[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M71F0M4DXKYYGSGXV51STPCH":3,"skill-same:01M71F0M4DXKYYGSGXV51STPCH":56},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":18,"publishedAt":24,"linkOnly":25,"markdownContent":26,"markdownBody":27,"frontMatter":28,"refName":29,"commitSha":30,"skillDirectory":31,"forksCount":14,"repositoryHtmlUrl":32,"repositoryHomepageUrl":6,"ownerHtmlUrl":33,"ownerBlogUrl":6,"ownerDescription":34,"updatedAt":35,"install":36,"resources":49},"01M71F0M4DXKYYGSGXV51STPCH","malware-ransomware-artifacts",null,"Malware Ransomware Artifacts.","DCx7C5\u002Fai-marketplace","DCx7C5","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F42419559?v=4","01M71C01G2AZV3NTNGWAWSHJPP","DC","01M71C01GQW6G50S2BYMS7PP3E",0,"MIT","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fmalware-ransomware-artifacts\u002FSKILL.md",[],[19,20,21,22,23],"artifacts","malware","ransomware","malware ransomware artifacts","cybersecurity","2026-11-10 10:12:30",false,"---\nname: malware-ransomware-artifacts\ndescription: \"Malware Ransomware Artifacts.\"\ndomain: cybersecurity\n---\n\n|\n| ID Ransomware | Online service identifying ransomware variant from samples |\n| No More Ransom | Free decryption tools from law enforcement partnerships |\n| Volatility | Memory forensics for encryption key and malware artifact recovery |\n| Chainsaw\u002FHayabusa | Windows Event Log analysis for attack timeline reconstruction |\n| PECmd | Prefetch analysis confirming ransomware executable execution |\n| YARA | Pattern matching for ransomware variant identification |\n| Any.Run\u002FJoe Sandbox | Online malware sandboxes for ransomware behavior analysis |\n| Capa | Mandiant tool identifying malware capabilities from static analysis |\n\n## Common Scenarios\n\n**Scenario 1: LockBit Attack via RDP**\nTrace initial access through RDP brute force in event logs, identify attacker IP and compromised account, follow lateral movement through network logons, find LockBit deployment via PsExec or GPO, document encryption timeline from file timestamps, check for data exfiltration before encryption.\n\n**Scenario 2: Phishing-Initiated Ransomware**\nTrace phishing email through browser history and email artifacts, identify malicious attachment execution in Prefetch, follow Cobalt Strike beacon communication in network logs, trace privilege escalation and domain compromise, document ransomware deployment across the network.\n\n**Scenario 3: Supply Chain Ransomware Attack**\nIdentify the compromised software update mechanism, trace the malicious update distribution in application logs, analyze the ransomware payload delivered via the trusted channel, assess which systems received the update, determine if the vendor was notified.\n\n**Scenario 4: Recovery from Partial Encryption**\nDetermine which systems and files were encrypted before containment, check for surviving volume shadow copies, verify backup integrity and restoration capability, attempt memory-based key recovery, contact law enforcement for potential decryptor availability.\n\n## Output Format\n\n```\nRansomware Investigation Summary:\n  Variant: LockBit 3.0\n  First Seen: 2024-01-18 02:00:00 UTC\n  Encryption Duration: 4 hours 23 minutes\n  Systems Encrypted: 45 out of 200 (containment stopped spread)\n\n  Attack Timeline:\n    2024-01-10 14:32 - RDP brute force from 203.0.113.45 (1,234 attempts)\n    2024-01-10 15:00 - Successful RDP login as admin_backup\n    2024-01-12 02:00 - Mimikatz executed (credential dump)\n    2024-01-12 02:30 - Domain Admin credentials obtained\n    2024-01-15 03:00 - Data exfiltration (45 GB to 185.x.x.x)\n    2024-01-18 02:00 - LockBit deployed via PsExec to 45 systems\n    2024-01-18 06:23 - Encryption completed on affected systems\n\n  Recovery Options:\n    Decryptor: Not available (LockBit 3.0)\n    Shadow Copies: Deleted on all systems\n    Backups: Last clean backup 2024-01-09 (9 days of data loss)\n    Memory Keys: Not recovered (systems rebooted)\n\n  IOCs:\n    Ransomware Hash: a1b2c3d4e5f6...\n    C2 IP: 185.x.x.x\n    Bitcoin: bc1q...\n    Tor: http:\u002F\u002Flockbit...onion\n```\n","|\n| ID Ransomware | Online service identifying ransomware variant from samples |\n| No More Ransom | Free decryption tools from law enforcement partnerships |\n| Volatility | Memory forensics for encryption key and malware artifact recovery |\n| Chainsaw\u002FHayabusa | Windows Event Log analysis for attack timeline reconstruction |\n| PECmd | Prefetch analysis confirming ransomware executable execution |\n| YARA | Pattern matching for ransomware variant identification |\n| Any.Run\u002FJoe Sandbox | Online malware sandboxes for ransomware behavior analysis |\n| Capa | Mandiant tool identifying malware capabilities from static analysis |\n\n## Common Scenarios\n\n**Scenario 1: LockBit Attack via RDP**\nTrace initial access through RDP brute force in event logs, identify attacker IP and compromised account, follow lateral movement through network logons, find LockBit deployment via PsExec or GPO, document encryption timeline from file timestamps, check for data exfiltration before encryption.\n\n**Scenario 2: Phishing-Initiated Ransomware**\nTrace phishing email through browser history and email artifacts, identify malicious attachment execution in Prefetch, follow Cobalt Strike beacon communication in network logs, trace privilege escalation and domain compromise, document ransomware deployment across the network.\n\n**Scenario 3: Supply Chain Ransomware Attack**\nIdentify the compromised software update mechanism, trace the malicious update distribution in application logs, analyze the ransomware payload delivered via the trusted channel, assess which systems received the update, determine if the vendor was notified.\n\n**Scenario 4: Recovery from Partial Encryption**\nDetermine which systems and files were encrypted before containment, check for surviving volume shadow copies, verify backup integrity and restoration capability, attempt memory-based key recovery, contact law enforcement for potential decryptor availability.\n\n## Output Format\n\n```\nRansomware Investigation Summary:\n  Variant: LockBit 3.0\n  First Seen: 2024-01-18 02:00:00 UTC\n  Encryption Duration: 4 hours 23 minutes\n  Systems Encrypted: 45 out of 200 (containment stopped spread)\n\n  Attack Timeline:\n    2024-01-10 14:32 - RDP brute force from 203.0.113.45 (1,234 attempts)\n    2024-01-10 15:00 - Successful RDP login as admin_backup\n    2024-01-12 02:00 - Mimikatz executed (credential dump)\n    2024-01-12 02:30 - Domain Admin credentials obtained\n    2024-01-15 03:00 - Data exfiltration (45 GB to 185.x.x.x)\n    2024-01-18 02:00 - LockBit deployed via PsExec to 45 systems\n    2024-01-18 06:23 - Encryption completed on affected systems\n\n  Recovery Options:\n    Decryptor: Not available (LockBit 3.0)\n    Shadow Copies: Deleted on all systems\n    Backups: Last clean backup 2024-01-09 (9 days of data loss)\n    Memory Keys: Not recovered (systems rebooted)\n\n  IOCs:\n    Ransomware Hash: a1b2c3d4e5f6...\n    C2 IP: 185.x.x.x\n    Bitcoin: bc1q...\n    Tor: http:\u002F\u002Flockbit...onion\n```\n",{"name":5,"domain":23,"description":7},"main","a91f1293287ffa9f4f1b8f486cd6e835a1568c84","skills\u002Fmalware-ransomware-artifacts","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace","https:\u002F\u002Fgithub.com\u002FDCx7C5","#Python","2026-09-01 11:21:00",{"source":8,"skillName":5,"commands":37,"prompt":47,"zipAvailable":48},[38,41,44],{"tool":39,"command":40},"npx","npx skills add DCx7C5\u002Fai-marketplace --skill malware-ransomware-artifacts",{"tool":42,"command":43},"bunx","bunx skills add DCx7C5\u002Fai-marketplace --skill malware-ransomware-artifacts",{"tool":45,"command":46},"pnpm","pnpm dlx skills add DCx7C5\u002Fai-marketplace --skill malware-ransomware-artifacts","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fmalware-ransomware-artifacts\u002FSKILL.md",true,[50],{"path":51,"resourceType":52,"resourceTypeDesc":53,"sizeBytes":54,"sourceHtmlUrl":55},"index.json","REFERENCE","参考文档",512,"https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fmalware-ransomware-artifacts\u002Findex.json",[57,82,105,127,149,165],{"skillNo":58,"name":59,"nameZh":6,"description":60,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":61,"categories":62,"keywords":63,"publishedAt":24},"01M71HAPZ01KQ30RKTB0FFSQ05","services-wmi-persistence-detect","Detect WMI event subscription persistence by enumerating ActiveScriptEventConsumer, CommandLineEventConsumer, and permanent subscriptions in the WMI repository.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fservices\u002Fwmi\u002Fpersistence\u002Fdetect\u002FSKILL.md",[],[64,65,66,67,68,69,70,71,72,73,74,75,76,77,78,79,80,23,81],"services","detect","services wmi persistence detect","wmi","persistence","de","cm","process","activescript","event","subscriptions","commandline-consumer","repository","subscription","event-subscription","t1546.003","forensics","process-forensics",{"skillNo":83,"name":84,"nameZh":6,"description":85,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":86,"categories":87,"keywords":88,"publishedAt":24},"01M71HAK6JTTTS229T17WJMMCG","services-wmi-exec-exploit","Perform lateral movement across Windows networks using WMI-based remote execution techniques including Impacket wmiexec.py, CrackMapExec, and native WMI commands for stealthy post-exploitation during red team engagements.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fservices\u002Fwmi\u002Fexec\u002Fexploit\u002FSKILL.md",[],[89,64,90,67,91,92,93,23,94,95,96,97,98,99,69,100,101,102,103,104],"exploit","services wmi exec exploit","exec","remote","traffic","Bash","analysis","team","across","crackmapexec","native","command","lateral movement","read","lateral-movement","Impacket",{"skillNo":106,"name":107,"nameZh":6,"description":108,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":109,"categories":110,"keywords":111,"publishedAt":24},"01M71HAG6MHKNQV8KDZKMT4886","registry-artifact-extract","Extract and analyze Windows Registry hives to uncover user activity, installed software, autostart entries, and evidence of system compromise.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fregistry\u002Fartifact\u002Fextract\u002FSKILL.md",[],[112,113,114,115,116,117,23,94,118,95,119,120,69,102,121,122,123,124,125,126],"artifact","registry","registry artifact extract","extract","evidence-collection","artifact-analysis","collection","analyze","uncover","software","activity","digital-forensics","windows-registry","regripper","sonnet",{"skillNo":128,"name":129,"nameZh":6,"description":130,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":131,"categories":132,"keywords":133,"publishedAt":24},"01M71HACR4A8XTWTTSXK4124AA","processes-token-impersonate-detect","Detect Windows token impersonation and privilege abuse including SeImpersonatePrivilege exploitation via Potato attacks and token stealing techniques.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fprocesses\u002Ftoken\u002Fimpersonate\u002Fdetect\u002FSKILL.md",[],[65,134,135,136,137,138,139,70,140,23,81,141,142,143,144,145,146,147,148,69],"processes token impersonate detect","token","processes","attacks","windows","escalation","techniques","privilege-escalation","seimpersonate","token-impersonation","printspoofer","exploitation","potato","impersonation","via",{"skillNo":150,"name":151,"nameZh":6,"description":152,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":153,"categories":154,"keywords":155,"publishedAt":24},"01M71HAABSB4Z6QFSXEG00R4RK","processes-thread-injection-detect","Detect Windows thread injection techniques including CreateRemoteThread, QueueUserAPC, NtCreateThreadEx, and thread hijacking via process memory analysis.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fprocesses\u002Fthread\u002Finjection\u002Fdetect\u002FSKILL.md",[],[156,157,65,158,136,138,159,70,160,140,23,81,95,161,162,163,164,148,69,71],"thread","processes thread injection detect","injection","memory","process-injection","api","apc-injection","thread-injection","nt-api",{"skillNo":166,"name":167,"nameZh":6,"description":168,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":169,"categories":170,"keywords":171,"publishedAt":24},"01M71HA7H311V5G14WMX58HQSS","processes-hollow-technique-detect","Detect process hollowing (RunPE) by identifying processes with mismatched image paths between PEB and VAD tree, or unmapped PE headers in memory.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fprocesses\u002Fhollow\u002Ftechnique\u002Fdetect\u002FSKILL.md",[],[172,65,136,173,159,70,174,175,23,81,176,177,178,179,180,181,69,71,182,183],"processes hollow technique detect","tree","memory-forensics","process-hollow","peb","runpe","image","pe-header","in memory","with","mismatched","headers"]