[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M71ET87GSCB5CHR0T4NJ6X4G":3,"skill-same:01M71ET87GSCB5CHR0T4NJ6X4G":84},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":18,"publishedAt":39,"linkOnly":40,"markdownContent":41,"markdownBody":42,"frontMatter":43,"refName":57,"commitSha":58,"skillDirectory":59,"forksCount":14,"repositoryHtmlUrl":60,"repositoryHomepageUrl":6,"ownerHtmlUrl":61,"ownerBlogUrl":6,"ownerDescription":62,"updatedAt":63,"install":64,"resources":77},"01M71ET87GSCB5CHR0T4NJ6X4G","memory-endpoint-analyze",null,"Implements memory protection mechanisms including DEP (Data Execution Prevention), ASLR (Address Space Layout Randomization), CFG (Control Flow Guard), and other exploit mitigations to prevent memory corruption attacks. Use when hardening endpoints against buffer overflow exploits, ROP chains, and code injection. Activates for requests involving memory protection, exploit mitigation, DEP, ASLR, or CFG configuration.","DCx7C5\u002Fai-marketplace","DCx7C5","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F42419559?v=4","01M71C01G2AZV3NTNGWAWSHJPP","DC","01M71C01GQW6G50S2BYMS7PP3E",0,"MIT","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Flinux\u002Fmemory\u002Fendpoint\u002Fanalyze\u002FSKILL.md",[],[19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38],"analyze","endpoint","memory endpoint analyze","memory","exploit","read","layout","de","code","Bash","when","CFG","cybersecurity","exploit-mitigation","ASLR","buffer","DEP","memory-protection","endpoint-security","cm","2026-11-10 10:12:30",false,"---\nname: memory-endpoint-analyze\ndescription: Implements memory protection mechanisms including DEP (Data Execution Prevention), ASLR (Address Space Layout Randomization), CFG (Control Flow Guard), and other exploit mitigations to prevent memory corruption attacks. Use when hardening endpoints against buffer overflow exploits, ROP chains, and code injection. Activates for requests involving memory protection, exploit mitigation, DEP, ASLR, or CFG configuration.\ndomain: cybersecurity\nsubdomain: endpoint-security\ntags:\n- endpoint\n- memory-protection\n- DEP\n- ASLR\n- exploit-mitigation\n- CFG\nnist_csf:\n- PR.PS-01\n- PR.PS-02\n- DE.CM-01\n- PR.IR-01\nmodel: sonnet\nmaxTurns: 20\ntools: [Read, Bash, Glob, Grep]\ncapec: []\n---\n\n# Implementing Memory Protection with DEP and ASLR\n\n## When to Use\n\nUse this skill when hardening endpoints against memory-based exploits by configuring DEP, ASLR, CFG, and Windows Exploit Protection system-wide and per-application mitigations.\n\n## Prerequisites\n\n- Windows 10\u002F11 or Windows Server 2016+ with administrative privileges\n- Group Policy management access for enterprise-wide deployment\n- Understanding of memory corruption attack techniques (buffer overflow, ROP chains)\n- Test environment for validating application compatibility with exploit mitigations\n\n## Workflow\n\n### Step 1: Configure System-Level Mitigations\n\n```powershell\n# Enable system-wide DEP (Data Execution Prevention)\n# Boot configuration: OptIn (default), OptOut (recommended), AlwaysOn\nbcdedit \u002Fset nx AlwaysOn\n\n# Verify ASLR status (enabled by default on modern Windows)\nGet-ProcessMitigation -System\n# MandatoryASLR, BottomUpASLR, HighEntropyASLR should be ON\n\n# Enable all system-level mitigations\nSet-ProcessMitigation -System -Enable DEP,SEHOP,ForceRelocateImages,BottomUp,HighEntropy\n```\n\n### Step 2: Configure Per-Application Mitigations\n\n```powershell\n# Harden high-risk applications (browsers, Office, PDF readers)\nSet-ProcessMitigation -Name \"WINWORD.EXE\" -Enable DEP,SEHOP,ForceRelocateImages,CFG,StrictHandle\nSet-ProcessMitigation -Name \"EXCEL.EXE\" -Enable DEP,SEHOP,ForceRelocateImages,CFG,StrictHandle\nSet-ProcessMitigation -Name \"AcroRd32.exe\" -Enable DEP,SEHOP,ForceRelocateImages,CFG\nSet-ProcessMitigation -Name \"chrome.exe\" -Enable DEP,CFG,ForceRelocateImages\nSet-ProcessMitigation -Name \"msedge.exe\" -Enable DEP,CFG,ForceRelocateImages\n\n# Export configuration for deployment\nGet-ProcessMitigation -RegistryConfigFilePath \"C:\\exploit_protection.xml\"\n# Deploy via Intune or GPO\n```\n\n### Step 3: Deploy via Intune\u002FGPO\n\n```\nIntune: Endpoint Security → Attack Surface Reduction → Exploit Protection\n  Import exploit_protection.xml template\n\nGPO: Computer Configuration → Admin Templates → Windows Components\n  → Windows Defender Exploit Guard → Exploit Protection\n  → \"Use a common set of exploit protection settings\" → Enabled\n  → Point to XML file on network share\n```\n\n## Key Concepts\n\n| Term | Definition |\n|------|-----------|\n| **DEP** | Marks memory pages as non-executable to prevent shellcode execution in data regions |\n| **ASLR** | Randomizes memory addresses of loaded modules to defeat hardcoded ROP gadgets |\n| **CFG** | Validates indirect call targets at runtime to prevent control flow hijacking |\n| **SEHOP** | Validates SEH chain integrity to prevent SEH-based exploitation |\n\n## Tools & Systems\n- **Windows Exploit Protection**: Built-in per-process mitigation management\n- **EMET (legacy)**: Enhanced Mitigation Experience Toolkit (predecessor, now deprecated)\n- **ProcessMitigations PowerShell**: Get\u002FSet-ProcessMitigation cmdlets\n\n## Common Pitfalls\n- **DEP compatibility**: Legacy 32-bit applications may crash with DEP AlwaysOn. Use OptOut with exceptions.\n- **Mandatory ASLR breaking apps**: Some applications are not ASLR-compatible. Test before enforcing ForceRelocateImages.\n- **CFG limited to compiled-in support**: CFG only works for applications compiled with \u002Fguard:cf. Cannot be retroactively applied.\n","# Implementing Memory Protection with DEP and ASLR\n\n## When to Use\n\nUse this skill when hardening endpoints against memory-based exploits by configuring DEP, ASLR, CFG, and Windows Exploit Protection system-wide and per-application mitigations.\n\n## Prerequisites\n\n- Windows 10\u002F11 or Windows Server 2016+ with administrative privileges\n- Group Policy management access for enterprise-wide deployment\n- Understanding of memory corruption attack techniques (buffer overflow, ROP chains)\n- Test environment for validating application compatibility with exploit mitigations\n\n## Workflow\n\n### Step 1: Configure System-Level Mitigations\n\n```powershell\n# Enable system-wide DEP (Data Execution Prevention)\n# Boot configuration: OptIn (default), OptOut (recommended), AlwaysOn\nbcdedit \u002Fset nx AlwaysOn\n\n# Verify ASLR status (enabled by default on modern Windows)\nGet-ProcessMitigation -System\n# MandatoryASLR, BottomUpASLR, HighEntropyASLR should be ON\n\n# Enable all system-level mitigations\nSet-ProcessMitigation -System -Enable DEP,SEHOP,ForceRelocateImages,BottomUp,HighEntropy\n```\n\n### Step 2: Configure Per-Application Mitigations\n\n```powershell\n# Harden high-risk applications (browsers, Office, PDF readers)\nSet-ProcessMitigation -Name \"WINWORD.EXE\" -Enable DEP,SEHOP,ForceRelocateImages,CFG,StrictHandle\nSet-ProcessMitigation -Name \"EXCEL.EXE\" -Enable DEP,SEHOP,ForceRelocateImages,CFG,StrictHandle\nSet-ProcessMitigation -Name \"AcroRd32.exe\" -Enable DEP,SEHOP,ForceRelocateImages,CFG\nSet-ProcessMitigation -Name \"chrome.exe\" -Enable DEP,CFG,ForceRelocateImages\nSet-ProcessMitigation -Name \"msedge.exe\" -Enable DEP,CFG,ForceRelocateImages\n\n# Export configuration for deployment\nGet-ProcessMitigation -RegistryConfigFilePath \"C:\\exploit_protection.xml\"\n# Deploy via Intune or GPO\n```\n\n### Step 3: Deploy via Intune\u002FGPO\n\n```\nIntune: Endpoint Security → Attack Surface Reduction → Exploit Protection\n  Import exploit_protection.xml template\n\nGPO: Computer Configuration → Admin Templates → Windows Components\n  → Windows Defender Exploit Guard → Exploit Protection\n  → \"Use a common set of exploit protection settings\" → Enabled\n  → Point to XML file on network share\n```\n\n## Key Concepts\n\n| Term | Definition |\n|------|-----------|\n| **DEP** | Marks memory pages as non-executable to prevent shellcode execution in data regions |\n| **ASLR** | Randomizes memory addresses of loaded modules to defeat hardcoded ROP gadgets |\n| **CFG** | Validates indirect call targets at runtime to prevent control flow hijacking |\n| **SEHOP** | Validates SEH chain integrity to prevent SEH-based exploitation |\n\n## Tools & Systems\n- **Windows Exploit Protection**: Built-in per-process mitigation management\n- **EMET (legacy)**: Enhanced Mitigation Experience Toolkit (predecessor, now deprecated)\n- **ProcessMitigations PowerShell**: Get\u002FSet-ProcessMitigation cmdlets\n\n## Common Pitfalls\n- **DEP compatibility**: Legacy 32-bit applications may crash with DEP AlwaysOn. Use OptOut with exceptions.\n- **Mandatory ASLR breaking apps**: Some applications are not ASLR-compatible. Test before enforcing ForceRelocateImages.\n- **CFG limited to compiled-in support**: CFG only works for applications compiled with \u002Fguard:cf. Cannot be retroactively applied.\n",{"name":5,"tags":44,"capec":45,"model":46,"tools":47,"domain":31,"maxTurns":51,"nist_csf":52,"subdomain":37,"description":7},[20,36,35,33,32,30],[],"sonnet",[48,28,49,50],"Read","Glob","Grep",20,[53,54,55,56],"PR.PS-01","PR.PS-02","DE.CM-01","PR.IR-01","main","a91f1293287ffa9f4f1b8f486cd6e835a1568c84","skills\u002Flinux\u002Fmemory\u002Fendpoint\u002Fanalyze","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace","https:\u002F\u002Fgithub.com\u002FDCx7C5","#Python","2026-09-01 11:21:00",{"source":8,"skillName":5,"commands":65,"prompt":75,"zipAvailable":76},[66,69,72],{"tool":67,"command":68},"npx","npx skills add DCx7C5\u002Fai-marketplace --skill memory-endpoint-analyze",{"tool":70,"command":71},"bunx","bunx skills add DCx7C5\u002Fai-marketplace --skill memory-endpoint-analyze",{"tool":73,"command":74},"pnpm","pnpm dlx skills add DCx7C5\u002Fai-marketplace --skill memory-endpoint-analyze","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Flinux\u002Fmemory\u002Fendpoint\u002Fanalyze\u002FSKILL.md",true,[78],{"path":79,"resourceType":80,"resourceTypeDesc":81,"sizeBytes":82,"sourceHtmlUrl":83},"index.json","REFERENCE","参考文档",680,"https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Flinux\u002Fmemory\u002Fendpoint\u002Fanalyze\u002Findex.json",[85,108,128,148,170,185],{"skillNo":86,"name":87,"nameZh":6,"description":88,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":89,"categories":90,"keywords":91,"publishedAt":39},"01M71HAPZ01KQ30RKTB0FFSQ05","services-wmi-persistence-detect","Detect WMI event subscription persistence by enumerating ActiveScriptEventConsumer, CommandLineEventConsumer, and permanent subscriptions in the WMI repository.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fservices\u002Fwmi\u002Fpersistence\u002Fdetect\u002FSKILL.md",[],[92,93,94,95,96,26,38,97,98,99,100,101,102,103,104,105,106,31,107],"services","detect","services wmi persistence detect","wmi","persistence","process","activescript","event","subscriptions","commandline-consumer","repository","subscription","event-subscription","t1546.003","forensics","process-forensics",{"skillNo":109,"name":110,"nameZh":6,"description":111,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":112,"categories":113,"keywords":114,"publishedAt":39},"01M71HAK6JTTTS229T17WJMMCG","services-wmi-exec-exploit","Perform lateral movement across Windows networks using WMI-based remote execution techniques including Impacket wmiexec.py, CrackMapExec, and native WMI commands for stealthy post-exploitation during red team engagements.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fservices\u002Fwmi\u002Fexec\u002Fexploit\u002FSKILL.md",[],[23,92,115,95,116,117,118,31,28,119,120,121,122,123,26,124,125,24,126,127],"services wmi exec exploit","exec","remote","traffic","analysis","team","across","crackmapexec","native","command","lateral movement","lateral-movement","Impacket",{"skillNo":129,"name":130,"nameZh":6,"description":131,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":132,"categories":133,"keywords":134,"publishedAt":39},"01M71HAG6MHKNQV8KDZKMT4886","registry-artifact-extract","Extract and analyze Windows Registry hives to uncover user activity, installed software, autostart entries, and evidence of system compromise.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fregistry\u002Fartifact\u002Fextract\u002FSKILL.md",[],[135,136,137,138,139,140,31,28,141,119,19,142,26,24,143,144,145,146,147,46],"artifact","registry","registry artifact extract","extract","evidence-collection","artifact-analysis","collection","uncover","software","activity","digital-forensics","windows-registry","regripper",{"skillNo":149,"name":150,"nameZh":6,"description":151,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":152,"categories":153,"keywords":154,"publishedAt":39},"01M71HACR4A8XTWTTSXK4124AA","processes-token-impersonate-detect","Detect Windows token impersonation and privilege abuse including SeImpersonatePrivilege exploitation via Potato attacks and token stealing techniques.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fprocesses\u002Ftoken\u002Fimpersonate\u002Fdetect\u002FSKILL.md",[],[93,155,156,157,158,159,160,38,161,31,107,162,163,164,165,166,167,168,169,26],"processes token impersonate detect","token","processes","attacks","windows","escalation","techniques","privilege-escalation","seimpersonate","token-impersonation","printspoofer","exploitation","potato","impersonation","via",{"skillNo":171,"name":172,"nameZh":6,"description":173,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":174,"categories":175,"keywords":176,"publishedAt":39},"01M71HAABSB4Z6QFSXEG00R4RK","processes-thread-injection-detect","Detect Windows thread injection techniques including CreateRemoteThread, QueueUserAPC, NtCreateThreadEx, and thread hijacking via process memory analysis.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fprocesses\u002Fthread\u002Finjection\u002Fdetect\u002FSKILL.md",[],[177,178,93,179,157,159,22,38,180,161,31,107,119,181,182,183,184,169,26,97],"thread","processes thread injection detect","injection","process-injection","api","apc-injection","thread-injection","nt-api",{"skillNo":186,"name":187,"nameZh":6,"description":188,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":189,"categories":190,"keywords":191,"publishedAt":39},"01M71HA7H311V5G14WMX58HQSS","processes-hollow-technique-detect","Detect process hollowing (RunPE) by identifying processes with mismatched image paths between PEB and VAD tree, or unmapped PE headers in memory.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fprocesses\u002Fhollow\u002Ftechnique\u002Fdetect\u002FSKILL.md",[],[192,93,157,193,22,38,194,195,31,107,196,197,198,199,200,201,26,97,202,203],"processes hollow technique detect","tree","memory-forensics","process-hollow","peb","runpe","image","pe-header","in memory","with","mismatched","headers"]