[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M71EMN8EAE36Y0WYQPACT991":3,"skill-same:01M71EMN8EAE36Y0WYQPACT991":100},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":18,"publishedAt":39,"linkOnly":40,"markdownContent":41,"markdownBody":42,"frontMatter":43,"refName":73,"commitSha":74,"skillDirectory":75,"forksCount":14,"repositoryHtmlUrl":76,"repositoryHomepageUrl":6,"ownerHtmlUrl":77,"ownerBlogUrl":6,"ownerDescription":78,"updatedAt":79,"install":80,"resources":93},"01M71EMN8EAE36Y0WYQPACT991","forensics-memory-injection-sysmon-detect",null,"Detect process injection techniques (T1055) including classic DLL injection, process hollowing, and APC injection by analyzing Sysmon events for cross-process memory operations, remote thread creation, and anomalous DLL loading patterns.","DCx7C5\u002Fai-marketplace","DCx7C5","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F42419559?v=4","01M71C01G2AZV3NTNGWAWSHJPP","DC","01M71C01GQW6G50S2BYMS7PP3E",0,"MIT","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Flinux\u002Fforensics\u002Fmemory\u002Finjection\u002Fsysmon\u002Fdetect\u002FSKILL.md",[],[19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38],"forensics memory injection sysmon detect","sysmon","injection","detect","forensics","memory","threat-hunting","read","de","hunting","conversion","defense-evasion","analysis","Bash","cybersecurity","content analysis","remote","cm","loading","creation","2026-11-10 10:12:30",false,"---\nname: forensics-memory-injection-sysmon-detect\ndescription: Detect process injection techniques (T1055) including classic DLL injection, process hollowing, and APC injection by analyzing Sysmon events for cross-process memory operations, remote thread creation, and anomalous DLL loading patterns.\ndomain: cybersecurity\nsubdomain: threat-hunting\ntags:\n- threat-hunting\n- process-injection\n- sysmon\n- mitre-t1055\n- defense-evasion\n- dll-injection\n- process-hollowing\nd3fend_techniques:\n- Executable Denylisting\n- Execution Isolation\n- File Metadata Consistency Validation\n- Content Format Conversion\n- File Content Analysis\nnist_csf:\n- DE.CM-01\n- DE.AE-02\n- DE.AE-07\n- ID.RA-05\nmodel: sonnet\nmaxTurns: 20\ntools: [Read, Bash, Glob, Grep]\nmitre_attack:\n- T1027\n- T1055\n- T1055.001\n- T1055.012\n- T1059\ncapec: []\n---\n\n# Detecting T1055 Process Injection with Sysmon\n\n## When to Use\n\n- When hunting for defense evasion techniques that hide malicious code inside legitimate processes\n- After EDR alerts for suspicious cross-process memory access or remote thread creation\n- When investigating malware that injects into svchost.exe, explorer.exe, or other system processes\n- During purple team exercises testing detection of process injection variants\n- When validating Sysmon configuration coverage for injection detection\n\n## Prerequisites\n\n- Sysmon deployed with comprehensive configuration capturing Events 1, 7, 8, 10, 25\n- Event ID 8 (CreateRemoteThread) enabled for remote thread detection\n- Event ID 10 (ProcessAccess) configured with appropriate access mask filters\n- Event ID 7 (ImageLoaded) for DLL injection detection\n- Event ID 25 (ProcessTampering) for process hollowing on Sysmon 13+\n- SIEM platform for correlation and alerting\n\n## Workflow\n\n1. **Monitor CreateRemoteThread (Event 8)**: Detect when one process creates a thread in another process's address space. This is the primary indicator of classic DLL injection and shellcode injection.\n2. **Analyze ProcessAccess (Event 10)**: Track cross-process handle requests with PROCESS_VM_WRITE (0x0020), PROCESS_VM_OPERATION (0x0008), and PROCESS_CREATE_THREAD (0x0002) access rights. Legitimate processes rarely need these on other processes.\n3. **Detect Anomalous DLL Loading (Event 7)**: Identify DLLs loaded from unusual paths (user temp directories, download folders) into system processes.\n4. **Hunt Process Hollowing (Event 25)**: Sysmon 13+ generates ProcessTampering events when the executable image in memory diverges from what was mapped from disk -- a hallmark of process hollowing (T1055.012).\n5. **Correlate with Process Creation**: Link injection events to the originating process creation (Event 1) to build the full attack chain from initial execution to injection.\n6. **Filter Known-Good Cross-Process Activity**: Exclude legitimate software that performs cross-process operations (debuggers, AV products, accessibility tools, RMM agents).\n7. **Map to ATT&CK Sub-Techniques**: Classify detected injection as classic injection (T1055.001), PE injection (T1055.002), thread execution hijacking (T1055.003), APC injection (T1055.004), thread local storage (T1055.005), process hollowing (T1055.012), or process doppelganging (T1055.013).\n\n## Key Concepts\n\n| Concept | Description |\n|---------|-------------|\n| T1055.001 | Dynamic-link Library Injection |\n| T1055.002 | Portable Executable Injection |\n| T1055.003 | Thread Execution Hijacking |\n| T1055.004 | Asynchronous Procedure Call (APC) Injection |\n| T1055.005 | Thread Local Storage |\n| T1055.012 | Process Hollowing |\n| T1055.013 | Process Doppelganging |\n| T1055.015 | ListPlanting |\n| Sysmon Event 8 | CreateRemoteThread detected |\n| Sysmon Event 10 | ProcessAccess with memory write permissions |\n| Sysmon Event 25 | ProcessTampering (image mismatch) |\n| Access Mask 0x1FFFFF | PROCESS_ALL_ACCESS -- full cross-process control |\n\n## Tools & Systems\n\n| Tool | Purpose |\n|------|---------|\n| Sysmon | Primary telemetry source for injection detection |\n| Process Hacker | Manual investigation of process memory regions |\n| PE-sieve | Scan running processes for hollowed\u002Finjected code |\n| Moneta | Detect anomalous memory regions in processes |\n| Splunk \u002F Elastic | SIEM correlation of Sysmon events |\n| Volatility | Memory forensics for injection artifacts |\n| Hollows Hunter | Automated scan for hollowed processes |\n\n## Detection Queries\n\n### Splunk -- Remote Thread Creation\n```spl\nindex=sysmon EventCode=8\n| where SourceImage!=TargetImage\n| where NOT match(SourceImage, \"(?i)(csrss|lsass|services|svchost|MsMpEng|SecurityHealthService|vmtoolsd)\\.exe$\")\n| eval suspicious=if(match(TargetImage, \"(?i)(svchost|explorer|lsass|winlogon|csrss|services)\\.exe$\"), \"high_value_target\", \"normal_target\")\n| where suspicious=\"high_value_target\"\n| table _time Computer SourceImage SourceProcessId TargetImage TargetProcessId StartFunction NewThreadId\n```\n\n### Splunk -- Suspicious ProcessAccess Patterns\n```spl\nindex=sysmon EventCode=10\n| where SourceImage!=TargetImage\n| where match(GrantedAccess, \"(0x1FFFFF|0x1F3FFF|0x143A|0x0040)\")\n| where match(TargetImage, \"(?i)(lsass|svchost|explorer|winlogon)\\.exe$\")\n| where NOT match(SourceImage, \"(?i)(MsMpEng|csrss|services|svchost|taskmgr|procexp)\\.exe$\")\n| table _time Computer SourceImage TargetImage GrantedAccess CallTrace\n```\n\n### KQL -- Process Injection via Remote Thread\n```kql\nDeviceEvents\n| where Timestamp > ago(7d)\n| where ActionType == \"CreateRemoteThreadApiCall\"\n| where InitiatingProcessFileName !in~ (\"csrss.exe\", \"lsass.exe\", \"services.exe\", \"svchost.exe\")\n| where FileName in~ (\"svchost.exe\", \"explorer.exe\", \"lsass.exe\", \"winlogon.exe\")\n| project Timestamp, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine,\n    FileName, ProcessCommandLine\n```\n\n### Sigma Rule -- Process Injection Detection\n```yaml\ntitle: Process Injection via CreateRemoteThread into System Process\nstatus: stable\nlogsource:\n    product: windows\n    category: create_remote_thread\ndetection:\n    selection:\n        TargetImage|endswith:\n            - '\\svchost.exe'\n            - '\\explorer.exe'\n            - '\\lsass.exe'\n            - '\\winlogon.exe'\n    filter_legitimate:\n        SourceImage|endswith:\n            - '\\csrss.exe'\n            - '\\lsass.exe'\n            - '\\services.exe'\n            - '\\MsMpEng.exe'\n    condition: selection and not filter_legitimate\nlevel: high\ntags:\n    - attack.defense_evasion\n    - attack.t1055\n```\n\n## Common Scenarios\n\n1. **Classic DLL Injection**: Malware uses VirtualAllocEx + WriteProcessMemory + CreateRemoteThread to load a malicious DLL into a target process. Detected via Sysmon Event 8.\n2. **Process Hollowing (RunPE)**: Attacker creates a suspended process, unmaps its image, writes malicious PE, and resumes execution. Detected via Sysmon Event 25.\n3. **APC Injection**: Malware queues an Asynchronous Procedure Call to threads of a target process using QueueUserAPC. Harder to detect, requires Event 10 monitoring.\n4. **Reflective DLL Injection**: DLL is loaded directly from memory without touching disk, bypassing ImageLoaded detection. Requires memory-level analysis.\n5. **Process Doppelganging**: Leverages NTFS transactions to replace a legitimate process image. Detected via process integrity checking.\n\n## Output Format\n\n```\nHunt ID: TH-INJECT-[DATE]-[SEQ]\nHost: [Hostname]\nSource Process: [Injecting process path]\nSource PID: [Process ID]\nTarget Process: [Target process path]\nTarget PID: [Process ID]\nInjection Type: [DLL\u002FShellcode\u002FHollowing\u002FAPC]\nSysmon Events: [Event IDs triggered]\nAccess Mask: [Granted access value]\nRisk Level: [Critical\u002FHigh\u002FMedium\u002FLow]\nATT&CK Sub-Technique: [T1055.xxx]\n```\n","# Detecting T1055 Process Injection with Sysmon\n\n## When to Use\n\n- When hunting for defense evasion techniques that hide malicious code inside legitimate processes\n- After EDR alerts for suspicious cross-process memory access or remote thread creation\n- When investigating malware that injects into svchost.exe, explorer.exe, or other system processes\n- During purple team exercises testing detection of process injection variants\n- When validating Sysmon configuration coverage for injection detection\n\n## Prerequisites\n\n- Sysmon deployed with comprehensive configuration capturing Events 1, 7, 8, 10, 25\n- Event ID 8 (CreateRemoteThread) enabled for remote thread detection\n- Event ID 10 (ProcessAccess) configured with appropriate access mask filters\n- Event ID 7 (ImageLoaded) for DLL injection detection\n- Event ID 25 (ProcessTampering) for process hollowing on Sysmon 13+\n- SIEM platform for correlation and alerting\n\n## Workflow\n\n1. **Monitor CreateRemoteThread (Event 8)**: Detect when one process creates a thread in another process's address space. This is the primary indicator of classic DLL injection and shellcode injection.\n2. **Analyze ProcessAccess (Event 10)**: Track cross-process handle requests with PROCESS_VM_WRITE (0x0020), PROCESS_VM_OPERATION (0x0008), and PROCESS_CREATE_THREAD (0x0002) access rights. Legitimate processes rarely need these on other processes.\n3. **Detect Anomalous DLL Loading (Event 7)**: Identify DLLs loaded from unusual paths (user temp directories, download folders) into system processes.\n4. **Hunt Process Hollowing (Event 25)**: Sysmon 13+ generates ProcessTampering events when the executable image in memory diverges from what was mapped from disk -- a hallmark of process hollowing (T1055.012).\n5. **Correlate with Process Creation**: Link injection events to the originating process creation (Event 1) to build the full attack chain from initial execution to injection.\n6. **Filter Known-Good Cross-Process Activity**: Exclude legitimate software that performs cross-process operations (debuggers, AV products, accessibility tools, RMM agents).\n7. **Map to ATT&CK Sub-Techniques**: Classify detected injection as classic injection (T1055.001), PE injection (T1055.002), thread execution hijacking (T1055.003), APC injection (T1055.004), thread local storage (T1055.005), process hollowing (T1055.012), or process doppelganging (T1055.013).\n\n## Key Concepts\n\n| Concept | Description |\n|---------|-------------|\n| T1055.001 | Dynamic-link Library Injection |\n| T1055.002 | Portable Executable Injection |\n| T1055.003 | Thread Execution Hijacking |\n| T1055.004 | Asynchronous Procedure Call (APC) Injection |\n| T1055.005 | Thread Local Storage |\n| T1055.012 | Process Hollowing |\n| T1055.013 | Process Doppelganging |\n| T1055.015 | ListPlanting |\n| Sysmon Event 8 | CreateRemoteThread detected |\n| Sysmon Event 10 | ProcessAccess with memory write permissions |\n| Sysmon Event 25 | ProcessTampering (image mismatch) |\n| Access Mask 0x1FFFFF | PROCESS_ALL_ACCESS -- full cross-process control |\n\n## Tools & Systems\n\n| Tool | Purpose |\n|------|---------|\n| Sysmon | Primary telemetry source for injection detection |\n| Process Hacker | Manual investigation of process memory regions |\n| PE-sieve | Scan running processes for hollowed\u002Finjected code |\n| Moneta | Detect anomalous memory regions in processes |\n| Splunk \u002F Elastic | SIEM correlation of Sysmon events |\n| Volatility | Memory forensics for injection artifacts |\n| Hollows Hunter | Automated scan for hollowed processes |\n\n## Detection Queries\n\n### Splunk -- Remote Thread Creation\n```spl\nindex=sysmon EventCode=8\n| where SourceImage!=TargetImage\n| where NOT match(SourceImage, \"(?i)(csrss|lsass|services|svchost|MsMpEng|SecurityHealthService|vmtoolsd)\\.exe$\")\n| eval suspicious=if(match(TargetImage, \"(?i)(svchost|explorer|lsass|winlogon|csrss|services)\\.exe$\"), \"high_value_target\", \"normal_target\")\n| where suspicious=\"high_value_target\"\n| table _time Computer SourceImage SourceProcessId TargetImage TargetProcessId StartFunction NewThreadId\n```\n\n### Splunk -- Suspicious ProcessAccess Patterns\n```spl\nindex=sysmon EventCode=10\n| where SourceImage!=TargetImage\n| where match(GrantedAccess, \"(0x1FFFFF|0x1F3FFF|0x143A|0x0040)\")\n| where match(TargetImage, \"(?i)(lsass|svchost|explorer|winlogon)\\.exe$\")\n| where NOT match(SourceImage, \"(?i)(MsMpEng|csrss|services|svchost|taskmgr|procexp)\\.exe$\")\n| table _time Computer SourceImage TargetImage GrantedAccess CallTrace\n```\n\n### KQL -- Process Injection via Remote Thread\n```kql\nDeviceEvents\n| where Timestamp > ago(7d)\n| where ActionType == \"CreateRemoteThreadApiCall\"\n| where InitiatingProcessFileName !in~ (\"csrss.exe\", \"lsass.exe\", \"services.exe\", \"svchost.exe\")\n| where FileName in~ (\"svchost.exe\", \"explorer.exe\", \"lsass.exe\", \"winlogon.exe\")\n| project Timestamp, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine,\n    FileName, ProcessCommandLine\n```\n\n### Sigma Rule -- Process Injection Detection\n```yaml\ntitle: Process Injection via CreateRemoteThread into System Process\nstatus: stable\nlogsource:\n    product: windows\n    category: create_remote_thread\ndetection:\n    selection:\n        TargetImage|endswith:\n            - '\\svchost.exe'\n            - '\\explorer.exe'\n            - '\\lsass.exe'\n            - '\\winlogon.exe'\n    filter_legitimate:\n        SourceImage|endswith:\n            - '\\csrss.exe'\n            - '\\lsass.exe'\n            - '\\services.exe'\n            - '\\MsMpEng.exe'\n    condition: selection and not filter_legitimate\nlevel: high\ntags:\n    - attack.defense_evasion\n    - attack.t1055\n```\n\n## Common Scenarios\n\n1. **Classic DLL Injection**: Malware uses VirtualAllocEx + WriteProcessMemory + CreateRemoteThread to load a malicious DLL into a target process. Detected via Sysmon Event 8.\n2. **Process Hollowing (RunPE)**: Attacker creates a suspended process, unmaps its image, writes malicious PE, and resumes execution. Detected via Sysmon Event 25.\n3. **APC Injection**: Malware queues an Asynchronous Procedure Call to threads of a target process using QueueUserAPC. Harder to detect, requires Event 10 monitoring.\n4. **Reflective DLL Injection**: DLL is loaded directly from memory without touching disk, bypassing ImageLoaded detection. Requires memory-level analysis.\n5. **Process Doppelganging**: Leverages NTFS transactions to replace a legitimate process image. Detected via process integrity checking.\n\n## Output Format\n\n```\nHunt ID: TH-INJECT-[DATE]-[SEQ]\nHost: [Hostname]\nSource Process: [Injecting process path]\nSource PID: [Process ID]\nTarget Process: [Target process path]\nTarget PID: [Process ID]\nInjection Type: [DLL\u002FShellcode\u002FHollowing\u002FAPC]\nSysmon Events: [Event IDs triggered]\nAccess Mask: [Granted access value]\nRisk Level: [Critical\u002FHigh\u002FMedium\u002FLow]\nATT&CK Sub-Technique: [T1055.xxx]\n```\n",{"name":5,"tags":44,"capec":49,"model":50,"tools":51,"domain":33,"maxTurns":55,"nist_csf":56,"subdomain":25,"description":7,"mitre_attack":61,"d3fend_techniques":67},[25,45,20,46,30,47,48],"process-injection","mitre-t1055","dll-injection","process-hollowing",[],"sonnet",[52,32,53,54],"Read","Glob","Grep",20,[57,58,59,60],"DE.CM-01","DE.AE-02","DE.AE-07","ID.RA-05",[62,63,64,65,66],"T1027","T1055","T1055.001","T1055.012","T1059",[68,69,70,71,72],"Executable Denylisting","Execution Isolation","File Metadata Consistency Validation","Content Format Conversion","File Content Analysis","main","a91f1293287ffa9f4f1b8f486cd6e835a1568c84","skills\u002Flinux\u002Fforensics\u002Fmemory\u002Finjection\u002Fsysmon\u002Fdetect","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace","https:\u002F\u002Fgithub.com\u002FDCx7C5","#Python","2026-09-01 11:21:00",{"source":8,"skillName":5,"commands":81,"prompt":91,"zipAvailable":92},[82,85,88],{"tool":83,"command":84},"npx","npx skills add DCx7C5\u002Fai-marketplace --skill forensics-memory-injection-sysmon-detect",{"tool":86,"command":87},"bunx","bunx skills add DCx7C5\u002Fai-marketplace --skill forensics-memory-injection-sysmon-detect",{"tool":89,"command":90},"pnpm","pnpm dlx skills add DCx7C5\u002Fai-marketplace --skill forensics-memory-injection-sysmon-detect","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Flinux\u002Fforensics\u002Fmemory\u002Finjection\u002Fsysmon\u002Fdetect\u002FSKILL.md",true,[94],{"path":95,"resourceType":96,"resourceTypeDesc":97,"sizeBytes":98,"sourceHtmlUrl":99},"index.json","REFERENCE","参考文档",731,"https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Flinux\u002Fforensics\u002Fmemory\u002Finjection\u002Fsysmon\u002Fdetect\u002Findex.json",[101,122,141,162,184,197],{"skillNo":102,"name":103,"nameZh":6,"description":104,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":105,"categories":106,"keywords":107,"publishedAt":39},"01M71HAPZ01KQ30RKTB0FFSQ05","services-wmi-persistence-detect","Detect WMI event subscription persistence by enumerating ActiveScriptEventConsumer, CommandLineEventConsumer, and permanent subscriptions in the WMI repository.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fservices\u002Fwmi\u002Fpersistence\u002Fdetect\u002FSKILL.md",[],[108,22,109,110,111,27,36,112,113,114,115,116,117,118,119,120,23,33,121],"services","services wmi persistence detect","wmi","persistence","process","activescript","event","subscriptions","commandline-consumer","repository","subscription","event-subscription","t1546.003","process-forensics",{"skillNo":123,"name":124,"nameZh":6,"description":125,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":126,"categories":127,"keywords":128,"publishedAt":39},"01M71HAK6JTTTS229T17WJMMCG","services-wmi-exec-exploit","Perform lateral movement across Windows networks using WMI-based remote execution techniques including Impacket wmiexec.py, CrackMapExec, and native WMI commands for stealthy post-exploitation during red team engagements.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fservices\u002Fwmi\u002Fexec\u002Fexploit\u002FSKILL.md",[],[129,108,130,110,131,35,132,33,32,31,133,134,135,136,27,137,138,26,139,140],"exploit","services wmi exec exploit","exec","traffic","team","across","crackmapexec","native","command","lateral movement","lateral-movement","Impacket",{"skillNo":142,"name":143,"nameZh":6,"description":144,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":145,"categories":146,"keywords":147,"publishedAt":39},"01M71HAG6MHKNQV8KDZKMT4886","registry-artifact-extract","Extract and analyze Windows Registry hives to uncover user activity, installed software, autostart entries, and evidence of system compromise.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fregistry\u002Fartifact\u002Fextract\u002FSKILL.md",[],[148,149,150,151,152,153,33,32,154,31,155,156,27,26,157,158,159,160,161,50],"artifact","registry","registry artifact extract","extract","evidence-collection","artifact-analysis","collection","analyze","uncover","software","activity","digital-forensics","windows-registry","regripper",{"skillNo":163,"name":164,"nameZh":6,"description":165,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":166,"categories":167,"keywords":168,"publishedAt":39},"01M71HACR4A8XTWTTSXK4124AA","processes-token-impersonate-detect","Detect Windows token impersonation and privilege abuse including SeImpersonatePrivilege exploitation via Potato attacks and token stealing techniques.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fprocesses\u002Ftoken\u002Fimpersonate\u002Fdetect\u002FSKILL.md",[],[22,169,170,171,172,173,174,36,175,33,121,176,177,178,179,180,181,182,183,27],"processes token impersonate detect","token","processes","attacks","windows","escalation","techniques","privilege-escalation","seimpersonate","token-impersonation","printspoofer","exploitation","potato","impersonation","via",{"skillNo":185,"name":186,"nameZh":6,"description":187,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":188,"categories":189,"keywords":190,"publishedAt":39},"01M71HAABSB4Z6QFSXEG00R4RK","processes-thread-injection-detect","Detect Windows thread injection techniques including CreateRemoteThread, QueueUserAPC, NtCreateThreadEx, and thread hijacking via process memory analysis.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fprocesses\u002Fthread\u002Finjection\u002Fdetect\u002FSKILL.md",[],[191,192,22,21,171,173,24,36,45,175,33,121,31,193,194,195,196,183,27,112],"thread","processes thread injection detect","api","apc-injection","thread-injection","nt-api",{"skillNo":198,"name":199,"nameZh":6,"description":200,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":201,"categories":202,"keywords":203,"publishedAt":39},"01M71HA7H311V5G14WMX58HQSS","processes-hollow-technique-detect","Detect process hollowing (RunPE) by identifying processes with mismatched image paths between PEB and VAD tree, or unmapped PE headers in memory.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fprocesses\u002Fhollow\u002Ftechnique\u002Fdetect\u002FSKILL.md",[],[204,22,171,205,24,36,206,207,33,121,208,209,210,211,212,213,27,112,214,215],"processes hollow technique detect","tree","memory-forensics","process-hollow","peb","runpe","image","pe-header","in memory","with","mismatched","headers"]