[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M71EXHS92WG2PWAWXJS0588V":3,"skill-same:01M71EXHS92WG2PWAWXJS0588V":87},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":18,"publishedAt":39,"linkOnly":40,"markdownContent":41,"markdownBody":42,"frontMatter":43,"refName":60,"commitSha":61,"skillDirectory":62,"forksCount":14,"repositoryHtmlUrl":63,"repositoryHomepageUrl":6,"ownerHtmlUrl":64,"ownerBlogUrl":6,"ownerDescription":65,"updatedAt":66,"install":67,"resources":80},"01M71EXHS92WG2PWAWXJS0588V","services-dbus-alerts-detect",null,"D-Bus security monitoring and IPC forensics. Detects suspicious service activations, polkit authentication bypasses, DBUS_SESSION_BUS_ADDRESS hijacking, and lateral movement via session\u002Fsystem bus event monitoring.","DCx7C5\u002Fai-marketplace","DCx7C5","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F42419559?v=4","01M71C01G2AZV3NTNGWAWSHJPP","DC","01M71C01GQW6G50S2BYMS7PP3E",0,"MIT","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Flinux\u002Fservices\u002Fdbus\u002Falerts\u002Fdetect\u002FSKILL.md",[],[19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38],"alerts","services","detect","services dbus alerts detect","mitre-attack","monitoring","websearch","Bash","ipc","shared-memory","ops","session","authentication","system","event","memory","dbus-alerts","cve","dbus","shared","2026-11-10 10:12:30",false,"---\nname: services-dbus-alerts-detect\ndescription: D-Bus security monitoring and IPC forensics. Detects suspicious service activations, polkit authentication bypasses, DBUS_SESSION_BUS_ADDRESS hijacking, and lateral movement via session\u002Fsystem bus event monitoring.\nmodel: sonnet\nmaxTurns: 20\ntools:\n  - Read\n  - Bash\n  - Glob\n  - Grep\n  - WebSearch\nskills:\n  - shared-memory\n  - threats\u002Fmitre-attack-mapper\ntags:\n- ops\n- dbus\n- alerts\n- dbus-alerts\nmitre_attack:\n- T1021\ncve:\n- CVE-2021-3560\nnist_csf: []\ncapec: []\n---\n\n# D-Bus Alerts\n\n**Purpose:** Real-time and forensic monitoring of D-Bus alert events, suspicious service activations, polkit policy violations, and IPC abuse patterns on the session and system bus.\n\n---\n\n## Core Focus Areas\n\n- **Service activation alerts**: Unexpected D-Bus service activations, unknown well-known names\n- **Polkit authentication**: Authorization bypass attempts, agent spoofing, pkexec abuse\n- **DBUS_SESSION_BUS_ADDRESS manipulation**: Environment variable hijacking for session bus access\n- **Signal storm detection**: Unusual high-frequency signal emissions (DoS, exfil indicators)\n- **Privilege escalation via D-Bus**: Known CVE patterns (e.g., CVE-2021-3560 polkit bypass)\n- **System bus policy violations**: Service calls violating org.freedesktop policy rules\n- **Credential relay**: D-Bus-based credential requests from unauthorized callers\n\n---\n\n## Key Techniques & Tools\n\n### Live Bus Monitoring\n```bash\n# Monitor all system bus activity in real-time\ndbus-monitor --system 2>\u002Fdev\u002Fnull | grep -E \"(signal|method|error)\" | head -50\n\n# Monitor session bus\ndbus-monitor --session 2>\u002Fdev\u002Fnull | head -50\n\n# busctl — structured live monitor with sender\u002Fdestination\nbusctl monitor --system 2>\u002Fdev\u002Fnull | head -100\nbusctl monitor --session 2>\u002Fdev\u002Fnull | head -100\n\n# Monitor specific interface for suspicious calls\ndbus-monitor --system \"type='method_call',interface='org.freedesktop.PolicyKit1.Authority'\" 2>\u002Fdev\u002Fnull\n```\n\n### Service & Name Inventory\n```bash\n# List all registered names on system bus\nbusctl list --system 2>\u002Fdev\u002Fnull | sort\n\n# List all registered names on session bus\nbusctl list --session 2>\u002Fdev\u002Fnull | sort\n\n# Activatable services (can be started on demand)\ndbus-send --system --print-reply \\\n  --dest=org.freedesktop.DBus \\\n  \u002Forg\u002Ffreedesktop\u002FDBus \\\n  org.freedesktop.DBus.ListActivatableNames 2>\u002Fdev\u002Fnull\n\n# Services with unusual PIDs or running as unexpected users\nbusctl list --system --no-legend 2>\u002Fdev\u002Fnull | \\\n  awk '{print $1,$2,$3}' | while read name pid user; do\n    expected=$(grep -r \"^User=\" \u002Fusr\u002Fshare\u002Fdbus-1\u002Fsystem-services\u002F 2>\u002Fdev\u002Fnull | grep \"$name\" | head -1)\n    echo \"$name (PID:$pid USER:$user)\"\n  done\n```\n\n### Polkit Analysis\n```bash\n# Check polkit rules for dangerous allow-any permissions\ngrep -r \"result.any\\|return polkit.Result.YES\\|allow_any.*yes\" \\\n  \u002Fetc\u002Fpolkit-1\u002F \u002Fusr\u002Fshare\u002Fpolkit-1\u002F 2>\u002Fdev\u002Fnull | head -20\n\n# List polkit actions available to unprivileged users\npkaction --verbose 2>\u002Fdev\u002Fnull | grep -A5 \"allow_any.*yes\\|allow_inactive.*yes\" | head -40\n\n# Recent polkit authorization events\njournalctl -u polkit --since \"7 days ago\" 2>\u002Fdev\u002Fnull | \\\n  grep -E \"(Operator|Authorized|Rejected|Error)\" | head -30\n\n# CVE-2021-3560 polkit bypass indicator (rapid pkexec calls)\njournalctl --since \"30 days ago\" 2>\u002Fdev\u002Fnull | \\\n  grep \"pkexec\" | awk '{print $1,$2,$3}' | sort | uniq -c | sort -rn | head -10\n```\n\n### D-Bus Policy Audit\n```bash\n# System bus policy files — find dangerous allow rules\ngrep -r \"\u003Callow\\|\u003Cdeny\" \u002Fetc\u002Fdbus-1\u002F \u002Fusr\u002Fshare\u002Fdbus-1\u002F 2>\u002Fdev\u002Fnull | \\\n  grep -v \"\u003C!--\" | grep -E \"send_destination|receive_sender|own\" | head -30\n\n# Third-party D-Bus service definitions (potential attack surface)\nfind \u002Fusr\u002Fshare\u002Fdbus-1\u002Fsystem-services\u002F \u002Fetc\u002Fdbus-1\u002Fsystem.d\u002F \\\n  -name \"*.service\" -o -name \"*.conf\" 2>\u002Fdev\u002Fnull | \\\n  xargs grep -l \"Exec\\|User=root\" 2>\u002Fdev\u002Fnull | head -10\n```\n\n### Session Bus Security\n```bash\n# DBUS_SESSION_BUS_ADDRESS hijack detection\ngrep -r \"DBUS_SESSION_BUS_ADDRESS\" \u002Fproc\u002F*\u002Fenviron 2>\u002Fdev\u002Fnull | \\\n  grep -v \"^Binary\" | sort -u | head -20\n\n# Detect D-Bus socket files in unexpected locations\nfind \u002Ftmp \u002Frun \u002Fvar\u002Frun -name \"dbus-*\" -o -name \".dbus-*\" 2>\u002Fdev\u002Fnull | \\\n  while read f; do\n    echo \"$(stat -c '%a %U %G %n' \"$f\" 2>\u002Fdev\u002Fnull)\"\n  done\n\n# Check for D-Bus socket owned by non-root in system locations\nfind \u002Frun\u002Fdbus -type s 2>\u002Fdev\u002Fnull | \\\n  while read s; do stat -c '%a %U %G %n' \"$s\"; done\n```\n\n### Journald D-Bus Events\n```bash\n# All D-Bus-related audit events\njournalctl --since \"7 days ago\" 2>\u002Fdev\u002Fnull | \\\n  grep -iE \"(dbus|polkit|pkexec|org\\.freedesktop)\" | \\\n  grep -iE \"(fail|error|reject|deny|block|unauthorized)\" | head -30\n\n# Unusual service registrations\njournalctl -k --since \"7 days ago\" 2>\u002Fdev\u002Fnull | \\\n  grep -i \"dbus\" | head -20\n```\n\n---\n\n## MITRE ATT&CK Mapping\n\n| Finding | Technique |\n|---------|-----------|\n| Polkit bypass for privilege escalation | T1548.003 – Sudo and Sudo Caching |\n| D-Bus service impersonation | T1574 – Hijack Execution Flow |\n| DBUS_SESSION_BUS_ADDRESS hijack | T1574.006 – Dynamic Linker Hijacking |\n| Unauthorized pkexec\u002Fpolkit use | T1548 – Abuse Elevation Control Mechanism |\n| D-Bus-based lateral movement | T1021 – Remote Services |\n\n---\n\n## Rules for Agents\n\n1. Flag any polkit `allow_any = yes` rule for unprivileged access as **HIGH**\n2. Log all unknown well-known D-Bus names to `iocs.md`\n3. Alert on pkexec calls outside normal admin workflows\n4. Check DBUS_SESSION_BUS_ADDRESS in all process environments — unexpected paths are **MEDIUM**\n5. Cross-correlate D-Bus alerts with authentication log timestamps\n6. Sync all D-Bus IOCs to shared memory at session end\n","# D-Bus Alerts\n\n**Purpose:** Real-time and forensic monitoring of D-Bus alert events, suspicious service activations, polkit policy violations, and IPC abuse patterns on the session and system bus.\n\n---\n\n## Core Focus Areas\n\n- **Service activation alerts**: Unexpected D-Bus service activations, unknown well-known names\n- **Polkit authentication**: Authorization bypass attempts, agent spoofing, pkexec abuse\n- **DBUS_SESSION_BUS_ADDRESS manipulation**: Environment variable hijacking for session bus access\n- **Signal storm detection**: Unusual high-frequency signal emissions (DoS, exfil indicators)\n- **Privilege escalation via D-Bus**: Known CVE patterns (e.g., CVE-2021-3560 polkit bypass)\n- **System bus policy violations**: Service calls violating org.freedesktop policy rules\n- **Credential relay**: D-Bus-based credential requests from unauthorized callers\n\n---\n\n## Key Techniques & Tools\n\n### Live Bus Monitoring\n```bash\n# Monitor all system bus activity in real-time\ndbus-monitor --system 2>\u002Fdev\u002Fnull | grep -E \"(signal|method|error)\" | head -50\n\n# Monitor session bus\ndbus-monitor --session 2>\u002Fdev\u002Fnull | head -50\n\n# busctl — structured live monitor with sender\u002Fdestination\nbusctl monitor --system 2>\u002Fdev\u002Fnull | head -100\nbusctl monitor --session 2>\u002Fdev\u002Fnull | head -100\n\n# Monitor specific interface for suspicious calls\ndbus-monitor --system \"type='method_call',interface='org.freedesktop.PolicyKit1.Authority'\" 2>\u002Fdev\u002Fnull\n```\n\n### Service & Name Inventory\n```bash\n# List all registered names on system bus\nbusctl list --system 2>\u002Fdev\u002Fnull | sort\n\n# List all registered names on session bus\nbusctl list --session 2>\u002Fdev\u002Fnull | sort\n\n# Activatable services (can be started on demand)\ndbus-send --system --print-reply \\\n  --dest=org.freedesktop.DBus \\\n  \u002Forg\u002Ffreedesktop\u002FDBus \\\n  org.freedesktop.DBus.ListActivatableNames 2>\u002Fdev\u002Fnull\n\n# Services with unusual PIDs or running as unexpected users\nbusctl list --system --no-legend 2>\u002Fdev\u002Fnull | \\\n  awk '{print $1,$2,$3}' | while read name pid user; do\n    expected=$(grep -r \"^User=\" \u002Fusr\u002Fshare\u002Fdbus-1\u002Fsystem-services\u002F 2>\u002Fdev\u002Fnull | grep \"$name\" | head -1)\n    echo \"$name (PID:$pid USER:$user)\"\n  done\n```\n\n### Polkit Analysis\n```bash\n# Check polkit rules for dangerous allow-any permissions\ngrep -r \"result.any\\|return polkit.Result.YES\\|allow_any.*yes\" \\\n  \u002Fetc\u002Fpolkit-1\u002F \u002Fusr\u002Fshare\u002Fpolkit-1\u002F 2>\u002Fdev\u002Fnull | head -20\n\n# List polkit actions available to unprivileged users\npkaction --verbose 2>\u002Fdev\u002Fnull | grep -A5 \"allow_any.*yes\\|allow_inactive.*yes\" | head -40\n\n# Recent polkit authorization events\njournalctl -u polkit --since \"7 days ago\" 2>\u002Fdev\u002Fnull | \\\n  grep -E \"(Operator|Authorized|Rejected|Error)\" | head -30\n\n# CVE-2021-3560 polkit bypass indicator (rapid pkexec calls)\njournalctl --since \"30 days ago\" 2>\u002Fdev\u002Fnull | \\\n  grep \"pkexec\" | awk '{print $1,$2,$3}' | sort | uniq -c | sort -rn | head -10\n```\n\n### D-Bus Policy Audit\n```bash\n# System bus policy files — find dangerous allow rules\ngrep -r \"\u003Callow\\|\u003Cdeny\" \u002Fetc\u002Fdbus-1\u002F \u002Fusr\u002Fshare\u002Fdbus-1\u002F 2>\u002Fdev\u002Fnull | \\\n  grep -v \"\u003C!--\" | grep -E \"send_destination|receive_sender|own\" | head -30\n\n# Third-party D-Bus service definitions (potential attack surface)\nfind \u002Fusr\u002Fshare\u002Fdbus-1\u002Fsystem-services\u002F \u002Fetc\u002Fdbus-1\u002Fsystem.d\u002F \\\n  -name \"*.service\" -o -name \"*.conf\" 2>\u002Fdev\u002Fnull | \\\n  xargs grep -l \"Exec\\|User=root\" 2>\u002Fdev\u002Fnull | head -10\n```\n\n### Session Bus Security\n```bash\n# DBUS_SESSION_BUS_ADDRESS hijack detection\ngrep -r \"DBUS_SESSION_BUS_ADDRESS\" \u002Fproc\u002F*\u002Fenviron 2>\u002Fdev\u002Fnull | \\\n  grep -v \"^Binary\" | sort -u | head -20\n\n# Detect D-Bus socket files in unexpected locations\nfind \u002Ftmp \u002Frun \u002Fvar\u002Frun -name \"dbus-*\" -o -name \".dbus-*\" 2>\u002Fdev\u002Fnull | \\\n  while read f; do\n    echo \"$(stat -c '%a %U %G %n' \"$f\" 2>\u002Fdev\u002Fnull)\"\n  done\n\n# Check for D-Bus socket owned by non-root in system locations\nfind \u002Frun\u002Fdbus -type s 2>\u002Fdev\u002Fnull | \\\n  while read s; do stat -c '%a %U %G %n' \"$s\"; done\n```\n\n### Journald D-Bus Events\n```bash\n# All D-Bus-related audit events\njournalctl --since \"7 days ago\" 2>\u002Fdev\u002Fnull | \\\n  grep -iE \"(dbus|polkit|pkexec|org\\.freedesktop)\" | \\\n  grep -iE \"(fail|error|reject|deny|block|unauthorized)\" | head -30\n\n# Unusual service registrations\njournalctl -k --since \"7 days ago\" 2>\u002Fdev\u002Fnull | \\\n  grep -i \"dbus\" | head -20\n```\n\n---\n\n## MITRE ATT&CK Mapping\n\n| Finding | Technique |\n|---------|-----------|\n| Polkit bypass for privilege escalation | T1548.003 – Sudo and Sudo Caching |\n| D-Bus service impersonation | T1574 – Hijack Execution Flow |\n| DBUS_SESSION_BUS_ADDRESS hijack | T1574.006 – Dynamic Linker Hijacking |\n| Unauthorized pkexec\u002Fpolkit use | T1548 – Abuse Elevation Control Mechanism |\n| D-Bus-based lateral movement | T1021 – Remote Services |\n\n---\n\n## Rules for Agents\n\n1. Flag any polkit `allow_any = yes` rule for unprivileged access as **HIGH**\n2. Log all unknown well-known D-Bus names to `iocs.md`\n3. Alert on pkexec calls outside normal admin workflows\n4. Check DBUS_SESSION_BUS_ADDRESS in all process environments — unexpected paths are **MEDIUM**\n5. Cross-correlate D-Bus alerts with authentication log timestamps\n6. Sync all D-Bus IOCs to shared memory at session end\n",{"cve":44,"name":5,"tags":46,"capec":47,"model":48,"tools":49,"skills":54,"maxTurns":56,"nist_csf":57,"description":7,"mitre_attack":58},[45],"CVE-2021-3560",[29,37,19,35],[],"sonnet",[50,26,51,52,53],"Read","Glob","Grep","WebSearch",[28,55],"threats\u002Fmitre-attack-mapper",20,[],[59],"T1021","main","a91f1293287ffa9f4f1b8f486cd6e835a1568c84","skills\u002Flinux\u002Fservices\u002Fdbus\u002Falerts\u002Fdetect","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace","https:\u002F\u002Fgithub.com\u002FDCx7C5","#Python","2026-09-01 11:21:00",{"source":8,"skillName":5,"commands":68,"prompt":78,"zipAvailable":79},[69,72,75],{"tool":70,"command":71},"npx","npx skills add DCx7C5\u002Fai-marketplace --skill services-dbus-alerts-detect",{"tool":73,"command":74},"bunx","bunx skills add DCx7C5\u002Fai-marketplace --skill services-dbus-alerts-detect",{"tool":76,"command":77},"pnpm","pnpm dlx skills add DCx7C5\u002Fai-marketplace --skill services-dbus-alerts-detect","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Flinux\u002Fservices\u002Fdbus\u002Falerts\u002Fdetect\u002FSKILL.md",true,[81],{"path":82,"resourceType":83,"resourceTypeDesc":84,"sizeBytes":85,"sourceHtmlUrl":86},"index.json","REFERENCE","参考文档",692,"https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Flinux\u002Fservices\u002Fdbus\u002Falerts\u002Fdetect\u002Findex.json",[88,111,133,154,176,191],{"skillNo":89,"name":90,"nameZh":6,"description":91,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":92,"categories":93,"keywords":94,"publishedAt":39},"01M71HAPZ01KQ30RKTB0FFSQ05","services-wmi-persistence-detect","Detect WMI event subscription persistence by enumerating ActiveScriptEventConsumer, CommandLineEventConsumer, and permanent subscriptions in the WMI repository.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fservices\u002Fwmi\u002Fpersistence\u002Fdetect\u002FSKILL.md",[],[20,21,95,96,97,98,99,100,101,33,102,103,104,105,106,107,108,109,110],"services wmi persistence detect","wmi","persistence","de","cm","process","activescript","subscriptions","commandline-consumer","repository","subscription","event-subscription","t1546.003","forensics","cybersecurity","process-forensics",{"skillNo":112,"name":113,"nameZh":6,"description":114,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":115,"categories":116,"keywords":117,"publishedAt":39},"01M71HAK6JTTTS229T17WJMMCG","services-wmi-exec-exploit","Perform lateral movement across Windows networks using WMI-based remote execution techniques including Impacket wmiexec.py, CrackMapExec, and native WMI commands for stealthy post-exploitation during red team engagements.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fservices\u002Fwmi\u002Fexec\u002Fexploit\u002FSKILL.md",[],[118,20,119,96,120,121,122,109,26,123,124,125,126,127,98,128,129,130,131,132],"exploit","services wmi exec exploit","exec","remote","traffic","analysis","team","across","crackmapexec","native","command","lateral movement","read","lateral-movement","Impacket",{"skillNo":134,"name":135,"nameZh":6,"description":136,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":137,"categories":138,"keywords":139,"publishedAt":39},"01M71HAG6MHKNQV8KDZKMT4886","registry-artifact-extract","Extract and analyze Windows Registry hives to uncover user activity, installed software, autostart entries, and evidence of system compromise.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fregistry\u002Fartifact\u002Fextract\u002FSKILL.md",[],[140,141,142,143,144,145,109,26,146,123,147,148,98,130,149,150,151,152,153,48],"artifact","registry","registry artifact extract","extract","evidence-collection","artifact-analysis","collection","analyze","uncover","software","activity","digital-forensics","windows-registry","regripper",{"skillNo":155,"name":156,"nameZh":6,"description":157,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":158,"categories":159,"keywords":160,"publishedAt":39},"01M71HACR4A8XTWTTSXK4124AA","processes-token-impersonate-detect","Detect Windows token impersonation and privilege abuse including SeImpersonatePrivilege exploitation via Potato attacks and token stealing techniques.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fprocesses\u002Ftoken\u002Fimpersonate\u002Fdetect\u002FSKILL.md",[],[21,161,162,163,164,165,166,99,167,109,110,168,169,170,171,172,173,174,175,98],"processes token impersonate detect","token","processes","attacks","windows","escalation","techniques","privilege-escalation","seimpersonate","token-impersonation","printspoofer","exploitation","potato","impersonation","via",{"skillNo":177,"name":178,"nameZh":6,"description":179,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":180,"categories":181,"keywords":182,"publishedAt":39},"01M71HAABSB4Z6QFSXEG00R4RK","processes-thread-injection-detect","Detect Windows thread injection techniques including CreateRemoteThread, QueueUserAPC, NtCreateThreadEx, and thread hijacking via process memory analysis.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fprocesses\u002Fthread\u002Finjection\u002Fdetect\u002FSKILL.md",[],[183,184,21,185,163,165,34,99,186,167,109,110,123,187,188,189,190,175,98,100],"thread","processes thread injection detect","injection","process-injection","api","apc-injection","thread-injection","nt-api",{"skillNo":192,"name":193,"nameZh":6,"description":194,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":195,"categories":196,"keywords":197,"publishedAt":39},"01M71HA7H311V5G14WMX58HQSS","processes-hollow-technique-detect","Detect process hollowing (RunPE) by identifying processes with mismatched image paths between PEB and VAD tree, or unmapped PE headers in memory.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fprocesses\u002Fhollow\u002Ftechnique\u002Fdetect\u002FSKILL.md",[],[198,21,163,199,34,99,200,201,109,110,202,203,204,205,206,207,98,100,208,209],"processes hollow technique detect","tree","memory-forensics","process-hollow","peb","runpe","image","pe-header","in memory","with","mismatched","headers"]