[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M71F6GFZE0JAXSXRABFB6TZC":3,"skill-same:01M71F6GFZE0JAXSXRABFB6TZC":93},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":23,"publishedAt":44,"linkOnly":45,"markdownContent":46,"markdownBody":47,"frontMatter":48,"refName":66,"commitSha":67,"skillDirectory":68,"forksCount":14,"repositoryHtmlUrl":69,"repositoryHomepageUrl":6,"ownerHtmlUrl":70,"ownerBlogUrl":6,"ownerDescription":71,"updatedAt":72,"install":73,"resources":86},"01M71F6GFZE0JAXSXRABFB6TZC","ransomware-cisaplaybook-detect",null,"Builds a structured ransomware incident response playbook aligned with the CISA StopRansomware Guide and NIST Cybersecurity Framework. Covers preparation, detection, containment, eradication, recovery, and post-incident phases with actionable checklists. Activates for requests involving ransomware response planning, CISA compliance, incident response playbook creation, or ransomware preparedness assessment.","DCx7C5\u002Fai-marketplace","DCx7C5","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F42419559?v=4","01M71C01G2AZV3NTNGWAWSHJPP","DC","01M71C01GQW6G50S2BYMS7PP3E",0,"MIT","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fmalware\u002Fransomware\u002Fcisaplaybook\u002Fdetect\u002FSKILL.md",[18],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000037","律师与法务","PROFESSION","适用职业",[24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43],"ransomware cisaplaybook detect","detect","ransomware","guide","sonnet","eradication","ransomware response","defense","NIST","playbook","read","CISA","Bash","incident response","cybersecurity","assessment","incident","actionable","creation","incident response playbook","2026-11-10 10:12:30",false,"---\nname: ransomware-cisaplaybook-detect\ndescription: Builds a structured ransomware incident response playbook aligned with the CISA StopRansomware Guide and NIST Cybersecurity Framework. Covers preparation, detection, containment, eradication, recovery, and post-incident phases with actionable checklists. Activates for requests involving ransomware response planning, CISA compliance, incident response playbook creation, or ransomware preparedness assessment.\ndomain: cybersecurity\nsubdomain: ransomware-defense\ntags:\n- ransomware\n- incident-response\n- CISA\n- playbook\n- compliance\n- NIST\nnist_csf:\n- PR.DS-11\n- RS.MA-01\n- RC.RP-01\n- PR.IR-01\nmodel: sonnet\nmaxTurns: 20\ntools: [Read, Bash, Glob, Grep]\nmitre_attack:\n- T1486\ncapec: []\n---\n\n# Building Ransomware Playbook with CISA Framework\n\n## When to Use\n\n- An organization needs to create or update its ransomware incident response playbook following CISA guidelines\n- A security team is conducting a ransomware readiness assessment against the CISA StopRansomware framework\n- Compliance requires documenting ransomware response procedures aligned with NIST CSF and CISA recommendations\n- During tabletop exercises to validate that the organization's ransomware response steps match industry best practices\n- After a ransomware incident to update the playbook with lessons learned and close identified gaps\n\n**Do not use** as a substitute for legal counsel regarding ransom payment decisions, breach notification timelines, or regulatory obligations specific to your jurisdiction.\n\n## Prerequisites\n\n- Familiarity with the CISA StopRansomware Guide (cisa.gov\u002Fstopransomware\u002Fransomware-guide)\n- NIST Cybersecurity Framework (CSF) understanding (Identify, Protect, Detect, Respond, Recover)\n- Inventory of critical assets, backup infrastructure, and communication channels\n- Defined roles and responsibilities for incident response team members\n- Python 3.8+ for playbook generation and compliance checking automation\n- Access to organization's asset inventory and backup configuration documentation\n\n## Workflow\n\n### Step 1: Preparation Phase (CISA Part 1 - Prevention)\n\nEstablish ransomware-specific defenses before an incident:\n\n```\nCISA Preparation Checklist:\n━━━━━━━━━━━━━━━━━━━━━━━━━━\n[ ] Maintain offline, encrypted backups tested for restoration\n[ ] Create and exercise a cyber incident response plan (IRP)\n[ ] Implement network segmentation between IT and OT networks\n[ ] Enable MFA on all remote access and privileged accounts\n[ ] Deploy endpoint detection and response (EDR) on all endpoints\n[ ] Disable or restrict RDP; require VPN for remote access\n[ ] Maintain a software\u002Fhardware asset inventory\n[ ] Apply patches within 48 hours for internet-facing systems\n[ ] Configure email filtering and disable macro execution by default\n[ ] Conduct regular phishing awareness training\n[ ] Implement application allowlisting (AppLocker\u002FWDAC)\n[ ] Test backup restoration quarterly and document RTO\u002FRPO\n```\n\n### Step 2: Detection and Analysis Phase\n\nIdentify ransomware indicators and assess scope:\n\n```\nDetection Indicators:\n━━━━━━━━━━━━━━━━━━━━\n- Mass file rename operations with new extensions (.locked, .encrypted)\n- Ransom notes appearing in directories (README.txt, DECRYPT.html)\n- Volume Shadow Copy deletion (vssadmin delete shadows)\n- Abnormal CPU usage from encryption processes\n- EDR\u002FAV alerts for known ransomware signatures\n- Network connections to known C2 infrastructure\n- Unusual lateral movement via SMB or PsExec\n- Sysmon Event ID 11 (file creation) spikes\n\nInitial Analysis Steps (CISA):\n  1. Take system images and memory captures of affected devices\n  2. Identify patient zero and initial access vector\n  3. Determine the ransomware family (ID Ransomware, ransom note analysis)\n  4. Assess encryption scope: which systems, shares, and data are affected\n  5. Check if data exfiltration occurred (double extortion indicator)\n```\n\n### Step 3: Containment Phase\n\nStop the spread and preserve evidence:\n\n```\nImmediate Containment (First 1-4 hours):\n━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━\n1. Isolate affected systems from the network (disable NICs, VLAN quarantine)\n2. If unable to disconnect, power down affected systems\n3. Disable shared drives to prevent encryption spread\n4. Reset credentials for compromised accounts (especially admin\u002Fservice accounts)\n5. Block known ransomware IOCs at firewall\u002Fproxy (C2 domains, IPs)\n6. Preserve forensic evidence (memory dumps, disk images, logs)\n7. Engage legal counsel and prepare breach notification if data exfiltrated\n\nExtended Containment:\n  - Identify and patch the initial access vector (phishing, RDP, VPN vuln)\n  - Audit all Active Directory accounts for persistence (scheduled tasks, services)\n  - Check for backdoors or additional malware beyond the ransomware payload\n```\n\n### Step 4: Eradication and Recovery Phase\n\nRemove the threat and restore operations:\n\n```\nCISA Recovery Steps:\n━━━━━━━━━━━━━━━━━━━\n1. Rebuild affected systems from known-clean images (do NOT decrypt in place)\n2. Restore data from offline backups (verify backup integrity first)\n3. Reset ALL passwords including service accounts, krbtgt (twice, 12h apart)\n4. Scan restored systems with updated AV\u002FEDR before reconnecting to network\n5. Re-enable services in priority order based on business criticality\n6. Monitor restored systems intensively for 72 hours for reinfection\n\nRecovery Priority Matrix:\n  P1 (0-4h):  Domain controllers, DNS, authentication infrastructure\n  P2 (4-24h): Email, critical business applications, databases\n  P3 (1-3d):  File servers, departmental applications\n  P4 (3-7d):  Non-critical systems, development environments\n```\n\n### Step 5: Post-Incident Activity\n\nDocument lessons learned and improve defenses:\n\n```\nPost-Incident Report Template:\n━━━━━━━━━━━━━━━━━━━━━━━━━━━━━\n1. Executive summary: What happened, impact, resolution\n2. Timeline: Detection to full recovery with timestamps\n3. Root cause analysis: Initial access vector and propagation path\n4. Scope: Number of systems, data volumes, business impact in hours\u002Fdollars\n5. Response effectiveness: What worked, what failed, what was missing\n6. Recommendations: Specific technical and procedural improvements\n7. Compliance actions: Notification timeline, regulatory obligations met\n8. Updated playbook: Revisions based on lessons learned\n```\n\n## Verification\n\n- Validate playbook completeness against CISA StopRansomware checklist items\n- Conduct tabletop exercise using the playbook with all stakeholders\n- Verify backup restoration procedures work within documented RTO targets\n- Test communication plans including out-of-band channels\n- Confirm legal and regulatory notification procedures are current\n- Review and update the playbook at least annually or after any incident\n\n## Key Concepts\n\n| Term | Definition |\n|------|------------|\n| **CISA StopRansomware Guide** | Joint CISA\u002FMS-ISAC\u002FNSA\u002FFBI guide providing ransomware prevention best practices and response checklists |\n| **RTO\u002FRPO** | Recovery Time Objective (max downtime) and Recovery Point Objective (max data loss); critical metrics for backup planning |\n| **Double Extortion** | Ransomware tactic where attackers both encrypt data and threaten to publish stolen data unless paid |\n| **Patient Zero** | The first system compromised in an incident; identifying it reveals the initial access vector |\n| **Tabletop Exercise** | Simulated incident scenario walked through by the response team to validate the playbook without live systems |\n\n## Tools & Systems\n\n- **CISA StopRansomware Guide**: Primary framework for ransomware response planning and prevention\n- **NIST CSF**: Cybersecurity Framework providing the Identify\u002FProtect\u002FDetect\u002FRespond\u002FRecover structure\n- **ID Ransomware**: Service for identifying ransomware families from encrypted files and ransom notes\n- **MITRE ATT&CK**: Technique framework for mapping ransomware TTPs to detection opportunities\n- **Velociraptor**: Endpoint visibility tool for rapid triage and forensic artifact collection during incidents\n","# Building Ransomware Playbook with CISA Framework\n\n## When to Use\n\n- An organization needs to create or update its ransomware incident response playbook following CISA guidelines\n- A security team is conducting a ransomware readiness assessment against the CISA StopRansomware framework\n- Compliance requires documenting ransomware response procedures aligned with NIST CSF and CISA recommendations\n- During tabletop exercises to validate that the organization's ransomware response steps match industry best practices\n- After a ransomware incident to update the playbook with lessons learned and close identified gaps\n\n**Do not use** as a substitute for legal counsel regarding ransom payment decisions, breach notification timelines, or regulatory obligations specific to your jurisdiction.\n\n## Prerequisites\n\n- Familiarity with the CISA StopRansomware Guide (cisa.gov\u002Fstopransomware\u002Fransomware-guide)\n- NIST Cybersecurity Framework (CSF) understanding (Identify, Protect, Detect, Respond, Recover)\n- Inventory of critical assets, backup infrastructure, and communication channels\n- Defined roles and responsibilities for incident response team members\n- Python 3.8+ for playbook generation and compliance checking automation\n- Access to organization's asset inventory and backup configuration documentation\n\n## Workflow\n\n### Step 1: Preparation Phase (CISA Part 1 - Prevention)\n\nEstablish ransomware-specific defenses before an incident:\n\n```\nCISA Preparation Checklist:\n━━━━━━━━━━━━━━━━━━━━━━━━━━\n[ ] Maintain offline, encrypted backups tested for restoration\n[ ] Create and exercise a cyber incident response plan (IRP)\n[ ] Implement network segmentation between IT and OT networks\n[ ] Enable MFA on all remote access and privileged accounts\n[ ] Deploy endpoint detection and response (EDR) on all endpoints\n[ ] Disable or restrict RDP; require VPN for remote access\n[ ] Maintain a software\u002Fhardware asset inventory\n[ ] Apply patches within 48 hours for internet-facing systems\n[ ] Configure email filtering and disable macro execution by default\n[ ] Conduct regular phishing awareness training\n[ ] Implement application allowlisting (AppLocker\u002FWDAC)\n[ ] Test backup restoration quarterly and document RTO\u002FRPO\n```\n\n### Step 2: Detection and Analysis Phase\n\nIdentify ransomware indicators and assess scope:\n\n```\nDetection Indicators:\n━━━━━━━━━━━━━━━━━━━━\n- Mass file rename operations with new extensions (.locked, .encrypted)\n- Ransom notes appearing in directories (README.txt, DECRYPT.html)\n- Volume Shadow Copy deletion (vssadmin delete shadows)\n- Abnormal CPU usage from encryption processes\n- EDR\u002FAV alerts for known ransomware signatures\n- Network connections to known C2 infrastructure\n- Unusual lateral movement via SMB or PsExec\n- Sysmon Event ID 11 (file creation) spikes\n\nInitial Analysis Steps (CISA):\n  1. Take system images and memory captures of affected devices\n  2. Identify patient zero and initial access vector\n  3. Determine the ransomware family (ID Ransomware, ransom note analysis)\n  4. Assess encryption scope: which systems, shares, and data are affected\n  5. Check if data exfiltration occurred (double extortion indicator)\n```\n\n### Step 3: Containment Phase\n\nStop the spread and preserve evidence:\n\n```\nImmediate Containment (First 1-4 hours):\n━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━\n1. Isolate affected systems from the network (disable NICs, VLAN quarantine)\n2. If unable to disconnect, power down affected systems\n3. Disable shared drives to prevent encryption spread\n4. Reset credentials for compromised accounts (especially admin\u002Fservice accounts)\n5. Block known ransomware IOCs at firewall\u002Fproxy (C2 domains, IPs)\n6. Preserve forensic evidence (memory dumps, disk images, logs)\n7. Engage legal counsel and prepare breach notification if data exfiltrated\n\nExtended Containment:\n  - Identify and patch the initial access vector (phishing, RDP, VPN vuln)\n  - Audit all Active Directory accounts for persistence (scheduled tasks, services)\n  - Check for backdoors or additional malware beyond the ransomware payload\n```\n\n### Step 4: Eradication and Recovery Phase\n\nRemove the threat and restore operations:\n\n```\nCISA Recovery Steps:\n━━━━━━━━━━━━━━━━━━━\n1. Rebuild affected systems from known-clean images (do NOT decrypt in place)\n2. Restore data from offline backups (verify backup integrity first)\n3. Reset ALL passwords including service accounts, krbtgt (twice, 12h apart)\n4. Scan restored systems with updated AV\u002FEDR before reconnecting to network\n5. Re-enable services in priority order based on business criticality\n6. Monitor restored systems intensively for 72 hours for reinfection\n\nRecovery Priority Matrix:\n  P1 (0-4h):  Domain controllers, DNS, authentication infrastructure\n  P2 (4-24h): Email, critical business applications, databases\n  P3 (1-3d):  File servers, departmental applications\n  P4 (3-7d):  Non-critical systems, development environments\n```\n\n### Step 5: Post-Incident Activity\n\nDocument lessons learned and improve defenses:\n\n```\nPost-Incident Report Template:\n━━━━━━━━━━━━━━━━━━━━━━━━━━━━━\n1. Executive summary: What happened, impact, resolution\n2. Timeline: Detection to full recovery with timestamps\n3. Root cause analysis: Initial access vector and propagation path\n4. Scope: Number of systems, data volumes, business impact in hours\u002Fdollars\n5. Response effectiveness: What worked, what failed, what was missing\n6. Recommendations: Specific technical and procedural improvements\n7. Compliance actions: Notification timeline, regulatory obligations met\n8. Updated playbook: Revisions based on lessons learned\n```\n\n## Verification\n\n- Validate playbook completeness against CISA StopRansomware checklist items\n- Conduct tabletop exercise using the playbook with all stakeholders\n- Verify backup restoration procedures work within documented RTO targets\n- Test communication plans including out-of-band channels\n- Confirm legal and regulatory notification procedures are current\n- Review and update the playbook at least annually or after any incident\n\n## Key Concepts\n\n| Term | Definition |\n|------|------------|\n| **CISA StopRansomware Guide** | Joint CISA\u002FMS-ISAC\u002FNSA\u002FFBI guide providing ransomware prevention best practices and response checklists |\n| **RTO\u002FRPO** | Recovery Time Objective (max downtime) and Recovery Point Objective (max data loss); critical metrics for backup planning |\n| **Double Extortion** | Ransomware tactic where attackers both encrypt data and threaten to publish stolen data unless paid |\n| **Patient Zero** | The first system compromised in an incident; identifying it reveals the initial access vector |\n| **Tabletop Exercise** | Simulated incident scenario walked through by the response team to validate the playbook without live systems |\n\n## Tools & Systems\n\n- **CISA StopRansomware Guide**: Primary framework for ransomware response planning and prevention\n- **NIST CSF**: Cybersecurity Framework providing the Identify\u002FProtect\u002FDetect\u002FRespond\u002FRecover structure\n- **ID Ransomware**: Service for identifying ransomware families from encrypted files and ransom notes\n- **MITRE ATT&CK**: Technique framework for mapping ransomware TTPs to detection opportunities\n- **Velociraptor**: Endpoint visibility tool for rapid triage and forensic artifact collection during incidents\n",{"name":5,"tags":49,"capec":52,"model":28,"tools":53,"domain":38,"maxTurns":57,"nist_csf":58,"subdomain":63,"description":7,"mitre_attack":64},[26,50,35,33,51,32],"incident-response","compliance",[],[54,36,55,56],"Read","Glob","Grep",20,[59,60,61,62],"PR.DS-11","RS.MA-01","RC.RP-01","PR.IR-01","ransomware-defense",[65],"T1486","main","a91f1293287ffa9f4f1b8f486cd6e835a1568c84","skills\u002Fmalware\u002Fransomware\u002Fcisaplaybook\u002Fdetect","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace","https:\u002F\u002Fgithub.com\u002FDCx7C5","#Python","2026-09-01 11:21:00",{"source":8,"skillName":5,"commands":74,"prompt":84,"zipAvailable":85},[75,78,81],{"tool":76,"command":77},"npx","npx skills add DCx7C5\u002Fai-marketplace --skill ransomware-cisaplaybook-detect",{"tool":79,"command":80},"bunx","bunx skills add DCx7C5\u002Fai-marketplace --skill ransomware-cisaplaybook-detect",{"tool":82,"command":83},"pnpm","pnpm dlx skills add DCx7C5\u002Fai-marketplace --skill ransomware-cisaplaybook-detect","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fmalware\u002Fransomware\u002Fcisaplaybook\u002Fdetect\u002FSKILL.md",true,[87],{"path":88,"resourceType":89,"resourceTypeDesc":90,"sizeBytes":91,"sourceHtmlUrl":92},"index.json","REFERENCE","参考文档",705,"https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fmalware\u002Fransomware\u002Fcisaplaybook\u002Fdetect\u002Findex.json",[94,118,139,160,182,198],{"skillNo":95,"name":96,"nameZh":6,"description":97,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":98,"categories":99,"keywords":100,"publishedAt":44},"01M71HAPZ01KQ30RKTB0FFSQ05","services-wmi-persistence-detect","Detect WMI event subscription persistence by enumerating ActiveScriptEventConsumer, CommandLineEventConsumer, and permanent subscriptions in the WMI repository.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fservices\u002Fwmi\u002Fpersistence\u002Fdetect\u002FSKILL.md",[],[101,25,102,103,104,105,106,107,108,109,110,111,112,113,114,115,116,38,117],"services","services wmi persistence detect","wmi","persistence","de","cm","process","activescript","event","subscriptions","commandline-consumer","repository","subscription","event-subscription","t1546.003","forensics","process-forensics",{"skillNo":119,"name":120,"nameZh":6,"description":121,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":122,"categories":123,"keywords":124,"publishedAt":44},"01M71HAK6JTTTS229T17WJMMCG","services-wmi-exec-exploit","Perform lateral movement across Windows networks using WMI-based remote execution techniques including Impacket wmiexec.py, CrackMapExec, and native WMI commands for stealthy post-exploitation during red team engagements.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fservices\u002Fwmi\u002Fexec\u002Fexploit\u002FSKILL.md",[],[125,101,126,103,127,128,129,38,36,130,131,132,133,134,105,135,136,34,137,138],"exploit","services wmi exec exploit","exec","remote","traffic","analysis","team","across","crackmapexec","native","command","lateral movement","lateral-movement","Impacket",{"skillNo":140,"name":141,"nameZh":6,"description":142,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":143,"categories":144,"keywords":145,"publishedAt":44},"01M71HAG6MHKNQV8KDZKMT4886","registry-artifact-extract","Extract and analyze Windows Registry hives to uncover user activity, installed software, autostart entries, and evidence of system compromise.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fregistry\u002Fartifact\u002Fextract\u002FSKILL.md",[],[146,147,148,149,150,151,38,36,152,130,153,154,105,34,155,156,157,158,159,28],"artifact","registry","registry artifact extract","extract","evidence-collection","artifact-analysis","collection","analyze","uncover","software","activity","digital-forensics","windows-registry","regripper",{"skillNo":161,"name":162,"nameZh":6,"description":163,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":164,"categories":165,"keywords":166,"publishedAt":44},"01M71HACR4A8XTWTTSXK4124AA","processes-token-impersonate-detect","Detect Windows token impersonation and privilege abuse including SeImpersonatePrivilege exploitation via Potato attacks and token stealing techniques.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fprocesses\u002Ftoken\u002Fimpersonate\u002Fdetect\u002FSKILL.md",[],[25,167,168,169,170,171,172,106,173,38,117,174,175,176,177,178,179,180,181,105],"processes token impersonate detect","token","processes","attacks","windows","escalation","techniques","privilege-escalation","seimpersonate","token-impersonation","printspoofer","exploitation","potato","impersonation","via",{"skillNo":183,"name":184,"nameZh":6,"description":185,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":186,"categories":187,"keywords":188,"publishedAt":44},"01M71HAABSB4Z6QFSXEG00R4RK","processes-thread-injection-detect","Detect Windows thread injection techniques including CreateRemoteThread, QueueUserAPC, NtCreateThreadEx, and thread hijacking via process memory analysis.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fprocesses\u002Fthread\u002Finjection\u002Fdetect\u002FSKILL.md",[],[189,190,25,191,169,171,192,106,193,173,38,117,130,194,195,196,197,181,105,107],"thread","processes thread injection detect","injection","memory","process-injection","api","apc-injection","thread-injection","nt-api",{"skillNo":199,"name":200,"nameZh":6,"description":201,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":202,"categories":203,"keywords":204,"publishedAt":44},"01M71HA7H311V5G14WMX58HQSS","processes-hollow-technique-detect","Detect process hollowing (RunPE) by identifying processes with mismatched image paths between PEB and VAD tree, or unmapped PE headers in memory.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fprocesses\u002Fhollow\u002Ftechnique\u002Fdetect\u002FSKILL.md",[],[205,25,169,206,192,106,207,208,38,117,209,210,211,212,213,214,105,107,215,216],"processes hollow technique detect","tree","memory-forensics","process-hollow","peb","runpe","image","pe-header","in memory","with","mismatched","headers"]