[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M71DX7S53ZXZG2VR88V74WC4":3,"skill-same:01M71DX7S53ZXZG2VR88V74WC4":96},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":18,"publishedAt":39,"linkOnly":40,"markdownContent":41,"markdownBody":42,"frontMatter":43,"refName":69,"commitSha":70,"skillDirectory":71,"forksCount":14,"repositoryHtmlUrl":72,"repositoryHomepageUrl":6,"ownerHtmlUrl":73,"ownerBlogUrl":6,"ownerDescription":74,"updatedAt":75,"install":76,"resources":89},"01M71DX7S53ZXZG2VR88V74WC4","analysis-actorinfra-exploit",null,"Threat actor infrastructure tracking involves monitoring and mapping adversary-controlled assets including command-and-control (C2) servers, phishing domains, exploit kit hosts, bulletproof hosting, a","DCx7C5\u002Fai-marketplace","DCx7C5","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F42419559?v=4","01M71C01G2AZV3NTNGWAWSHJPP","DC","01M71C01GQW6G50S2BYMS7PP3E",0,"MIT","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fintel\u002Fanalysis\u002Factorinfra\u002Fexploit\u002FSKILL.md",[],[19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38],"analysis actorinfra exploit","analysis","exploit","read","hosts","kit","domains","de","mapping","intelligence","cm","cybersecurity","command","Bash","t1566","dns","command-and-control","threat-intelligence","mitre-attack","monitoring","2026-11-10 10:12:30",false,"---\nname: analysis-actorinfra-exploit\ndescription: Threat actor infrastructure tracking involves monitoring and mapping adversary-controlled assets including command-and-control (C2) servers, phishing domains, exploit kit hosts, bulletproof hosting, a\ndomain: cybersecurity\nsubdomain: threat-intelligence\ntags:\n- threat-intelligence\n- cti\n- ioc\n- mitre-attack\n- stix\n- infrastructure-tracking\n- shodan\n- censys\n- passive-dns\nnist_csf:\n- ID.RA-01\n- ID.RA-05\n- DE.CM-01\n- DE.AE-02\nmodel: sonnet\nmaxTurns: 20\ntools: [Read, Bash, Glob, Grep]\nmitre_attack:\n- T1046\n- T1071\n- T1566\n- T1596.002\ncapec: []\n---\n\n# Tracking Threat Actor Infrastructure\n\n## Overview\n\nThreat actor infrastructure tracking involves monitoring and mapping adversary-controlled assets including command-and-control (C2) servers, phishing domains, exploit kit hosts, bulletproof hosting, and staging servers. This skill covers using passive DNS, certificate transparency logs, Shodan\u002FCensys scanning, WHOIS analysis, and network fingerprinting to discover, track, and pivot across threat actor infrastructure over time.\n\n\n## When to Use\n\n- When managing security operations that require tracking threat actor infrastructure\n- When improving security program maturity and operational processes\n- When establishing standardized procedures for security team workflows\n- When integrating threat intelligence or vulnerability data into operations\n\n## Prerequisites\n\n- Python 3.9+ with `shodan`, `censys`, `requests`, `stix2` libraries\n- API keys: Shodan, Censys, VirusTotal, SecurityTrails, PassiveTotal\n- Understanding of DNS, TLS\u002FSSL certificates, IP allocation, ASN structure\n- Familiarity with passive DNS and certificate transparency concepts\n- Access to domain registration (WHOIS) lookup services\n\n## Key Concepts\n\n### Infrastructure Pivoting\nPivoting is the technique of using one known indicator to discover related infrastructure. Starting from a known C2 IP address, analysts can pivot via: passive DNS (find domains), reverse WHOIS (find related registrations), SSL certificates (find shared certs), SSH key fingerprints, HTTP response fingerprints, JARM\u002FJA3S hashes, and WHOIS registrant data.\n\n### Passive DNS\nPassive DNS databases record DNS query\u002Fresponse data observed at recursive resolvers. This allows analysts to find historical domain-to-IP mappings, discover domains hosted on a known C2 IP, and identify fast-flux or domain generation algorithm (DGA) behavior.\n\n### Certificate Transparency\nCertificate Transparency (CT) logs publicly record all SSL\u002FTLS certificates issued by CAs. Monitoring CT logs reveals new certificates registered for suspicious domains, helping identify phishing sites and C2 infrastructure before they become active.\n\n### Network Fingerprinting\n- **JARM**: Active TLS server fingerprint (hash of TLS handshake responses)\n- **JA3S**: Passive TLS server fingerprint (hash of Server Hello)\n- **HTTP Headers**: Server banners, custom headers, response patterns\n- **Favicon Hash**: Hash of HTTP favicon for server identification\n\n## Workflow\n\n### Step 1: Shodan Infrastructure Discovery\n\n```python\nimport shodan\n\napi = shodan.Shodan(\"YOUR_SHODAN_API_KEY\")\n\ndef discover_infrastructure(ip_address):\n    \"\"\"Discover services and metadata for a target IP.\"\"\"\n    try:\n        host = api.host(ip_address)\n        return {\n            \"ip\": host[\"ip_str\"],\n            \"org\": host.get(\"org\", \"\"),\n            \"asn\": host.get(\"asn\", \"\"),\n            \"isp\": host.get(\"isp\", \"\"),\n            \"country\": host.get(\"country_name\", \"\"),\n            \"city\": host.get(\"city\", \"\"),\n            \"os\": host.get(\"os\"),\n            \"ports\": host.get(\"ports\", []),\n            \"vulns\": host.get(\"vulns\", []),\n            \"hostnames\": host.get(\"hostnames\", []),\n            \"domains\": host.get(\"domains\", []),\n            \"tags\": host.get(\"tags\", []),\n            \"services\": [\n                {\n                    \"port\": svc.get(\"port\"),\n                    \"transport\": svc.get(\"transport\"),\n                    \"product\": svc.get(\"product\", \"\"),\n                    \"version\": svc.get(\"version\", \"\"),\n                    \"ssl_cert\": svc.get(\"ssl\", {}).get(\"cert\", {}).get(\"subject\", {}),\n                    \"jarm\": svc.get(\"ssl\", {}).get(\"jarm\", \"\"),\n                }\n                for svc in host.get(\"data\", [])\n            ],\n        }\n    except shodan.APIError as e:\n        print(f\"[-] Shodan error: {e}\")\n        return None\n\ndef search_c2_framework(framework_name):\n    \"\"\"Search Shodan for known C2 framework signatures.\"\"\"\n    c2_queries = {\n        \"cobalt-strike\": 'product:\"Cobalt Strike Beacon\"',\n        \"metasploit\": 'product:\"Metasploit\"',\n        \"covenant\": 'http.html:\"Covenant\" http.title:\"Covenant\"',\n        \"sliver\": 'ssl.cert.subject.cn:\"multiplayer\" ssl.cert.issuer.cn:\"operators\"',\n        \"havoc\": 'http.html_hash:-1472705893',\n    }\n\n    query = c2_queries.get(framework_name.lower(), framework_name)\n    results = api.search(query, limit=100)\n\n    hosts = []\n    for match in results.get(\"matches\", []):\n        hosts.append({\n            \"ip\": match[\"ip_str\"],\n            \"port\": match[\"port\"],\n            \"org\": match.get(\"org\", \"\"),\n            \"country\": match.get(\"location\", {}).get(\"country_name\", \"\"),\n            \"asn\": match.get(\"asn\", \"\"),\n            \"timestamp\": match.get(\"timestamp\", \"\"),\n        })\n\n    return hosts\n```\n\n### Step 2: Passive DNS Pivoting\n\n```python\nimport requests\n\ndef passive_dns_lookup(indicator, api_key, indicator_type=\"ip\"):\n    \"\"\"Query SecurityTrails for passive DNS records.\"\"\"\n    base_url = \"https:\u002F\u002Fapi.securitytrails.com\u002Fv1\"\n    headers = {\"APIKEY\": api_key, \"Accept\": \"application\u002Fjson\"}\n\n    if indicator_type == \"ip\":\n        url = f\"{base_url}\u002Fsearch\u002Flist\"\n        payload = {\n            \"filter\": {\"ipv4\": indicator}\n        }\n        resp = requests.post(url, json=payload, headers=headers, timeout=30)\n    else:\n        url = f\"{base_url}\u002Fdomain\u002F{indicator}\u002Fsubdomains\"\n        resp = requests.get(url, headers=headers, timeout=30)\n\n    if resp.status_code == 200:\n        return resp.json()\n    return None\n\n\ndef query_passive_total(indicator, user, api_key):\n    \"\"\"Query PassiveTotal for passive DNS and WHOIS data.\"\"\"\n    base_url = \"https:\u002F\u002Fapi.passivetotal.org\u002Fv2\"\n    auth = (user, api_key)\n\n    # Passive DNS\n    pdns_resp = requests.get(\n        f\"{base_url}\u002Fdns\u002Fpassive\",\n        params={\"query\": indicator},\n        auth=auth,\n        timeout=30,\n    )\n\n    # WHOIS\n    whois_resp = requests.get(\n        f\"{base_url}\u002Fwhois\",\n        params={\"query\": indicator},\n        auth=auth,\n        timeout=30,\n    )\n\n    results = {}\n    if pdns_resp.status_code == 200:\n        results[\"passive_dns\"] = pdns_resp.json().get(\"results\", [])\n    if whois_resp.status_code == 200:\n        results[\"whois\"] = whois_resp.json()\n\n    return results\n```\n\n### Step 3: Certificate Transparency Monitoring\n\n```python\nimport requests\n\ndef search_ct_logs(domain):\n    \"\"\"Search Certificate Transparency logs via crt.sh.\"\"\"\n    resp = requests.get(\n        f\"https:\u002F\u002Fcrt.sh\u002F?q=%.{domain}&output=json\",\n        timeout=30,\n    )\n\n    if resp.status_code == 200:\n        certs = resp.json()\n        unique_domains = set()\n        cert_info = []\n\n        for cert in certs:\n            name_value = cert.get(\"name_value\", \"\")\n            for name in name_value.split(\"\\n\"):\n                unique_domains.add(name.strip())\n\n            cert_info.append({\n                \"id\": cert.get(\"id\"),\n                \"issuer\": cert.get(\"issuer_name\", \"\"),\n                \"common_name\": cert.get(\"common_name\", \"\"),\n                \"name_value\": name_value,\n                \"not_before\": cert.get(\"not_before\", \"\"),\n                \"not_after\": cert.get(\"not_after\", \"\"),\n                \"serial_number\": cert.get(\"serial_number\", \"\"),\n            })\n\n        return {\n            \"domain\": domain,\n            \"total_certificates\": len(certs),\n            \"unique_domains\": sorted(unique_domains),\n            \"certificates\": cert_info[:50],\n        }\n    return None\n\n\ndef monitor_new_certs(domains, interval_hours=1):\n    \"\"\"Monitor for newly issued certificates for a list of domains.\"\"\"\n    from datetime import datetime, timedelta\n\n    cutoff = (datetime.utcnow() - timedelta(hours=interval_hours)).isoformat()\n    new_certs = []\n\n    for domain in domains:\n        result = search_ct_logs(domain)\n        if result:\n            for cert in result.get(\"certificates\", []):\n                if cert.get(\"not_before\", \"\") > cutoff:\n                    new_certs.append({\n                        \"domain\": domain,\n                        \"cert\": cert,\n                    })\n\n    return new_certs\n```\n\n### Step 4: Infrastructure Correlation and Timeline\n\n```python\nfrom datetime import datetime\n\ndef build_infrastructure_timeline(indicators):\n    \"\"\"Build a timeline of infrastructure changes.\"\"\"\n    timeline = []\n\n    for ind in indicators:\n        if \"passive_dns\" in ind:\n            for record in ind[\"passive_dns\"]:\n                timeline.append({\n                    \"timestamp\": record.get(\"firstSeen\", \"\"),\n                    \"event\": \"dns_resolution\",\n                    \"source\": record.get(\"resolve\", \"\"),\n                    \"target\": record.get(\"value\", \"\"),\n                    \"record_type\": record.get(\"recordType\", \"\"),\n                })\n\n        if \"certificates\" in ind:\n            for cert in ind[\"certificates\"]:\n                timeline.append({\n                    \"timestamp\": cert.get(\"not_before\", \"\"),\n                    \"event\": \"certificate_issued\",\n                    \"domain\": cert.get(\"common_name\", \"\"),\n                    \"issuer\": cert.get(\"issuer\", \"\"),\n                })\n\n    timeline.sort(key=lambda x: x.get(\"timestamp\", \"\"))\n    return timeline\n```\n\n## Validation Criteria\n\n- Shodan\u002FCensys queries return infrastructure details for target IPs\n- Passive DNS reveals historical domain-IP mappings\n- Certificate transparency search finds associated domains\n- Infrastructure pivoting discovers new related indicators\n- Timeline shows infrastructure evolution over time\n- Results are exportable as STIX 2.1 Infrastructure objects\n\n## References\n\n- [Shodan API Documentation](https:\u002F\u002Fdeveloper.shodan.io\u002Fapi)\n- [Censys Search API](https:\u002F\u002Fsearch.censys.io\u002Fapi)\n- [SecurityTrails API](https:\u002F\u002Fsecuritytrails.com\u002Fcorp\u002Fapi)\n- [crt.sh Certificate Transparency](https:\u002F\u002Fcrt.sh\u002F)\n- [PassiveTotal API](https:\u002F\u002Fapi.passivetotal.org\u002Fapi\u002Fdocs\u002F)\n- [JARM Fingerprinting](https:\u002F\u002Fgithub.com\u002Fsalesforce\u002Fjarm)\n","# Tracking Threat Actor Infrastructure\n\n## Overview\n\nThreat actor infrastructure tracking involves monitoring and mapping adversary-controlled assets including command-and-control (C2) servers, phishing domains, exploit kit hosts, bulletproof hosting, and staging servers. This skill covers using passive DNS, certificate transparency logs, Shodan\u002FCensys scanning, WHOIS analysis, and network fingerprinting to discover, track, and pivot across threat actor infrastructure over time.\n\n\n## When to Use\n\n- When managing security operations that require tracking threat actor infrastructure\n- When improving security program maturity and operational processes\n- When establishing standardized procedures for security team workflows\n- When integrating threat intelligence or vulnerability data into operations\n\n## Prerequisites\n\n- Python 3.9+ with `shodan`, `censys`, `requests`, `stix2` libraries\n- API keys: Shodan, Censys, VirusTotal, SecurityTrails, PassiveTotal\n- Understanding of DNS, TLS\u002FSSL certificates, IP allocation, ASN structure\n- Familiarity with passive DNS and certificate transparency concepts\n- Access to domain registration (WHOIS) lookup services\n\n## Key Concepts\n\n### Infrastructure Pivoting\nPivoting is the technique of using one known indicator to discover related infrastructure. Starting from a known C2 IP address, analysts can pivot via: passive DNS (find domains), reverse WHOIS (find related registrations), SSL certificates (find shared certs), SSH key fingerprints, HTTP response fingerprints, JARM\u002FJA3S hashes, and WHOIS registrant data.\n\n### Passive DNS\nPassive DNS databases record DNS query\u002Fresponse data observed at recursive resolvers. This allows analysts to find historical domain-to-IP mappings, discover domains hosted on a known C2 IP, and identify fast-flux or domain generation algorithm (DGA) behavior.\n\n### Certificate Transparency\nCertificate Transparency (CT) logs publicly record all SSL\u002FTLS certificates issued by CAs. Monitoring CT logs reveals new certificates registered for suspicious domains, helping identify phishing sites and C2 infrastructure before they become active.\n\n### Network Fingerprinting\n- **JARM**: Active TLS server fingerprint (hash of TLS handshake responses)\n- **JA3S**: Passive TLS server fingerprint (hash of Server Hello)\n- **HTTP Headers**: Server banners, custom headers, response patterns\n- **Favicon Hash**: Hash of HTTP favicon for server identification\n\n## Workflow\n\n### Step 1: Shodan Infrastructure Discovery\n\n```python\nimport shodan\n\napi = shodan.Shodan(\"YOUR_SHODAN_API_KEY\")\n\ndef discover_infrastructure(ip_address):\n    \"\"\"Discover services and metadata for a target IP.\"\"\"\n    try:\n        host = api.host(ip_address)\n        return {\n            \"ip\": host[\"ip_str\"],\n            \"org\": host.get(\"org\", \"\"),\n            \"asn\": host.get(\"asn\", \"\"),\n            \"isp\": host.get(\"isp\", \"\"),\n            \"country\": host.get(\"country_name\", \"\"),\n            \"city\": host.get(\"city\", \"\"),\n            \"os\": host.get(\"os\"),\n            \"ports\": host.get(\"ports\", []),\n            \"vulns\": host.get(\"vulns\", []),\n            \"hostnames\": host.get(\"hostnames\", []),\n            \"domains\": host.get(\"domains\", []),\n            \"tags\": host.get(\"tags\", []),\n            \"services\": [\n                {\n                    \"port\": svc.get(\"port\"),\n                    \"transport\": svc.get(\"transport\"),\n                    \"product\": svc.get(\"product\", \"\"),\n                    \"version\": svc.get(\"version\", \"\"),\n                    \"ssl_cert\": svc.get(\"ssl\", {}).get(\"cert\", {}).get(\"subject\", {}),\n                    \"jarm\": svc.get(\"ssl\", {}).get(\"jarm\", \"\"),\n                }\n                for svc in host.get(\"data\", [])\n            ],\n        }\n    except shodan.APIError as e:\n        print(f\"[-] Shodan error: {e}\")\n        return None\n\ndef search_c2_framework(framework_name):\n    \"\"\"Search Shodan for known C2 framework signatures.\"\"\"\n    c2_queries = {\n        \"cobalt-strike\": 'product:\"Cobalt Strike Beacon\"',\n        \"metasploit\": 'product:\"Metasploit\"',\n        \"covenant\": 'http.html:\"Covenant\" http.title:\"Covenant\"',\n        \"sliver\": 'ssl.cert.subject.cn:\"multiplayer\" ssl.cert.issuer.cn:\"operators\"',\n        \"havoc\": 'http.html_hash:-1472705893',\n    }\n\n    query = c2_queries.get(framework_name.lower(), framework_name)\n    results = api.search(query, limit=100)\n\n    hosts = []\n    for match in results.get(\"matches\", []):\n        hosts.append({\n            \"ip\": match[\"ip_str\"],\n            \"port\": match[\"port\"],\n            \"org\": match.get(\"org\", \"\"),\n            \"country\": match.get(\"location\", {}).get(\"country_name\", \"\"),\n            \"asn\": match.get(\"asn\", \"\"),\n            \"timestamp\": match.get(\"timestamp\", \"\"),\n        })\n\n    return hosts\n```\n\n### Step 2: Passive DNS Pivoting\n\n```python\nimport requests\n\ndef passive_dns_lookup(indicator, api_key, indicator_type=\"ip\"):\n    \"\"\"Query SecurityTrails for passive DNS records.\"\"\"\n    base_url = \"https:\u002F\u002Fapi.securitytrails.com\u002Fv1\"\n    headers = {\"APIKEY\": api_key, \"Accept\": \"application\u002Fjson\"}\n\n    if indicator_type == \"ip\":\n        url = f\"{base_url}\u002Fsearch\u002Flist\"\n        payload = {\n            \"filter\": {\"ipv4\": indicator}\n        }\n        resp = requests.post(url, json=payload, headers=headers, timeout=30)\n    else:\n        url = f\"{base_url}\u002Fdomain\u002F{indicator}\u002Fsubdomains\"\n        resp = requests.get(url, headers=headers, timeout=30)\n\n    if resp.status_code == 200:\n        return resp.json()\n    return None\n\n\ndef query_passive_total(indicator, user, api_key):\n    \"\"\"Query PassiveTotal for passive DNS and WHOIS data.\"\"\"\n    base_url = \"https:\u002F\u002Fapi.passivetotal.org\u002Fv2\"\n    auth = (user, api_key)\n\n    # Passive DNS\n    pdns_resp = requests.get(\n        f\"{base_url}\u002Fdns\u002Fpassive\",\n        params={\"query\": indicator},\n        auth=auth,\n        timeout=30,\n    )\n\n    # WHOIS\n    whois_resp = requests.get(\n        f\"{base_url}\u002Fwhois\",\n        params={\"query\": indicator},\n        auth=auth,\n        timeout=30,\n    )\n\n    results = {}\n    if pdns_resp.status_code == 200:\n        results[\"passive_dns\"] = pdns_resp.json().get(\"results\", [])\n    if whois_resp.status_code == 200:\n        results[\"whois\"] = whois_resp.json()\n\n    return results\n```\n\n### Step 3: Certificate Transparency Monitoring\n\n```python\nimport requests\n\ndef search_ct_logs(domain):\n    \"\"\"Search Certificate Transparency logs via crt.sh.\"\"\"\n    resp = requests.get(\n        f\"https:\u002F\u002Fcrt.sh\u002F?q=%.{domain}&output=json\",\n        timeout=30,\n    )\n\n    if resp.status_code == 200:\n        certs = resp.json()\n        unique_domains = set()\n        cert_info = []\n\n        for cert in certs:\n            name_value = cert.get(\"name_value\", \"\")\n            for name in name_value.split(\"\\n\"):\n                unique_domains.add(name.strip())\n\n            cert_info.append({\n                \"id\": cert.get(\"id\"),\n                \"issuer\": cert.get(\"issuer_name\", \"\"),\n                \"common_name\": cert.get(\"common_name\", \"\"),\n                \"name_value\": name_value,\n                \"not_before\": cert.get(\"not_before\", \"\"),\n                \"not_after\": cert.get(\"not_after\", \"\"),\n                \"serial_number\": cert.get(\"serial_number\", \"\"),\n            })\n\n        return {\n            \"domain\": domain,\n            \"total_certificates\": len(certs),\n            \"unique_domains\": sorted(unique_domains),\n            \"certificates\": cert_info[:50],\n        }\n    return None\n\n\ndef monitor_new_certs(domains, interval_hours=1):\n    \"\"\"Monitor for newly issued certificates for a list of domains.\"\"\"\n    from datetime import datetime, timedelta\n\n    cutoff = (datetime.utcnow() - timedelta(hours=interval_hours)).isoformat()\n    new_certs = []\n\n    for domain in domains:\n        result = search_ct_logs(domain)\n        if result:\n            for cert in result.get(\"certificates\", []):\n                if cert.get(\"not_before\", \"\") > cutoff:\n                    new_certs.append({\n                        \"domain\": domain,\n                        \"cert\": cert,\n                    })\n\n    return new_certs\n```\n\n### Step 4: Infrastructure Correlation and Timeline\n\n```python\nfrom datetime import datetime\n\ndef build_infrastructure_timeline(indicators):\n    \"\"\"Build a timeline of infrastructure changes.\"\"\"\n    timeline = []\n\n    for ind in indicators:\n        if \"passive_dns\" in ind:\n            for record in ind[\"passive_dns\"]:\n                timeline.append({\n                    \"timestamp\": record.get(\"firstSeen\", \"\"),\n                    \"event\": \"dns_resolution\",\n                    \"source\": record.get(\"resolve\", \"\"),\n                    \"target\": record.get(\"value\", \"\"),\n                    \"record_type\": record.get(\"recordType\", \"\"),\n                })\n\n        if \"certificates\" in ind:\n            for cert in ind[\"certificates\"]:\n                timeline.append({\n                    \"timestamp\": cert.get(\"not_before\", \"\"),\n                    \"event\": \"certificate_issued\",\n                    \"domain\": cert.get(\"common_name\", \"\"),\n                    \"issuer\": cert.get(\"issuer\", \"\"),\n                })\n\n    timeline.sort(key=lambda x: x.get(\"timestamp\", \"\"))\n    return timeline\n```\n\n## Validation Criteria\n\n- Shodan\u002FCensys queries return infrastructure details for target IPs\n- Passive DNS reveals historical domain-IP mappings\n- Certificate transparency search finds associated domains\n- Infrastructure pivoting discovers new related indicators\n- Timeline shows infrastructure evolution over time\n- Results are exportable as STIX 2.1 Infrastructure objects\n\n## References\n\n- [Shodan API Documentation](https:\u002F\u002Fdeveloper.shodan.io\u002Fapi)\n- [Censys Search API](https:\u002F\u002Fsearch.censys.io\u002Fapi)\n- [SecurityTrails API](https:\u002F\u002Fsecuritytrails.com\u002Fcorp\u002Fapi)\n- [crt.sh Certificate Transparency](https:\u002F\u002Fcrt.sh\u002F)\n- [PassiveTotal API](https:\u002F\u002Fapi.passivetotal.org\u002Fapi\u002Fdocs\u002F)\n- [JARM Fingerprinting](https:\u002F\u002Fgithub.com\u002Fsalesforce\u002Fjarm)\n",{"name":5,"tags":44,"capec":52,"model":53,"tools":54,"domain":30,"maxTurns":58,"nist_csf":59,"subdomain":36,"description":7,"mitre_attack":64},[36,45,46,37,47,48,49,50,51],"cti","ioc","stix","infrastructure-tracking","shodan","censys","passive-dns",[],"sonnet",[55,32,56,57],"Read","Glob","Grep",20,[60,61,62,63],"ID.RA-01","ID.RA-05","DE.CM-01","DE.AE-02",[65,66,67,68],"T1046","T1071","T1566","T1596.002","main","a91f1293287ffa9f4f1b8f486cd6e835a1568c84","skills\u002Fintel\u002Fanalysis\u002Factorinfra\u002Fexploit","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace","https:\u002F\u002Fgithub.com\u002FDCx7C5","#Python","2026-09-01 11:21:00",{"source":8,"skillName":5,"commands":77,"prompt":87,"zipAvailable":88},[78,81,84],{"tool":79,"command":80},"npx","npx skills add DCx7C5\u002Fai-marketplace --skill analysis-actorinfra-exploit",{"tool":82,"command":83},"bunx","bunx skills add DCx7C5\u002Fai-marketplace --skill analysis-actorinfra-exploit",{"tool":85,"command":86},"pnpm","pnpm dlx skills add DCx7C5\u002Fai-marketplace --skill analysis-actorinfra-exploit","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fintel\u002Fanalysis\u002Factorinfra\u002Fexploit\u002FSKILL.md",true,[90],{"path":91,"resourceType":92,"resourceTypeDesc":93,"sizeBytes":94,"sourceHtmlUrl":95},"index.json","REFERENCE","参考文档",692,"https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fintel\u002Fanalysis\u002Factorinfra\u002Fexploit\u002Findex.json",[97,120,138,159,181,197],{"skillNo":98,"name":99,"nameZh":6,"description":100,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":101,"categories":102,"keywords":103,"publishedAt":39},"01M71HAPZ01KQ30RKTB0FFSQ05","services-wmi-persistence-detect","Detect WMI event subscription persistence by enumerating ActiveScriptEventConsumer, CommandLineEventConsumer, and permanent subscriptions in the WMI repository.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fservices\u002Fwmi\u002Fpersistence\u002Fdetect\u002FSKILL.md",[],[104,105,106,107,108,26,29,109,110,111,112,113,114,115,116,117,118,30,119],"services","detect","services wmi persistence detect","wmi","persistence","process","activescript","event","subscriptions","commandline-consumer","repository","subscription","event-subscription","t1546.003","forensics","process-forensics",{"skillNo":121,"name":122,"nameZh":6,"description":123,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":124,"categories":125,"keywords":126,"publishedAt":39},"01M71HAK6JTTTS229T17WJMMCG","services-wmi-exec-exploit","Perform lateral movement across Windows networks using WMI-based remote execution techniques including Impacket wmiexec.py, CrackMapExec, and native WMI commands for stealthy post-exploitation during red team engagements.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fservices\u002Fwmi\u002Fexec\u002Fexploit\u002FSKILL.md",[],[21,104,127,107,128,129,130,30,32,20,131,132,133,134,26,31,135,22,136,137],"services wmi exec exploit","exec","remote","traffic","team","across","crackmapexec","native","lateral movement","lateral-movement","Impacket",{"skillNo":139,"name":140,"nameZh":6,"description":141,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":142,"categories":143,"keywords":144,"publishedAt":39},"01M71HAG6MHKNQV8KDZKMT4886","registry-artifact-extract","Extract and analyze Windows Registry hives to uncover user activity, installed software, autostart entries, and evidence of system compromise.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fregistry\u002Fartifact\u002Fextract\u002FSKILL.md",[],[145,146,147,148,149,150,30,32,151,20,152,153,26,22,154,155,156,157,158,53],"artifact","registry","registry artifact extract","extract","evidence-collection","artifact-analysis","collection","analyze","uncover","software","activity","digital-forensics","windows-registry","regripper",{"skillNo":160,"name":161,"nameZh":6,"description":162,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":163,"categories":164,"keywords":165,"publishedAt":39},"01M71HACR4A8XTWTTSXK4124AA","processes-token-impersonate-detect","Detect Windows token impersonation and privilege abuse including SeImpersonatePrivilege exploitation via Potato attacks and token stealing techniques.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fprocesses\u002Ftoken\u002Fimpersonate\u002Fdetect\u002FSKILL.md",[],[105,166,167,168,169,170,171,29,172,30,119,173,174,175,176,177,178,179,180,26],"processes token impersonate detect","token","processes","attacks","windows","escalation","techniques","privilege-escalation","seimpersonate","token-impersonation","printspoofer","exploitation","potato","impersonation","via",{"skillNo":182,"name":183,"nameZh":6,"description":184,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":185,"categories":186,"keywords":187,"publishedAt":39},"01M71HAABSB4Z6QFSXEG00R4RK","processes-thread-injection-detect","Detect Windows thread injection techniques including CreateRemoteThread, QueueUserAPC, NtCreateThreadEx, and thread hijacking via process memory analysis.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fprocesses\u002Fthread\u002Finjection\u002Fdetect\u002FSKILL.md",[],[188,189,105,190,168,170,191,29,192,172,30,119,20,193,194,195,196,180,26,109],"thread","processes thread injection detect","injection","memory","process-injection","api","apc-injection","thread-injection","nt-api",{"skillNo":198,"name":199,"nameZh":6,"description":200,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":201,"categories":202,"keywords":203,"publishedAt":39},"01M71HA7H311V5G14WMX58HQSS","processes-hollow-technique-detect","Detect process hollowing (RunPE) by identifying processes with mismatched image paths between PEB and VAD tree, or unmapped PE headers in memory.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fprocesses\u002Fhollow\u002Ftechnique\u002Fdetect\u002FSKILL.md",[],[204,105,168,205,191,29,206,207,30,119,208,209,210,211,212,213,26,109,214,215],"processes hollow technique detect","tree","memory-forensics","process-hollow","peb","runpe","image","pe-header","in memory","with","mismatched","headers"]