromise indicators, USB-borne attack vectors, and multi-stage attack chain detection spanning IT-to-OT lateral movement through to process manipulation.","DCx7C5\u002Fai-marketplace","DCx7C5","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F42419559?v=4","01M71C01G2AZV3NTNGWAWSHJPP","DC","01M71C01GQW6G50S2BYMS7PP3E",0,"MIT","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Findustrial\u002Fics\u002Fmalware\u002Fstuxnet\u002Fdetect\u002FSKILL.md",[],[19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38],"malware","stuxnet","ics malware stuxnet","ics","detect","ics malware stuxnet detect","ICS-security","lateral movement","de","operators","usb","monitoring","Bash","cybersecurity","sensor","cm","chain","physics","detecting","workstation","2026-11-10 10:12:30",false,"---\nname: ics-malware-stuxnet-detect\ndescription: This skill covers detecting sophisticated cyber-physical attacks that follow the Stuxnet attack pattern of modifying PLC logic while spoofing sensor readings to hide the manipulation from operators. It addresses PLC logic integrity monitoring, physics-based process anomaly detection, engineering workstation compromise indicators, USB-borne attack vectors, and multi-stage attack chain detection spanning IT-to-OT lateral movement through to process manipulation.\ndomain: cybersecurity\nsubdomain: ot-ics-security\ntags:\n- ot-security\n- ics\n- scada\n- industrial-control\n- iec62443\n- stuxnet\n- plc-integrity\n- apt\nnist_csf:\n- PR.IR-01\n- DE.CM-01\n- ID.AM-05\n- GV.OC-02\nmodel: sonnet\nmaxTurns: 20\ntools: [Read, Bash, Glob, Grep]\nmitre_attack:\n- T0843\n- T0855\n- T1059\ncapec: []\n---\n\n# Detecting Stuxnet-Style Attacks\n\n## When to Use\n\n- When implementing advanced threat detection for high-value OT targets (nuclear, chemical, critical infrastructure)\n- When building detection for APT-style attacks targeting PLC logic and process manipulation\n- When establishing PLC logic integrity monitoring to detect unauthorized modifications\n- When investigating suspected process anomalies that may indicate cyber-physical attacks\n- When designing defense-in-depth strategies against nation-state level OT threats\n\n**Do not use** for basic OT intrusion detection (see detecting-attacks-on-scada-systems), for malware analysis of Stuxnet samples (see malware reverse engineering skills), or for PLC programming and logic development.\n\n## Prerequisites\n\n- Detailed understanding of the Stuxnet attack chain and MITRE ATT&CK for ICS framework\n- PLC logic backup repository with known-good baseline copies of all PLC programs\n- Engineering workstation monitoring (EDR with OT awareness)\n- Physics-based process models for the controlled physical process\n- Network monitoring for industrial protocol traffic analysis\n\n## Workflow\n\n### Step 1: Understand the Stuxnet Attack Chain\n\nMap detection opportunities across the multi-stage Stuxnet-style attack chain.\n\n```yaml\n# Stuxnet-Style Attack Chain and Detection Points\nattack_chain:\n  stage_1_initial_access:\n    technique: \"USB-borne malware targeting air-gapped network\"\n    mitre_ics: \"T0847 - Replication Through Removable Media\"\n    detection:\n      - \"USB device connection logging on engineering workstations\"\n      - \"Removable media scanning with OT-approved AV\"\n      - \"Application allowlisting blocking unauthorized executables\"\n      - \"Windows autorun disabled via Group Policy\"\n    indicators:\n      - \"New USB device connections to engineering workstations\"\n      - \"Execution of unsigned binaries from removable media\"\n      - \"LNK file exploitation patterns\"\n\n  stage_2_lateral_movement:\n    technique: \"Exploitation of Windows vulnerabilities for network propagation\"\n    mitre_ics: \"T0866 - Exploitation of Remote Services\"\n    detection:\n      - \"Network IDS detecting exploit traffic (MS08-067, MS10-061)\"\n      - \"Unusual SMB traffic between engineering workstations\"\n      - \"Windows event logs showing privilege escalation\"\n      - \"New scheduled tasks or services created\"\n    indicators:\n      - \"Lateral movement between Level 3-4 Windows systems\"\n      - \"WMI\u002FPsExec execution from unexpected sources\"\n      - \"Pass-the-hash authentication patterns\"\n\n  stage_3_ews_compromise:\n    technique: \"Compromise of engineering workstation with PLC programming software\"\n    mitre_ics: \"T0862 - Supply Chain Compromise (Step-7 hooking)\"\n    detection:\n      - \"File integrity monitoring on Step-7\u002FTIA Portal directories\"\n      - \"DLL injection detection in PLC programming software\"\n      - \"Monitoring s7otbxdx.dll for Stuxnet-specific hook\"\n      - \"Unexpected modifications to PLC project files\"\n    indicators:\n      - \"Modified DLLs in Siemens STEP 7 installation directory\"\n      - \"Rootkit hiding files on engineering workstation\"\n      - \"PLC programming software behaving abnormally\"\n\n  stage_4_plc_logic_modification:\n    technique: \"Injecting malicious OB\u002FFC blocks into PLC program\"\n    mitre_ics: \"T0839 - Module Firmware \u002F T0833 - Modify Control Logic\"\n    detection:\n      - \"PLC logic integrity comparison against known-good baseline\"\n      - \"S7comm upload\u002Fdownload traffic from unauthorized sources\"\n      - \"New OB\u002FFC\u002FFB blocks appearing in PLC program\"\n      - \"Modification of OB1 (main scan) or OB35 (cyclic interrupt)\"\n    indicators:\n      - \"PLC program block count changes\"\n      - \"PLC program size changes\"\n      - \"Upload of unknown program blocks\"\n\n  stage_5_process_manipulation:\n    technique: \"Manipulating physical process while spoofing sensor readings\"\n    mitre_ics: \"T0836 - Modify Parameter \u002F T0856 - Spoof Reporting Message\"\n    detection:\n      - \"Physics-based anomaly detection (process model deviation)\"\n      - \"Cross-validation of independent sensors\"\n      - \"Vibration analysis and mechanical signature monitoring\"\n      - \"Comparison of PLC-reported values vs independent measurements\"\n    indicators:\n      - \"Motor\u002Fpump operating outside normal parameters\"\n      - \"Sensor readings diverging from physics model predictions\"\n      - \"Process efficiency metrics deviating unexpectedly\"\n```\n\n### Step 2: Implement PLC Logic Integrity Monitoring\n\nContinuously monitor PLC program integrity by comparing running logic against known-good baselines.\n\n```python\n#!\u002Fusr\u002Fbin\u002Fenv python3\n\"\"\"PLC Logic Integrity Monitor.\n\nPeriodically retrieves PLC program block information and compares\nagainst known-good baselines to detect unauthorized modifications\n(Stuxnet-style logic injection).\n\"\"\"\n\nimport hashlib\nimport json\nimport sys\nimport time\nfrom dataclasses import dataclass, field, asdict\nfrom datetime import datetime\n\n\n@dataclass\nclass PLCBlock:\n    \"\"\"Represents a PLC program block.\"\"\"\n    block_type: str  # OB, FC, FB, DB\n    block_number: int\n    name: str\n    size_bytes: int\n    checksum: str\n    last_modified: str\n    author: str = \"\"\n\n\n@dataclass\nclass IntegrityAlert:\n    alert_id: str\n    timestamp: str\n    severity: str\n    plc_name: str\n    plc_ip: str\n    alert_type: str\n    description: str\n    baseline_value: str\n    current_value: str\n    mitre_technique: str\n\n\nclass PLCIntegrityMonitor:\n    \"\"\"Monitors PLC program integrity against baselines.\"\"\"\n\n    def __init__(self):\n        self.baselines = {}  # plc_name -> list of PLCBlock\n        self.alerts = []\n        self.alert_counter = 1\n\n    def load_baseline(self, plc_name, baseline_file):\n        \"\"\"Load known-good PLC program baseline.\"\"\"\n        with open(baseline_file) as f:\n            data = json.load(f)\n        blocks = [PLCBlock(**b) for b in data.get(\"blocks\", [])]\n        self.baselines[plc_name] = {\n            \"blocks\": {f\"{b.block_type}{b.block_number}\": b for b in blocks},\n            \"total_blocks\": len(blocks),\n            \"loaded_at\": datetime.now().isoformat(),\n        }\n        print(f\"[*] Loaded baseline for {plc_name}: {len(blocks)} blocks\")\n\n    def check_integrity(self, plc_name, plc_ip, current_blocks):\n        \"\"\"Compare current PLC program against baseline.\"\"\"\n        baseline = self.baselines.get(plc_name)\n        if not baseline:\n            print(f\"[WARN] No baseline for {plc_name}\")\n            return\n\n        baseline_blocks = baseline[\"blocks\"]\n        current_block_map = {f\"{b.block_type}{b.block_number}\": b for b in current_blocks}\n\n        # Check 1: New blocks added (potential logic injection)\n        for key, block in current_block_map.items():\n            if key not in baseline_blocks:\n                self.alerts.append(IntegrityAlert(\n                    alert_id=f\"INT-{self.alert_counter:04d}\",\n                    timestamp=datetime.now().isoformat(),\n                    severity=\"critical\",\n                    plc_name=plc_name,\n                    plc_ip=plc_ip,\n                    alert_type=\"NEW_BLOCK_DETECTED\",\n                    description=(\n                        f\"New program block {key} ({block.name}) found in PLC \"\n                        f\"that does not exist in baseline. Size: {block.size_bytes} bytes.\"\n                    ),\n                    baseline_value=\"Block does not exist in baseline\",\n                    current_value=f\"{key}: {block.size_bytes} bytes, checksum {block.checksum}\",\n                    mitre_technique=\"T0839 - Module Firmware \u002F T0833 - Modify Control Logic\",\n                ))\n                self.alert_counter += 1\n\n        # Check 2: Blocks removed\n        for key in baseline_blocks:\n            if key not in current_block_map:\n                self.alerts.append(IntegrityAlert(\n                    alert_id=f\"INT-{self.alert_counter:04d}\",\n                    timestamp=datetime.now().isoformat(),\n                    severity=\"high\",\n                    plc_name=plc_name,\n                    plc_ip=plc_ip,\n                    alert_type=\"BLOCK_REMOVED\",\n                    description=f\"Program block {key} removed from PLC\",\n                    baseline_value=f\"{key}: {baseline_blocks[key].size_bytes} bytes\",\n                    current_value=\"Block not found\",\n                    mitre_technique=\"T0833 - Modify Control Logic\",\n                ))\n                self.alert_counter += 1\n\n        # Check 3: Block content modified (checksum mismatch)\n        for key in baseline_blocks:\n            if key in current_block_map:\n                baseline_block = baseline_blocks[key]\n                current_block = current_block_map[key]\n\n                if baseline_block.checksum != current_block.checksum:\n                    self.alerts.append(IntegrityAlert(\n                        alert_id=f\"INT-{self.alert_counter:04d}\",\n                        timestamp=datetime.now().isoformat(),\n                        severity=\"critical\",\n                        plc_name=plc_name,\n                        plc_ip=plc_ip,\n                        alert_type=\"BLOCK_MODIFIED\",\n                        description=(\n                            f\"Program block {key} checksum mismatch. \"\n                            f\"Logic has been modified since baseline was established.\"\n                        ),\n                        baseline_value=f\"Checksum: {baseline_block.checksum}, Size: {baseline_block.size_bytes}\",\n                        current_value=f\"Checksum: {current_block.checksum}, Size: {current_block.size_bytes}\",\n                        mitre_technique=\"T0833 - Modify Control Logic\",\n                    ))\n                    self.alert_counter += 1\n\n        # Check 4: Block count change\n        if len(current_blocks) != baseline[\"total_blocks\"]:\n            self.alerts.append(IntegrityAlert(\n                alert_id=f\"INT-{self.alert_counter:04d}\",\n                timestamp=datetime.now().isoformat(),\n                severity=\"high\",\n                plc_name=plc_name,\n                plc_ip=plc_ip,\n                alert_type=\"BLOCK_COUNT_CHANGE\",\n                description=f\"Total block count changed from {baseline['total_blocks']} to {len(current_blocks)}\",\n                baseline_value=str(baseline[\"total_blocks\"]),\n                current_value=str(len(current_blocks)),\n                mitre_technique=\"T0833 - Modify Control Logic\",\n            ))\n            self.alert_counter += 1\n\n    def generate_report(self):\n        \"\"\"Generate integrity monitoring report.\"\"\"\n        print(f\"\\n{'='*70}\")\n        print(\"PLC LOGIC INTEGRITY MONITORING REPORT\")\n        print(f\"{'='*70}\")\n        print(f\"Baselines loaded: {len(self.baselines)}\")\n        print(f\"Alerts: {len(self.alerts)}\")\n\n        for a in self.alerts:\n            print(f\"\\n  [{a.severity.upper()}] {a.alert_type}\")\n            print(f\"    PLC: {a.plc_name} ({a.plc_ip})\")\n            print(f\"    {a.description}\")\n            print(f\"    Baseline: {a.baseline_value}\")\n            print(f\"    Current: {a.current_value}\")\n            print(f\"    MITRE: {a.mitre_technique}\")\n\n\nif __name__ == \"__main__\":\n    monitor = PLCIntegrityMonitor()\n    print(\"PLC Logic Integrity Monitor\")\n    print(\"Load baselines and call check_integrity() periodically\")\n```\n\n### Step 3: Deploy Physics-Based Process Anomaly Detection\n\nMonitor physical process behavior using models that predict expected sensor values based on the laws of physics. Deviations indicate either equipment failure or cyber-physical attack.\n\n```python\n#!\u002Fusr\u002Fbin\u002Fenv python3\n\"\"\"Physics-Based Cyber-Physical Attack Detector.\n\nUses simplified physics models to detect process manipulation\nattacks where the attacker modifies the physical process while\nspoofing sensor readings (the core Stuxnet attack pattern).\n\"\"\"\n\nimport math\nfrom dataclasses import dataclass\nfrom datetime import datetime\n\n\n@dataclass\nclass PhysicsAlert:\n    timestamp: str\n    severity: str\n    alert_type: str\n    sensor_tag: str\n    reported_value: float\n    predicted_value: float\n    deviation_percent: float\n    description: str\n\n\nclass CentrifugePhysicsModel:\n    \"\"\"Physics model for a centrifuge system (Stuxnet target analog).\n\n    Detects manipulation by cross-correlating:\n    - Motor frequency (Hz) vs reported RPM\n    - RPM vs vibration signature\n    - Power consumption vs rotational speed\n    \"\"\"\n\n    def __init__(self, rated_rpm=1200, rated_frequency=50, rated_power_kw=75):\n        self.rated_rpm = rated_rpm\n        self.rated_frequency = rated_frequency\n        self.rated_power_kw = rated_power_kw\n        self.alerts = []\n\n    def check_frequency_rpm_correlation(self, frequency_hz, reported_rpm):\n        \"\"\"Verify motor frequency matches reported RPM.\n\n        For an induction motor: RPM = 120 * frequency \u002F poles\n        If RPM is being spoofed, it won't match the actual frequency.\n        \"\"\"\n        # Assuming 4-pole motor with typical 3% slip\n        expected_rpm = (120 * frequency_hz \u002F 4) * 0.97\n        deviation = abs(reported_rpm - expected_rpm) \u002F expected_rpm * 100\n\n        if deviation > 5.0:\n            self.alerts.append(PhysicsAlert(\n                timestamp=datetime.now().isoformat(),\n                severity=\"critical\",\n                alert_type=\"FREQUENCY_RPM_MISMATCH\",\n                sensor_tag=\"MOTOR.RPM vs VFD.FREQ\",\n                reported_value=reported_rpm,\n                predicted_value=round(expected_rpm, 1),\n                deviation_percent=round(deviation, 1),\n                description=(\n                    f\"Motor RPM ({reported_rpm}) does not match VFD frequency \"\n                    f\"({frequency_hz} Hz). Expected ~{expected_rpm:.0f} RPM. \"\n                    f\"Possible RPM sensor spoofing while frequency is manipulated.\"\n                ),\n            ))\n\n    def check_power_speed_correlation(self, rpm, power_kw):\n        \"\"\"Verify power consumption matches rotational speed.\n\n        Power scales approximately with RPM^3 for centrifugal loads.\n        \"\"\"\n        speed_ratio = rpm \u002F self.rated_rpm\n        expected_power = self.rated_power_kw * (speed_ratio ** 3)\n        deviation = abs(power_kw - expected_power) \u002F max(expected_power, 0.1) * 100\n\n        if deviation > 15.0:\n            self.alerts.append(PhysicsAlert(\n                timestamp=datetime.now().isoformat(),\n                severity=\"high\",\n                alert_type=\"POWER_SPEED_MISMATCH\",\n                sensor_tag=\"MOTOR.POWER vs MOTOR.RPM\",\n                reported_value=power_kw,\n                predicted_value=round(expected_power, 1),\n                deviation_percent=round(deviation, 1),\n                description=(\n                    f\"Power consumption ({power_kw} kW) inconsistent with RPM ({rpm}). \"\n                    f\"Expected ~{expected_power:.1f} kW. May indicate hidden speed changes.\"\n                ),\n            ))\n\n    def check_vibration_anomaly(self, rpm, vibration_mm_s):\n        \"\"\"Check if vibration signature is consistent with operating speed.\n\n        Abnormal vibration at reported 'normal' speed may indicate actual\n        speed is different from what sensors report.\n        \"\"\"\n        # Normal vibration increases linearly with speed for balanced rotor\n        speed_ratio = rpm \u002F self.rated_rpm\n        expected_vibration = 2.0 * speed_ratio  # mm\u002Fs baseline\n        deviation = abs(vibration_mm_s - expected_vibration) \u002F max(expected_vibration, 0.1) * 100\n\n        if vibration_mm_s > 7.0:  # ISO 10816 alert threshold\n            self.alerts.append(PhysicsAlert(\n                timestamp=datetime.now().isoformat(),\n                severity=\"critical\",\n                alert_type=\"ABNORMAL_VIBRATION\",\n                sensor_tag=\"MOTOR.VIBRATION\",\n                reported_value=vibration_mm_s,\n                predicted_value=round(expected_vibration, 1),\n                deviation_percent=round(deviation, 1),\n                description=(\n                    f\"Vibration ({vibration_mm_s} mm\u002Fs) at ISO alert level while \"\n                    f\"RPM reports normal ({rpm}). Actual speed may differ from reported.\"\n                ),\n            ))\n\n    def report(self):\n        if self.alerts:\n            print(f\"\\n{'='*60}\")\n            print(\"PHYSICS-BASED ANOMALY DETECTION ALERTS\")\n            print(f\"{'='*60}\")\n            for a in self.alerts:\n                print(f\"\\n  [{a.severity.upper()}] {a.alert_type}\")\n                print(f\"    {a.description}\")\n                print(f\"    Reported: {a.reported_value} | Predicted: {a.predicted_value}\")\n                print(f\"    Deviation: {a.deviation_percent}%\")\n\n\nif __name__ == \"__main__\":\n    model = CentrifugePhysicsModel(rated_rpm=1200, rated_frequency=50, rated_power_kw=75)\n\n    # Normal operation - no alerts expected\n    model.check_frequency_rpm_correlation(50.0, 1164)\n    model.check_power_speed_correlation(1164, 72.0)\n\n    # Stuxnet-style attack: frequency increased but RPM spoofed as normal\n    model.check_frequency_rpm_correlation(84.0, 1164)  # freq up, RPM spoofed\n    model.check_power_speed_correlation(1164, 180.0)    # power reveals true speed\n\n    model.report()\n```\n\n## Key Concepts\n\n| Term | Definition |\n|------|------------|\n| Cyber-Physical Attack | Attack that manipulates both the cyber system (PLC logic, sensor readings) and the physical process simultaneously |\n| Logic Injection | Inserting malicious code blocks into PLC programs to alter physical process behavior |\n| Sensor Spoofing | Replaying or fabricating sensor readings to hide process manipulation from operators |\n| Physics-Based Detection | Using mathematical models of physical processes to detect when reported sensor values are inconsistent with actual physics |\n| PLC Logic Baseline | Known-good copy of PLC program blocks (OB, FC, FB, DB) used for integrity comparison |\n| Air-Gap Bridging | Technique of crossing air-gapped networks via USB drives, as used by Stuxnet's initial access method |\n\n## Tools & Systems\n\n- **Claroty xDome**: Continuous PLC logic monitoring with baseline comparison and change detection\n- **SIGA OT Solutions**: Physical signal monitoring at the electrical level for detecting process manipulation\n- **Nozomi Guardian**: OT monitoring with PLC program change detection capabilities\n- **Siemens SINEMA Remote Connect**: Secure remote access with PLC project version tracking\n\n## Output Format\n\n```\nStuxnet-Style Attack Detection Report\n========================================\nMonitored PLCs: [N]\nMonitoring Period: YYYY-MM-DD to YYYY-MM-DD\n\nPLC INTEGRITY:\n  Baselines verified: [N]\u002F[N]\n  Logic modifications detected: [N]\n  New blocks detected: [N]\n\nPHYSICS ANOMALIES:\n  Sensor correlation violations: [N]\n  Process model deviations: [N]\n\nENGINEERING WORKSTATION:\n  Unauthorized modifications: [N]\n  USB connections: [N]\n```\n","# Detecting Stuxnet-Style Attacks\n\n## When to Use\n\n- When implementing advanced threat detection for high-value OT targets (nuclear, chemical, critical infrastructure)\n- When building detection for APT-style attacks targeting PLC logic and process manipulation\n- When establishing PLC logic integrity monitoring to detect unauthorized modifications\n- When investigating suspected process anomalies that may indicate cyber-physical attacks\n- When designing defense-in-depth strategies against nation-state level OT threats\n\n**Do not use** for basic OT intrusion detection (see detecting-attacks-on-scada-systems), for malware analysis of Stuxnet samples (see malware reverse engineering skills), or for PLC programming and logic development.\n\n## Prerequisites\n\n- Detailed understanding of the Stuxnet attack chain and MITRE ATT&CK for ICS framework\n- PLC logic backup repository with known-good baseline copies of all PLC programs\n- Engineering workstation monitoring (EDR with OT awareness)\n- Physics-based process models for the controlled physical process\n- Network monitoring for industrial protocol traffic analysis\n\n## Workflow\n\n### Step 1: Understand the Stuxnet Attack Chain\n\nMap detection opportunities across the multi-stage Stuxnet-style attack chain.\n\n```yaml\n# Stuxnet-Style Attack Chain and Detection Points\nattack_chain:\n  stage_1_initial_access:\n    technique: \"USB-borne malware targeting air-gapped network\"\n    mitre_ics: \"T0847 - Replication Through Removable Media\"\n    detection:\n      - \"USB device connection logging on engineering workstations\"\n      - \"Removable media scanning with OT-approved AV\"\n      - \"Application allowlisting blocking unauthorized executables\"\n      - \"Windows autorun disabled via Group Policy\"\n    indicators:\n      - \"New USB device connections to engineering workstations\"\n      - \"Execution of unsigned binaries from removable media\"\n      - \"LNK file exploitation patterns\"\n\n  stage_2_lateral_movement:\n    technique: \"Exploitation of Windows vulnerabilities for network propagation\"\n    mitre_ics: \"T0866 - Exploitation of Remote Services\"\n    detection:\n      - \"Network IDS detecting exploit traffic (MS08-067, MS10-061)\"\n      - \"Unusual SMB traffic between engineering workstations\"\n      - \"Windows event logs showing privilege escalation\"\n      - \"New scheduled tasks or services created\"\n    indicators:\n      - \"Lateral movement between Level 3-4 Windows systems\"\n      - \"WMI\u002FPsExec execution from unexpected sources\"\n      - \"Pass-the-hash authentication patterns\"\n\n  stage_3_ews_compromise:\n    technique: \"Compromise of engineering workstation with PLC programming software\"\n    mitre_ics: \"T0862 - Supply Chain Compromise (Step-7 hooking)\"\n    detection:\n      - \"File integrity monitoring on Step-7\u002FTIA Portal directories\"\n      - \"DLL injection detection in PLC programming software\"\n      - \"Monitoring s7otbxdx.dll for Stuxnet-specific hook\"\n      - \"Unexpected modifications to PLC project files\"\n    indicators:\n      - \"Modified DLLs in Siemens STEP 7 installation directory\"\n      - \"Rootkit hiding files on engineering workstation\"\n      - \"PLC programming software behaving abnormally\"\n\n  stage_4_plc_logic_modification:\n    technique: \"Injecting malicious OB\u002FFC blocks into PLC program\"\n    mitre_ics: \"T0839 - Module Firmware \u002F T0833 - Modify Control Logic\"\n    detection:\n      - \"PLC logic integrity comparison against known-good baseline\"\n      - \"S7comm upload\u002Fdownload traffic from unauthorized sources\"\n      - \"New OB\u002FFC\u002FFB blocks appearing in PLC program\"\n      - \"Modification of OB1 (main scan) or OB35 (cyclic interrupt)\"\n    indicators:\n      - \"PLC program block count changes\"\n      - \"PLC program size changes\"\n      - \"Upload of unknown program blocks\"\n\n  stage_5_process_manipulation:\n    technique: \"Manipulating physical process while spoofing sensor readings\"\n    mitre_ics: \"T0836 - Modify Parameter \u002F T0856 - Spoof Reporting Message\"\n    detection:\n      - \"Physics-based anomaly detection (process model deviation)\"\n      - \"Cross-validation of independent sensors\"\n      - \"Vibration analysis and mechanical signature monitoring\"\n      - \"Comparison of PLC-reported values vs independent measurements\"\n    indicators:\n      - \"Motor\u002Fpump operating outside normal parameters\"\n      - \"Sensor readings diverging from physics model predictions\"\n      - \"Process efficiency metrics deviating unexpectedly\"\n```\n\n### Step 2: Implement PLC Logic Integrity Monitoring\n\nContinuously monitor PLC program integrity by comparing running logic against known-good baselines.\n\n```python\n#!\u002Fusr\u002Fbin\u002Fenv python3\n\"\"\"PLC Logic Integrity Monitor.\n\nPeriodically retrieves PLC program block information and compares\nagainst known-good baselines to detect unauthorized modifications\n(Stuxnet-style logic injection).\n\"\"\"\n\nimport hashlib\nimport json\nimport sys\nimport time\nfrom dataclasses import dataclass, field, asdict\nfrom datetime import datetime\n\n\n@dataclass\nclass PLCBlock:\n    \"\"\"Represents a PLC program block.\"\"\"\n    block_type: str  # OB, FC, FB, DB\n    block_number: int\n    name: str\n    size_bytes: int\n    checksum: str\n    last_modified: str\n    author: str = \"\"\n\n\n@dataclass\nclass IntegrityAlert:\n    alert_id: str\n    timestamp: str\n    severity: str\n    plc_name: str\n    plc_ip: str\n    alert_type: str\n    description: str\n    baseline_value: str\n    current_value: str\n    mitre_technique: str\n\n\nclass PLCIntegrityMonitor:\n    \"\"\"Monitors PLC program integrity against baselines.\"\"\"\n\n    def __init__(self):\n        self.baselines = {}  # plc_name -> list of PLCBlock\n        self.alerts = []\n        self.alert_counter = 1\n\n    def load_baseline(self, plc_name, baseline_file):\n        \"\"\"Load known-good PLC program baseline.\"\"\"\n        with open(baseline_file) as f:\n            data = json.load(f)\n        blocks = [PLCBlock(**b) for b in data.get(\"blocks\", [])]\n        self.baselines[plc_name] = {\n            \"blocks\": {f\"{b.block_type}{b.block_number}\": b for b in blocks},\n            \"total_blocks\": len(blocks),\n            \"loaded_at\": datetime.now().isoformat(),\n        }\n        print(f\"[*] Loaded baseline for {plc_name}: {len(blocks)} blocks\")\n\n    def check_integrity(self, plc_name, plc_ip, current_blocks):\n        \"\"\"Compare current PLC program against baseline.\"\"\"\n        baseline = self.baselines.get(plc_name)\n        if not baseline:\n            print(f\"[WARN] No baseline for {plc_name}\")\n            return\n\n        baseline_blocks = baseline[\"blocks\"]\n        current_block_map = {f\"{b.block_type}{b.block_number}\": b for b in current_blocks}\n\n        # Check 1: New blocks added (potential logic injection)\n        for key, block in current_block_map.items():\n            if key not in baseline_blocks:\n                self.alerts.append(IntegrityAlert(\n                    alert_id=f\"INT-{self.alert_counter:04d}\",\n                    timestamp=datetime.now().isoformat(),\n                    severity=\"critical\",\n                    plc_name=plc_name,\n                    plc_ip=plc_ip,\n                    alert_type=\"NEW_BLOCK_DETECTED\",\n                    description=(\n                        f\"New program block {key} ({block.name}) found in PLC \"\n                        f\"that does not exist in baseline. Size: {block.size_bytes} bytes.\"\n                    ),\n                    baseline_value=\"Block does not exist in baseline\",\n                    current_value=f\"{key}: {block.size_bytes} bytes, checksum {block.checksum}\",\n                    mitre_technique=\"T0839 - Module Firmware \u002F T0833 - Modify Control Logic\",\n                ))\n                self.alert_counter += 1\n\n        # Check 2: Blocks removed\n        for key in baseline_blocks:\n            if key not in current_block_map:\n                self.alerts.append(IntegrityAlert(\n                    alert_id=f\"INT-{self.alert_counter:04d}\",\n                    timestamp=datetime.now().isoformat(),\n                    severity=\"high\",\n                    plc_name=plc_name,\n                    plc_ip=plc_ip,\n                    alert_type=\"BLOCK_REMOVED\",\n                    description=f\"Program block {key} removed from PLC\",\n                    baseline_value=f\"{key}: {baseline_blocks[key].size_bytes} bytes\",\n                    current_value=\"Block not found\",\n                    mitre_technique=\"T0833 - Modify Control Logic\",\n                ))\n                self.alert_counter += 1\n\n        # Check 3: Block content modified (checksum mismatch)\n        for key in baseline_blocks:\n            if key in current_block_map:\n                baseline_block = baseline_blocks[key]\n                current_block = current_block_map[key]\n\n                if baseline_block.checksum != current_block.checksum:\n                    self.alerts.append(IntegrityAlert(\n                        alert_id=f\"INT-{self.alert_counter:04d}\",\n                        timestamp=datetime.now().isoformat(),\n                        severity=\"critical\",\n                        plc_name=plc_name,\n                        plc_ip=plc_ip,\n                        alert_type=\"BLOCK_MODIFIED\",\n                        description=(\n                            f\"Program block {key} checksum mismatch. \"\n                            f\"Logic has been modified since baseline was established.\"\n                        ),\n                        baseline_value=f\"Checksum: {baseline_block.checksum}, Size: {baseline_block.size_bytes}\",\n                        current_value=f\"Checksum: {current_block.checksum}, Size: {current_block.size_bytes}\",\n                        mitre_technique=\"T0833 - Modify Control Logic\",\n                    ))\n                    self.alert_counter += 1\n\n        # Check 4: Block count change\n        if len(current_blocks) != baseline[\"total_blocks\"]:\n            self.alerts.append(IntegrityAlert(\n                alert_id=f\"INT-{self.alert_counter:04d}\",\n                timestamp=datetime.now().isoformat(),\n                severity=\"high\",\n                plc_name=plc_name,\n                plc_ip=plc_ip,\n                alert_type=\"BLOCK_COUNT_CHANGE\",\n                description=f\"Total block count changed from {baseline['total_blocks']} to {len(current_blocks)}\",\n                baseline_value=str(baseline[\"total_blocks\"]),\n                current_value=str(len(current_blocks)),\n                mitre_technique=\"T0833 - Modify Control Logic\",\n            ))\n            self.alert_counter += 1\n\n    def generate_report(self):\n        \"\"\"Generate integrity monitoring report.\"\"\"\n        print(f\"\\n{'='*70}\")\n        print(\"PLC LOGIC INTEGRITY MONITORING REPORT\")\n        print(f\"{'='*70}\")\n        print(f\"Baselines loaded: {len(self.baselines)}\")\n        print(f\"Alerts: {len(self.alerts)}\")\n\n        for a in self.alerts:\n            print(f\"\\n  [{a.severity.upper()}] {a.alert_type}\")\n            print(f\"    PLC: {a.plc_name} ({a.plc_ip})\")\n            print(f\"    {a.description}\")\n            print(f\"    Baseline: {a.baseline_value}\")\n            print(f\"    Current: {a.current_value}\")\n            print(f\"    MITRE: {a.mitre_technique}\")\n\n\nif __name__ == \"__main__\":\n    monitor = PLCIntegrityMonitor()\n    print(\"PLC Logic Integrity Monitor\")\n    print(\"Load baselines and call check_integrity() periodically\")\n```\n\n### Step 3: Deploy Physics-Based Process Anomaly Detection\n\nMonitor physical process behavior using models that predict expected sensor values based on the laws of physics. Deviations indicate either equipment failure or cyber-physical attack.\n\n```python\n#!\u002Fusr\u002Fbin\u002Fenv python3\n\"\"\"Physics-Based Cyber-Physical Attack Detector.\n\nUses simplified physics models to detect process manipulation\nattacks where the attacker modifies the physical process while\nspoofing sensor readings (the core Stuxnet attack pattern).\n\"\"\"\n\nimport math\nfrom dataclasses import dataclass\nfrom datetime import datetime\n\n\n@dataclass\nclass PhysicsAlert:\n    timestamp: str\n    severity: str\n    alert_type: str\n    sensor_tag: str\n    reported_value: float\n    predicted_value: float\n    deviation_percent: float\n    description: str\n\n\nclass CentrifugePhysicsModel:\n    \"\"\"Physics model for a centrifuge system (Stuxnet target analog).\n\n    Detects manipulation by cross-correlating:\n    - Motor frequency (Hz) vs reported RPM\n    - RPM vs vibration signature\n    - Power consumption vs rotational speed\n    \"\"\"\n\n    def __init__(self, rated_rpm=1200, rated_frequency=50, rated_power_kw=75):\n        self.rated_rpm = rated_rpm\n        self.rated_frequency = rated_frequency\n        self.rated_power_kw = rated_power_kw\n        self.alerts = []\n\n    def check_frequency_rpm_correlation(self, frequency_hz, reported_rpm):\n        \"\"\"Verify motor frequency matches reported RPM.\n\n        For an induction motor: RPM = 120 * frequency \u002F poles\n        If RPM is being spoofed, it won't match the actual frequency.\n        \"\"\"\n        # Assuming 4-pole motor with typical 3% slip\n        expected_rpm = (120 * frequency_hz \u002F 4) * 0.97\n        deviation = abs(reported_rpm - expected_rpm) \u002F expected_rpm * 100\n\n        if deviation > 5.0:\n            self.alerts.append(PhysicsAlert(\n                timestamp=datetime.now().isoformat(),\n                severity=\"critical\",\n                alert_type=\"FREQUENCY_RPM_MISMATCH\",\n                sensor_tag=\"MOTOR.RPM vs VFD.FREQ\",\n                reported_value=reported_rpm,\n                predicted_value=round(expected_rpm, 1),\n                deviation_percent=round(deviation, 1),\n                description=(\n                    f\"Motor RPM ({reported_rpm}) does not match VFD frequency \"\n                    f\"({frequency_hz} Hz). Expected ~{expected_rpm:.0f} RPM. \"\n                    f\"Possible RPM sensor spoofing while frequency is manipulated.\"\n                ),\n            ))\n\n    def check_power_speed_correlation(self, rpm, power_kw):\n        \"\"\"Verify power consumption matches rotational speed.\n\n        Power scales approximately with RPM^3 for centrifugal loads.\n        \"\"\"\n        speed_ratio = rpm \u002F self.rated_rpm\n        expected_power = self.rated_power_kw * (speed_ratio ** 3)\n        deviation = abs(power_kw - expected_power) \u002F max(expected_power, 0.1) * 100\n\n        if deviation > 15.0:\n            self.alerts.append(PhysicsAlert(\n                timestamp=datetime.now().isoformat(),\n                severity=\"high\",\n                alert_type=\"POWER_SPEED_MISMATCH\",\n                sensor_tag=\"MOTOR.POWER vs MOTOR.RPM\",\n                reported_value=power_kw,\n                predicted_value=round(expected_power, 1),\n                deviation_percent=round(deviation, 1),\n                description=(\n                    f\"Power consumption ({power_kw} kW) inconsistent with RPM ({rpm}). \"\n                    f\"Expected ~{expected_power:.1f} kW. May indicate hidden speed changes.\"\n                ),\n            ))\n\n    def check_vibration_anomaly(self, rpm, vibration_mm_s):\n        \"\"\"Check if vibration signature is consistent with operating speed.\n\n        Abnormal vibration at reported 'normal' speed may indicate actual\n        speed is different from what sensors report.\n        \"\"\"\n        # Normal vibration increases linearly with speed for balanced rotor\n        speed_ratio = rpm \u002F self.rated_rpm\n        expected_vibration = 2.0 * speed_ratio  # mm\u002Fs baseline\n        deviation = abs(vibration_mm_s - expected_vibration) \u002F max(expected_vibration, 0.1) * 100\n\n        if vibration_mm_s > 7.0:  # ISO 10816 alert threshold\n            self.alerts.append(PhysicsAlert(\n                timestamp=datetime.now().isoformat(),\n                severity=\"critical\",\n                alert_type=\"ABNORMAL_VIBRATION\",\n                sensor_tag=\"MOTOR.VIBRATION\",\n                reported_value=vibration_mm_s,\n                predicted_value=round(expected_vibration, 1),\n                deviation_percent=round(deviation, 1),\n                description=(\n                    f\"Vibration ({vibration_mm_s} mm\u002Fs) at ISO alert level while \"\n                    f\"RPM reports normal ({rpm}). Actual speed may differ from reported.\"\n                ),\n            ))\n\n    def report(self):\n        if self.alerts:\n            print(f\"\\n{'='*60}\")\n            print(\"PHYSICS-BASED ANOMALY DETECTION ALERTS\")\n            print(f\"{'='*60}\")\n            for a in self.alerts:\n                print(f\"\\n  [{a.severity.upper()}] {a.alert_type}\")\n                print(f\"    {a.description}\")\n                print(f\"    Reported: {a.reported_value} | Predicted: {a.predicted_value}\")\n                print(f\"    Deviation: {a.deviation_percent}%\")\n\n\nif __name__ == \"__main__\":\n    model = CentrifugePhysicsModel(rated_rpm=1200, rated_frequency=50, rated_power_kw=75)\n\n    # Normal operation - no alerts expected\n    model.check_frequency_rpm_correlation(50.0, 1164)\n    model.check_power_speed_correlation(1164, 72.0)\n\n    # Stuxnet-style attack: frequency increased but RPM spoofed as normal\n    model.check_frequency_rpm_correlation(84.0, 1164)  # freq up, RPM spoofed\n    model.check_power_speed_correlation(1164, 180.0)    # power reveals true speed\n\n    model.report()\n```\n\n## Key Concepts\n\n| Term | Definition |\n|------|------------|\n| Cyber-Physical Attack | Attack that manipulates both the cyber system (PLC logic, sensor readings) and the physical process simultaneously |\n| Logic Injection | Inserting malicious code blocks into PLC programs to alter physical process behavior |\n| Sensor Spoofing | Replaying or fabricating sensor readings to hide process manipulation from operators |\n| Physics-Based Detection | Using mathematical models of physical processes to detect when reported sensor values are inconsistent with actual physics |\n| PLC Logic Baseline | Known-good copy of PLC program blocks (OB, FC, FB, DB) used for integrity comparison |\n| Air-Gap Bridging | Technique of crossing air-gapped networks via USB drives, as used by Stuxnet's initial access method |\n\n## Tools & Systems\n\n- **Claroty xDome**: Continuous PLC logic monitoring with baseline comparison and change detection\n- **SIGA OT Solutions**: Physical signal monitoring at the electrical level for detecting process manipulation\n- **Nozomi Guardian**: OT monitoring with PLC program change detection capabilities\n- **Siemens SINEMA Remote Connect**: Secure remote access with PLC project version tracking\n\n## Output Format\n\n```\nStuxnet-Style Attack Detection Report\n========================================\nMonitored PLCs: [N]\nMonitoring Period: YYYY-MM-DD to YYYY-MM-DD\n\nPLC INTEGRITY:\n  Baselines verified: [N]\u002F[N]\n  Logic modifications detected: [N]\n  New blocks detected: [N]\n\nPHYSICS ANOMALIES:\n  Sensor correlation violations: [N]\n  Process model deviations: [N]\n\nENGINEERING WORKSTATION:\n  Unauthorized modifications: [N]\n  USB connections: [N]\n```\n",{"name":5,"tags":44,"capec":51,"model":52,"tools":53,"domain":32,"maxTurns":57,"nist_csf":58,"subdomain":63,"description":7,"mitre_attack":64},[45,22,46,47,48,20,49,50],"ot-security","scada","industrial-control","iec62443","plc-integrity","apt",[],"sonnet",[54,31,55,56],"Read","Glob","Grep",20,[59,60,61,62],"PR.IR-01","DE.CM-01","ID.AM-05","GV.OC-02","ot-ics-security",[65,66,67],"T0843","T0855","T1059","main","a91f1293287ffa9f4f1b8f486cd6e835a1568c84","skills\u002Findustrial\u002Fics\u002Fmalware\u002Fstuxnet\u002Fdetect","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace","https:\u002F\u002Fgithub.com\u002FDCx7C5","#Python","2026-09-01 11:21:00",{"source":8,"skillName":5,"commands":76,"prompt":86,"zipAvailable":87},[77,80,83],{"tool":78,"command":79},"npx","npx skills add DCx7C5\u002Fai-marketplace --skill ics-malware-stuxnet-detect",{"tool":81,"command":82},"bunx","bunx skills add DCx7C5\u002Fai-marketplace --skill ics-malware-stuxnet-detect",{"tool":84,"command":85},"pnpm","pnpm dlx skills add DCx7C5\u002Fai-marketplace --skill ics-malware-stuxnet-detect","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Findustrial\u002Fics\u002Fmalware\u002Fstuxnet\u002Fdetect\u002FSKILL.md",true,[89,95,99,103,109],{"path":90,"resourceType":91,"resourceTypeDesc":92,"sizeBytes":93,"sourceHtmlUrl":94},"index.json","REFERENCE","参考文档",1329,"https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Findustrial\u002Fics\u002Fmalware\u002Fstuxnet\u002Fdetect\u002Findex.json",{"path":96,"resourceType":91,"resourceTypeDesc":92,"sizeBytes":97,"sourceHtmlUrl":98},"references\u002Fapi-reference.md",2223,"https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Findustrial\u002Fics\u002Fmalware\u002Fstuxnet\u002Fdetect\u002Freferences\u002Fapi-reference.md",{"path":100,"resourceType":91,"resourceTypeDesc":92,"sizeBytes":101,"sourceHtmlUrl":102},"references\u002Findex.json",84,"https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Findustrial\u002Fics\u002Fmalware\u002Fstuxnet\u002Fdetect\u002Freferences\u002Findex.json",{"path":104,"resourceType":105,"resourceTypeDesc":106,"sizeBytes":107,"sourceHtmlUrl":108},"scripts\u002Fagent.py","SCRIPT","脚本",6272,"https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Findustrial\u002Fics\u002Fmalware\u002Fstuxnet\u002Fdetect\u002Fscripts\u002Fagent.py",{"path":110,"resourceType":105,"resourceTypeDesc":106,"sizeBytes":101,"sourceHtmlUrl":111},"scripts\u002Findex.json","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Findustrial\u002Fics\u002Fmalware\u002Fstuxnet\u002Fdetect\u002Fscripts\u002Findex.json",[113,135,156,177,199,215],{"skillNo":114,"name":115,"nameZh":6,"description":116,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":117,"categories":118,"keywords":119,"publishedAt":39},"01M71HAPZ01KQ30RKTB0FFSQ05","services-wmi-persistence-detect","Detect WMI event subscription persistence by enumerating ActiveScriptEventConsumer, CommandLineEventConsumer, and permanent subscriptions in the WMI repository.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fservices\u002Fwmi\u002Fpersistence\u002Fdetect\u002FSKILL.md",[],[120,23,121,122,123,27,34,124,125,126,127,128,129,130,131,132,133,32,134],"services","services wmi persistence detect","wmi","persistence","process","activescript","event","subscriptions","commandline-consumer","repository","subscription","event-subscription","t1546.003","forensics","process-forensics",{"skillNo":136,"name":137,"nameZh":6,"description":138,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":139,"categories":140,"keywords":141,"publishedAt":39},"01M71HAK6JTTTS229T17WJMMCG","services-wmi-exec-exploit","Perform lateral movement across Windows networks using WMI-based remote execution techniques including Impacket wmiexec.py, CrackMapExec, and native WMI commands for stealthy post-exploitation during red team engagements.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fservices\u002Fwmi\u002Fexec\u002Fexploit\u002FSKILL.md",[],[142,120,143,122,144,145,146,32,31,147,148,149,150,151,27,152,26,153,154,155],"exploit","services wmi exec exploit","exec","remote","traffic","analysis","team","across","crackmapexec","native","command","read","lateral-movement","Impacket",{"skillNo":157,"name":158,"nameZh":6,"description":159,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":160,"categories":161,"keywords":162,"publishedAt":39},"01M71HAG6MHKNQV8KDZKMT4886","registry-artifact-extract","Extract and analyze Windows Registry hives to uncover user activity, installed software, autostart entries, and evidence of system compromise.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fregistry\u002Fartifact\u002Fextract\u002FSKILL.md",[],[163,164,165,166,167,168,32,31,169,147,170,171,27,153,172,173,174,175,176,52],"artifact","registry","registry artifact extract","extract","evidence-collection","artifact-analysis","collection","analyze","uncover","software","activity","digital-forensics","windows-registry","regripper",{"skillNo":178,"name":179,"nameZh":6,"description":180,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":181,"categories":182,"keywords":183,"publishedAt":39},"01M71HACR4A8XTWTTSXK4124AA","processes-token-impersonate-detect","Detect Windows token impersonation and privilege abuse including SeImpersonatePrivilege exploitation via Potato attacks and token stealing techniques.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fprocesses\u002Ftoken\u002Fimpersonate\u002Fdetect\u002FSKILL.md",[],[23,184,185,186,187,188,189,34,190,32,134,191,192,193,194,195,196,197,198,27],"processes token impersonate detect","token","processes","attacks","windows","escalation","techniques","privilege-escalation","seimpersonate","token-impersonation","printspoofer","exploitation","potato","impersonation","via",{"skillNo":200,"name":201,"nameZh":6,"description":202,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":203,"categories":204,"keywords":205,"publishedAt":39},"01M71HAABSB4Z6QFSXEG00R4RK","processes-thread-injection-detect","Detect Windows thread injection techniques including CreateRemoteThread, QueueUserAPC, NtCreateThreadEx, and thread hijacking via process memory analysis.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fprocesses\u002Fthread\u002Finjection\u002Fdetect\u002FSKILL.md",[],[206,207,23,208,186,188,209,34,210,190,32,134,147,211,212,213,214,198,27,124],"thread","processes thread injection detect","injection","memory","process-injection","api","apc-injection","thread-injection","nt-api",{"skillNo":216,"name":217,"nameZh":6,"description":218,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":219,"categories":220,"keywords":221,"publishedAt":39},"01M71HA7H311V5G14WMX58HQSS","processes-hollow-technique-detect","Detect process hollowing (RunPE) by identifying processes with mismatched image paths between PEB and VAD tree, or unmapped PE headers in memory.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fprocesses\u002Fhollow\u002Ftechnique\u002Fdetect\u002FSKILL.md",[],[222,23,186,223,209,34,224,225,32,134,226,227,228,229,230,231,27,124,232,233],"processes hollow technique detect","tree","memory-forensics","process-hollow","peb","runpe","image","pe-header","in memory","with","mismatched","headers"]