[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M71F4HPFNGDAYD3537131HZ9":3,"skill-same:01M71F4HPFNGDAYD3537131HZ9":93},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":18,"publishedAt":39,"linkOnly":40,"markdownContent":41,"markdownBody":42,"frontMatter":43,"refName":66,"commitSha":67,"skillDirectory":68,"forksCount":14,"repositoryHtmlUrl":69,"repositoryHomepageUrl":6,"ownerHtmlUrl":70,"ownerBlogUrl":6,"ownerDescription":71,"updatedAt":72,"install":73,"resources":86},"01M71F4HPFNGDAYD3537131HZ9","dynamic-mobile-analyze",null,"Detects and analyzes malicious behavior in mobile applications through behavioral analysis, permission abuse detection, network traffic monitoring, and dynamic instrumentation. Use when analyzing suspicious mobile applications for data exfiltration, command-and-control communication, credential stealing, SMS interception, or other malware indicators. Activates for requests involving mobile malware analysis, app behavior monitoring, trojan detection, or suspicious app investigation.","DCx7C5\u002Fai-marketplace","DCx7C5","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F42419559?v=4","01M71C01G2AZV3NTNGWAWSHJPP","DC","01M71C01GQW6G50S2BYMS7PP3E",0,"MIT","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fmalware\u002Fdynamic\u002Fmobile\u002Fanalyze\u002FSKILL.md",[],[19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38],"analyze","mobile","dynamic mobile analyze","command","de","communication","abuse detection","suspicious","malicious","monitoring","exfiltration","analysis","Bash","when","cybersecurity","traffic","testing","cm","command-and-control","app","2026-11-10 10:12:30",false,"---\nname: dynamic-mobile-analyze\ndescription: Detects and analyzes malicious behavior in mobile applications through behavioral analysis, permission abuse detection, network traffic monitoring, and dynamic instrumentation. Use when analyzing suspicious mobile applications for data exfiltration, command-and-control communication, credential stealing, SMS interception, or other malware indicators. Activates for requests involving mobile malware analysis, app behavior monitoring, trojan detection, or suspicious app investigation.\ndomain: cybersecurity\nsubdomain: mobile-security\ntags:\n- mobile-security\n- android\n- ios\n- malware-analysis\n- owasp-mobile\n- penetration-testing\nnist_csf:\n- PR.PS-01\n- PR.AA-05\n- ID.RA-01\n- DE.CM-09\nmodel: sonnet\nmaxTurns: 20\ntools: [Read, Bash, Glob, Grep]\nmitre_attack:\n- T1041\n- T1404\ncapec: []\n---\n\n# Detecting Mobile Malware Behavior\n\n## When to Use\n\nUse this skill when:\n- Analyzing suspicious mobile applications submitted by users or discovered during incident response\n- Monitoring enterprise mobile fleet for malicious app indicators\n- Performing malware triage on APK\u002FIPA samples\n- Investigating data exfiltration or unauthorized device access from mobile apps\n\n**Do not use** this skill to create, enhance, or distribute malware. This skill is for defensive analysis only.\n\n## Prerequisites\n\n- Isolated analysis environment (dedicated device or emulator, not connected to production networks)\n- MobSF for automated static+dynamic analysis\n- Frida\u002FObjection for runtime behavior monitoring\n- Wireshark\u002Ftcpdump for network traffic capture\n- Android emulator (AVD) or Genymotion for safe execution\n- VirusTotal API key for hash lookups\n\n## Workflow\n\n### Step 1: Static Indicator Analysis\n\n```bash\n# Hash the sample\nsha256sum suspicious.apk\n\n# Check VirusTotal\ncurl -s \"https:\u002F\u002Fwww.virustotal.com\u002Fapi\u002Fv3\u002Ffiles\u002F\u003CSHA256>\" \\\n  -H \"x-apikey: \u003CVT_API_KEY>\" | jq '.data.attributes.last_analysis_stats'\n\n# Extract permissions from AndroidManifest.xml\naapt dump permissions suspicious.apk\n\n# High-risk permission combinations:\n# READ_SMS + INTERNET = SMS stealer\n# RECEIVE_SMS + SEND_SMS = SMS interceptor\u002Fbanker trojan\n# ACCESSIBILITY_SERVICE + INTERNET = overlay attack capability\n# CAMERA + RECORD_AUDIO + INTERNET = spyware\n# DEVICE_ADMIN + INTERNET = ransomware capability\n# READ_CONTACTS + INTERNET = contact exfiltration\n```\n\n### Step 2: MobSF Automated Malware Scan\n\n```bash\n# Upload to MobSF\ncurl -F \"file=@suspicious.apk\" http:\u002F\u002Flocalhost:8000\u002Fapi\u002Fv1\u002Fupload \\\n  -H \"Authorization: \u003CAPI_KEY>\"\n\n# Review malware indicators in report:\n# - Hardcoded C2 server addresses\n# - Dynamic code loading (DexClassLoader)\n# - Reflection-based API calls (to evade static analysis)\n# - Encrypted\u002Fobfuscated payloads\n# - Root detection (malware often checks for root)\n# - Anti-emulator checks (malware evades sandbox)\n```\n\n### Step 3: Network Behavior Monitoring\n\n```bash\n# Start packet capture on emulator\ntcpdump -i any -w malware_traffic.pcap\n\n# Or use mitmproxy for HTTP\u002FHTTPS\nmitmproxy --mode transparent\n\n# Monitor for:\n# - DNS lookups to suspicious\u002Fnewly registered domains\n# - Connections to known C2 infrastructure\n# - Data exfiltration patterns (large POST requests)\n# - Beaconing behavior (regular interval connections)\n# - Non-standard ports and protocols\n# - Domain Generation Algorithm (DGA) patterns\n```\n\n### Step 4: Runtime Behavior Monitoring with Frida\n\n```javascript\n\u002F\u002F monitor_malware.js - Comprehensive behavior monitoring\nJava.perform(function() {\n    \u002F\u002F Monitor SMS access\n    var SmsManager = Java.use(\"android.telephony.SmsManager\");\n    SmsManager.sendTextMessage.overload(\"java.lang.String\", \"java.lang.String\",\n        \"java.lang.String\", \"android.app.PendingIntent\", \"android.app.PendingIntent\")\n        .implementation = function(dest, sc, text, sent, delivery) {\n            console.log(\"[SMS] Sending to: \" + dest + \" Text: \" + text);\n            \u002F\u002F Allow or block based on analysis needs\n            return this.sendTextMessage(dest, sc, text, sent, delivery);\n        };\n\n    \u002F\u002F Monitor file operations\n    var FileOutputStream = Java.use(\"java.io.FileOutputStream\");\n    FileOutputStream.$init.overload(\"java.lang.String\").implementation = function(path) {\n        console.log(\"[FILE-WRITE] \" + path);\n        return this.$init(path);\n    };\n\n    \u002F\u002F Monitor network connections\n    var URL = Java.use(\"java.net.URL\");\n    URL.openConnection.overload().implementation = function() {\n        console.log(\"[NET] \" + this.toString());\n        return this.openConnection();\n    };\n\n    \u002F\u002F Monitor dynamic code loading\n    var DexClassLoader = Java.use(\"dalvik.system.DexClassLoader\");\n    DexClassLoader.$init.implementation = function(dexPath, optDir, libPath, parent) {\n        console.log(\"[DEX-LOAD] Loading: \" + dexPath);\n        return this.$init(dexPath, optDir, libPath, parent);\n    };\n\n    \u002F\u002F Monitor command execution\n    var Runtime = Java.use(\"java.lang.Runtime\");\n    Runtime.exec.overload(\"java.lang.String\").implementation = function(cmd) {\n        console.log(\"[EXEC] \" + cmd);\n        return this.exec(cmd);\n    };\n\n    \u002F\u002F Monitor camera\u002Faudio access\n    var Camera = Java.use(\"android.hardware.Camera\");\n    Camera.open.overload(\"int\").implementation = function(id) {\n        console.log(\"[CAMERA] Camera opened: \" + id);\n        return this.open(id);\n    };\n\n    \u002F\u002F Monitor content provider access (contacts, call log)\n    var ContentResolver = Java.use(\"android.content.ContentResolver\");\n    ContentResolver.query.overload(\"android.net.Uri\", \"[Ljava.lang.String;\",\n        \"java.lang.String\", \"[Ljava.lang.String;\", \"java.lang.String\")\n        .implementation = function(uri, proj, sel, selArgs, sort) {\n            console.log(\"[QUERY] \" + uri.toString());\n            return this.query(uri, proj, sel, selArgs, sort);\n        };\n\n    console.log(\"[*] Malware behavior monitor active\");\n});\n```\n\n### Step 5: Classify Malware Type\n\nBased on observed behaviors, classify the sample:\n\n| Behavior Pattern | Malware Type |\n|-----------------|-------------|\n| SMS interception + C2 communication | Banking Trojan |\n| Camera\u002Fmic access + data upload | Spyware\u002FStalkerware |\n| File encryption + ransom note display | Mobile Ransomware |\n| Ad injection + click fraud traffic | Adware |\n| Root exploit + persistence | Rootkit |\n| Contact harvesting + SMS spam | Worm\u002FSMS Spammer |\n| Overlay attacks + credential capture | Credential Stealer |\n| Crypto mining network activity | Cryptojacker |\n\n## Key Concepts\n\n| Term | Definition |\n|------|-----------|\n| **Dynamic Code Loading** | Loading executable code at runtime from external sources, commonly used by malware to evade static analysis |\n| **C2 Beacon** | Regular network check-in from malware to command-and-control server, identifiable by periodic timing patterns |\n| **DGA** | Domain Generation Algorithm creating pseudo-random domain names for resilient C2 infrastructure |\n| **Overlay Attack** | Drawing fake UI over legitimate apps to capture credentials, requiring SYSTEM_ALERT_WINDOW permission |\n| **Anti-Emulator** | Techniques malware uses to detect sandbox\u002Femulator environments and suppress malicious behavior |\n\n## Tools & Systems\n\n- **MobSF**: Automated static and dynamic analysis for initial malware triage\n- **VirusTotal**: Multi-engine malware scanning and hash reputation lookup\n- **Frida**: Runtime behavior monitoring through method hooking\n- **Wireshark**: Network traffic analysis for C2 communication patterns\n- **Cuckoo Sandbox \u002F CuckooDroid**: Automated malware analysis sandbox for Android samples\n\n## Common Pitfalls\n\n- **Anti-analysis evasion**: Sophisticated malware detects emulators, debuggers, and Frida. Use hardware devices and stealthy Frida configurations for accurate analysis.\n- **Time-delayed payloads**: Some malware activates only after a delay or specific trigger. Monitor for extended periods and simulate various conditions.\n- **Encrypted C2**: Malware using encrypted communications requires TLS interception or memory inspection to observe payload content.\n- **Multi-stage payloads**: Initial APK may be benign; malicious payload downloads later. Monitor for dynamic code loading and file downloads.\n","# Detecting Mobile Malware Behavior\n\n## When to Use\n\nUse this skill when:\n- Analyzing suspicious mobile applications submitted by users or discovered during incident response\n- Monitoring enterprise mobile fleet for malicious app indicators\n- Performing malware triage on APK\u002FIPA samples\n- Investigating data exfiltration or unauthorized device access from mobile apps\n\n**Do not use** this skill to create, enhance, or distribute malware. This skill is for defensive analysis only.\n\n## Prerequisites\n\n- Isolated analysis environment (dedicated device or emulator, not connected to production networks)\n- MobSF for automated static+dynamic analysis\n- Frida\u002FObjection for runtime behavior monitoring\n- Wireshark\u002Ftcpdump for network traffic capture\n- Android emulator (AVD) or Genymotion for safe execution\n- VirusTotal API key for hash lookups\n\n## Workflow\n\n### Step 1: Static Indicator Analysis\n\n```bash\n# Hash the sample\nsha256sum suspicious.apk\n\n# Check VirusTotal\ncurl -s \"https:\u002F\u002Fwww.virustotal.com\u002Fapi\u002Fv3\u002Ffiles\u002F\u003CSHA256>\" \\\n  -H \"x-apikey: \u003CVT_API_KEY>\" | jq '.data.attributes.last_analysis_stats'\n\n# Extract permissions from AndroidManifest.xml\naapt dump permissions suspicious.apk\n\n# High-risk permission combinations:\n# READ_SMS + INTERNET = SMS stealer\n# RECEIVE_SMS + SEND_SMS = SMS interceptor\u002Fbanker trojan\n# ACCESSIBILITY_SERVICE + INTERNET = overlay attack capability\n# CAMERA + RECORD_AUDIO + INTERNET = spyware\n# DEVICE_ADMIN + INTERNET = ransomware capability\n# READ_CONTACTS + INTERNET = contact exfiltration\n```\n\n### Step 2: MobSF Automated Malware Scan\n\n```bash\n# Upload to MobSF\ncurl -F \"file=@suspicious.apk\" http:\u002F\u002Flocalhost:8000\u002Fapi\u002Fv1\u002Fupload \\\n  -H \"Authorization: \u003CAPI_KEY>\"\n\n# Review malware indicators in report:\n# - Hardcoded C2 server addresses\n# - Dynamic code loading (DexClassLoader)\n# - Reflection-based API calls (to evade static analysis)\n# - Encrypted\u002Fobfuscated payloads\n# - Root detection (malware often checks for root)\n# - Anti-emulator checks (malware evades sandbox)\n```\n\n### Step 3: Network Behavior Monitoring\n\n```bash\n# Start packet capture on emulator\ntcpdump -i any -w malware_traffic.pcap\n\n# Or use mitmproxy for HTTP\u002FHTTPS\nmitmproxy --mode transparent\n\n# Monitor for:\n# - DNS lookups to suspicious\u002Fnewly registered domains\n# - Connections to known C2 infrastructure\n# - Data exfiltration patterns (large POST requests)\n# - Beaconing behavior (regular interval connections)\n# - Non-standard ports and protocols\n# - Domain Generation Algorithm (DGA) patterns\n```\n\n### Step 4: Runtime Behavior Monitoring with Frida\n\n```javascript\n\u002F\u002F monitor_malware.js - Comprehensive behavior monitoring\nJava.perform(function() {\n    \u002F\u002F Monitor SMS access\n    var SmsManager = Java.use(\"android.telephony.SmsManager\");\n    SmsManager.sendTextMessage.overload(\"java.lang.String\", \"java.lang.String\",\n        \"java.lang.String\", \"android.app.PendingIntent\", \"android.app.PendingIntent\")\n        .implementation = function(dest, sc, text, sent, delivery) {\n            console.log(\"[SMS] Sending to: \" + dest + \" Text: \" + text);\n            \u002F\u002F Allow or block based on analysis needs\n            return this.sendTextMessage(dest, sc, text, sent, delivery);\n        };\n\n    \u002F\u002F Monitor file operations\n    var FileOutputStream = Java.use(\"java.io.FileOutputStream\");\n    FileOutputStream.$init.overload(\"java.lang.String\").implementation = function(path) {\n        console.log(\"[FILE-WRITE] \" + path);\n        return this.$init(path);\n    };\n\n    \u002F\u002F Monitor network connections\n    var URL = Java.use(\"java.net.URL\");\n    URL.openConnection.overload().implementation = function() {\n        console.log(\"[NET] \" + this.toString());\n        return this.openConnection();\n    };\n\n    \u002F\u002F Monitor dynamic code loading\n    var DexClassLoader = Java.use(\"dalvik.system.DexClassLoader\");\n    DexClassLoader.$init.implementation = function(dexPath, optDir, libPath, parent) {\n        console.log(\"[DEX-LOAD] Loading: \" + dexPath);\n        return this.$init(dexPath, optDir, libPath, parent);\n    };\n\n    \u002F\u002F Monitor command execution\n    var Runtime = Java.use(\"java.lang.Runtime\");\n    Runtime.exec.overload(\"java.lang.String\").implementation = function(cmd) {\n        console.log(\"[EXEC] \" + cmd);\n        return this.exec(cmd);\n    };\n\n    \u002F\u002F Monitor camera\u002Faudio access\n    var Camera = Java.use(\"android.hardware.Camera\");\n    Camera.open.overload(\"int\").implementation = function(id) {\n        console.log(\"[CAMERA] Camera opened: \" + id);\n        return this.open(id);\n    };\n\n    \u002F\u002F Monitor content provider access (contacts, call log)\n    var ContentResolver = Java.use(\"android.content.ContentResolver\");\n    ContentResolver.query.overload(\"android.net.Uri\", \"[Ljava.lang.String;\",\n        \"java.lang.String\", \"[Ljava.lang.String;\", \"java.lang.String\")\n        .implementation = function(uri, proj, sel, selArgs, sort) {\n            console.log(\"[QUERY] \" + uri.toString());\n            return this.query(uri, proj, sel, selArgs, sort);\n        };\n\n    console.log(\"[*] Malware behavior monitor active\");\n});\n```\n\n### Step 5: Classify Malware Type\n\nBased on observed behaviors, classify the sample:\n\n| Behavior Pattern | Malware Type |\n|-----------------|-------------|\n| SMS interception + C2 communication | Banking Trojan |\n| Camera\u002Fmic access + data upload | Spyware\u002FStalkerware |\n| File encryption + ransom note display | Mobile Ransomware |\n| Ad injection + click fraud traffic | Adware |\n| Root exploit + persistence | Rootkit |\n| Contact harvesting + SMS spam | Worm\u002FSMS Spammer |\n| Overlay attacks + credential capture | Credential Stealer |\n| Crypto mining network activity | Cryptojacker |\n\n## Key Concepts\n\n| Term | Definition |\n|------|-----------|\n| **Dynamic Code Loading** | Loading executable code at runtime from external sources, commonly used by malware to evade static analysis |\n| **C2 Beacon** | Regular network check-in from malware to command-and-control server, identifiable by periodic timing patterns |\n| **DGA** | Domain Generation Algorithm creating pseudo-random domain names for resilient C2 infrastructure |\n| **Overlay Attack** | Drawing fake UI over legitimate apps to capture credentials, requiring SYSTEM_ALERT_WINDOW permission |\n| **Anti-Emulator** | Techniques malware uses to detect sandbox\u002Femulator environments and suppress malicious behavior |\n\n## Tools & Systems\n\n- **MobSF**: Automated static and dynamic analysis for initial malware triage\n- **VirusTotal**: Multi-engine malware scanning and hash reputation lookup\n- **Frida**: Runtime behavior monitoring through method hooking\n- **Wireshark**: Network traffic analysis for C2 communication patterns\n- **Cuckoo Sandbox \u002F CuckooDroid**: Automated malware analysis sandbox for Android samples\n\n## Common Pitfalls\n\n- **Anti-analysis evasion**: Sophisticated malware detects emulators, debuggers, and Frida. Use hardware devices and stealthy Frida configurations for accurate analysis.\n- **Time-delayed payloads**: Some malware activates only after a delay or specific trigger. Monitor for extended periods and simulate various conditions.\n- **Encrypted C2**: Malware using encrypted communications requires TLS interception or memory inspection to observe payload content.\n- **Multi-stage payloads**: Initial APK may be benign; malicious payload downloads later. Monitor for dynamic code loading and file downloads.\n",{"name":5,"tags":44,"capec":51,"model":52,"tools":53,"domain":33,"maxTurns":57,"nist_csf":58,"subdomain":45,"description":7,"mitre_attack":63},[45,46,47,48,49,50],"mobile-security","android","ios","malware-analysis","owasp-mobile","penetration-testing",[],"sonnet",[54,31,55,56],"Read","Glob","Grep",20,[59,60,61,62],"PR.PS-01","PR.AA-05","ID.RA-01","DE.CM-09",[64,65],"T1041","T1404","main","a91f1293287ffa9f4f1b8f486cd6e835a1568c84","skills\u002Fmalware\u002Fdynamic\u002Fmobile\u002Fanalyze","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace","https:\u002F\u002Fgithub.com\u002FDCx7C5","#Python","2026-09-01 11:21:00",{"source":8,"skillName":5,"commands":74,"prompt":84,"zipAvailable":85},[75,78,81],{"tool":76,"command":77},"npx","npx skills add DCx7C5\u002Fai-marketplace --skill dynamic-mobile-analyze",{"tool":79,"command":80},"bunx","bunx skills add DCx7C5\u002Fai-marketplace --skill dynamic-mobile-analyze",{"tool":82,"command":83},"pnpm","pnpm dlx skills add DCx7C5\u002Fai-marketplace --skill dynamic-mobile-analyze","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fmalware\u002Fdynamic\u002Fmobile\u002Fanalyze\u002FSKILL.md",true,[87],{"path":88,"resourceType":89,"resourceTypeDesc":90,"sizeBytes":91,"sourceHtmlUrl":92},"index.json","REFERENCE","参考文档",681,"https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fmalware\u002Fdynamic\u002Fmobile\u002Fanalyze\u002Findex.json",[94,117,136,156,178,194],{"skillNo":95,"name":96,"nameZh":6,"description":97,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":98,"categories":99,"keywords":100,"publishedAt":39},"01M71HAPZ01KQ30RKTB0FFSQ05","services-wmi-persistence-detect","Detect WMI event subscription persistence by enumerating ActiveScriptEventConsumer, CommandLineEventConsumer, and permanent subscriptions in the WMI repository.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fservices\u002Fwmi\u002Fpersistence\u002Fdetect\u002FSKILL.md",[],[101,102,103,104,105,23,36,106,107,108,109,110,111,112,113,114,115,33,116],"services","detect","services wmi persistence detect","wmi","persistence","process","activescript","event","subscriptions","commandline-consumer","repository","subscription","event-subscription","t1546.003","forensics","process-forensics",{"skillNo":118,"name":119,"nameZh":6,"description":120,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":121,"categories":122,"keywords":123,"publishedAt":39},"01M71HAK6JTTTS229T17WJMMCG","services-wmi-exec-exploit","Perform lateral movement across Windows networks using WMI-based remote execution techniques including Impacket wmiexec.py, CrackMapExec, and native WMI commands for stealthy post-exploitation during red team engagements.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fservices\u002Fwmi\u002Fexec\u002Fexploit\u002FSKILL.md",[],[124,101,125,104,126,127,34,33,31,30,128,129,130,131,23,22,132,133,134,135],"exploit","services wmi exec exploit","exec","remote","team","across","crackmapexec","native","lateral movement","read","lateral-movement","Impacket",{"skillNo":137,"name":138,"nameZh":6,"description":139,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":140,"categories":141,"keywords":142,"publishedAt":39},"01M71HAG6MHKNQV8KDZKMT4886","registry-artifact-extract","Extract and analyze Windows Registry hives to uncover user activity, installed software, autostart entries, and evidence of system compromise.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fregistry\u002Fartifact\u002Fextract\u002FSKILL.md",[],[143,144,145,146,147,148,33,31,149,30,19,150,23,133,151,152,153,154,155,52],"artifact","registry","registry artifact extract","extract","evidence-collection","artifact-analysis","collection","uncover","software","activity","digital-forensics","windows-registry","regripper",{"skillNo":157,"name":158,"nameZh":6,"description":159,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":160,"categories":161,"keywords":162,"publishedAt":39},"01M71HACR4A8XTWTTSXK4124AA","processes-token-impersonate-detect","Detect Windows token impersonation and privilege abuse including SeImpersonatePrivilege exploitation via Potato attacks and token stealing techniques.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fprocesses\u002Ftoken\u002Fimpersonate\u002Fdetect\u002FSKILL.md",[],[102,163,164,165,166,167,168,36,169,33,116,170,171,172,173,174,175,176,177,23],"processes token impersonate detect","token","processes","attacks","windows","escalation","techniques","privilege-escalation","seimpersonate","token-impersonation","printspoofer","exploitation","potato","impersonation","via",{"skillNo":179,"name":180,"nameZh":6,"description":181,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":182,"categories":183,"keywords":184,"publishedAt":39},"01M71HAABSB4Z6QFSXEG00R4RK","processes-thread-injection-detect","Detect Windows thread injection techniques including CreateRemoteThread, QueueUserAPC, NtCreateThreadEx, and thread hijacking via process memory analysis.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fprocesses\u002Fthread\u002Finjection\u002Fdetect\u002FSKILL.md",[],[185,186,102,187,165,167,188,36,189,169,33,116,30,190,191,192,193,177,23,106],"thread","processes thread injection detect","injection","memory","process-injection","api","apc-injection","thread-injection","nt-api",{"skillNo":195,"name":196,"nameZh":6,"description":197,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":198,"categories":199,"keywords":200,"publishedAt":39},"01M71HA7H311V5G14WMX58HQSS","processes-hollow-technique-detect","Detect process hollowing (RunPE) by identifying processes with mismatched image paths between PEB and VAD tree, or unmapped PE headers in memory.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fprocesses\u002Fhollow\u002Ftechnique\u002Fdetect\u002FSKILL.md",[],[201,102,165,202,188,36,203,204,33,116,205,206,207,208,209,210,23,106,211,212],"processes hollow technique detect","tree","memory-forensics","process-hollow","peb","runpe","image","pe-header","in memory","with","mismatched","headers"]