[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M71F76WMTVVQK6048ASYRHAF":3,"skill-same:01M71F76WMTVVQK6048ASYRHAF":107},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":23,"publishedAt":44,"linkOnly":45,"markdownContent":46,"markdownBody":47,"frontMatter":48,"refName":80,"commitSha":81,"skillDirectory":82,"forksCount":14,"repositoryHtmlUrl":83,"repositoryHomepageUrl":6,"ownerHtmlUrl":84,"ownerBlogUrl":6,"ownerDescription":85,"updatedAt":86,"install":87,"resources":100},"01M71F76WMTVVQK6048ASYRHAF","ransomware-immutable-exploit",null,"Implements immutable backup strategy using restic with S3-compatible storage and object lock for ransomware-resistant data protection. Automates backup creation, integrity verification via restic check --read-data, snapshot retention policy enforcement, and restore testing. Integrates with AWS S3 Object Lock, MinIO, and Backblaze B2 for WORM (Write Once Read Many) storage that prevents backup deletion or encryption by ransomware actors.","DCx7C5\u002Fai-marketplace","DCx7C5","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F42419559?v=4","01M71C01G2AZV3NTNGWAWSHJPP","DC","01M71C01GQW6G50S2BYMS7PP3E",0,"MIT","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fmalware\u002Fransomware\u002Fimmutable\u002Fexploit\u002FSKILL.md",[18],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000008","测试与质量","SCENARIO","使用场景",[24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43],"exploit","ransomware immutable exploit","immutable","ransomware","snapshot","write","read","storage","verification","lock","encryption","Bash","aml","cybersecurity","map","aws s3","testing","retention","creation","backup strategy","2026-11-10 10:12:30",false,"---\nname: ransomware-immutable-exploit\ndescription: Implements immutable backup strategy using restic with S3-compatible storage and object lock for ransomware-resistant data protection. Automates backup creation, integrity verification via restic check --read-data, snapshot retention policy enforcement, and restore testing. Integrates with AWS S3 Object Lock, MinIO, and Backblaze B2 for WORM (Write Once Read Many) storage that prevents backup deletion or encryption by ransomware actors.\ndomain: cybersecurity\nsubdomain: ransomware-defense\ntags:\n- restic\n- backup\n- immutable\n- ransomware\n- s3\n- object-lock\n- worm\n- recovery\nnist_ai_rmf:\n- MEASURE-2.7\n- MAP-5.1\n- MANAGE-2.4\natlas_techniques:\n- AML.T0070\n- AML.T0066\n- AML.T0082\nnist_csf:\n- PR.DS-11\n- RS.MA-01\n- RC.RP-01\n- PR.IR-01\nmodel: sonnet\nmaxTurns: 20\ntools: [Read, Bash, Glob, Grep]\nmitre_attack:\n- T1486\n- T1530\ncapec: []\n---\n\n# Implementing Immutable Backup with Restic\n\n## When to Use\n\n- Establishing ransomware-resistant backup infrastructure with cryptographic integrity verification\n- Implementing 3-2-1-1-0 backup strategy where the extra 1 is an immutable copy\n- Automating backup verification workflows that test restore capability on a schedule\n- Protecting backup repositories from deletion or modification by compromised admin accounts\n- Meeting compliance requirements for data retention with tamper-proof storage\n\n**Do not use** as the sole backup solution without also maintaining offline\u002Fair-gapped copies. Object lock protects against logical deletion but not physical storage failure.\n\n## Prerequisites\n\n- restic binary installed (https:\u002F\u002Frestic.readthedocs.io\u002F)\n- S3-compatible storage with Object Lock enabled (AWS S3, MinIO, Backblaze B2)\n- Python 3.8+ with subprocess module\n- AWS CLI or MinIO client (mc) configured for bucket access\n- Sufficient storage for backup repository (typically 2-3x source data with deduplication)\n\n## Workflow\n\n### Step 1: Initialize Restic Repository with Encryption\n\nCreate an encrypted restic repository on S3-compatible storage with object lock enabled. Restic uses AES-256-CTR for encryption with Poly1305-AES for authentication, ensuring backup data is both confidential and tamper-evident.\n\n### Step 2: Configure Object Lock Retention\n\nEnable S3 Object Lock in Compliance mode on the backup bucket to prevent any principal (including root) from deleting or modifying objects during the retention period. Set retention to match your backup window requirements (typically 30-90 days).\n\n### Step 3: Automate Backup and Verification\n\nSchedule backup operations with post-backup integrity verification using `restic check --read-data` which downloads and verifies every data blob against its stored checksum. Log results and alert on any integrity failures.\n\n### Step 4: Test Restore Procedures\n\nPeriodically restore random files from backup snapshots to a temporary location and compare checksums against the original to validate end-to-end backup integrity. Document restore times for RTO planning.\n\n## Key Concepts\n\n| Term | Definition |\n|------|------------|\n| **Object Lock** | S3 feature that prevents object deletion or overwrite for a specified retention period |\n| **Compliance Mode** | Object Lock mode where even the root account cannot delete objects before retention expires |\n| **Deduplication** | Restic stores data in content-addressable chunks, deduplicating across all snapshots |\n| **3-2-1-1-0** | 3 copies, 2 media types, 1 offsite, 1 immutable, 0 errors in verification |\n\n## Tools & Systems\n\n- **restic**: Fast, secure, cross-platform backup tool with built-in encryption and deduplication\n- **resticpy**: Python wrapper for restic CLI operations\n- **AWS S3 Object Lock**: WORM storage for tamper-proof backup retention\n- **MinIO**: Self-hosted S3-compatible storage with Object Lock support\n\n## Output Format\n\n```\nBACKUP VERIFICATION REPORT\n===========================\nRepository: s3:s3.amazonaws.com\u002Fcompany-backups-immutable\nSnapshots: 45\nTotal Size: 2.3 TiB (deduplicated from 8.7 TiB)\nLast Backup: 2026-03-11T02:00:00Z\nIntegrity Check: PASSED (all packs verified)\nObject Lock: Compliance mode, 90-day retention\nRestore Test: PASSED (15 files verified)\n```\n","# Implementing Immutable Backup with Restic\n\n## When to Use\n\n- Establishing ransomware-resistant backup infrastructure with cryptographic integrity verification\n- Implementing 3-2-1-1-0 backup strategy where the extra 1 is an immutable copy\n- Automating backup verification workflows that test restore capability on a schedule\n- Protecting backup repositories from deletion or modification by compromised admin accounts\n- Meeting compliance requirements for data retention with tamper-proof storage\n\n**Do not use** as the sole backup solution without also maintaining offline\u002Fair-gapped copies. Object lock protects against logical deletion but not physical storage failure.\n\n## Prerequisites\n\n- restic binary installed (https:\u002F\u002Frestic.readthedocs.io\u002F)\n- S3-compatible storage with Object Lock enabled (AWS S3, MinIO, Backblaze B2)\n- Python 3.8+ with subprocess module\n- AWS CLI or MinIO client (mc) configured for bucket access\n- Sufficient storage for backup repository (typically 2-3x source data with deduplication)\n\n## Workflow\n\n### Step 1: Initialize Restic Repository with Encryption\n\nCreate an encrypted restic repository on S3-compatible storage with object lock enabled. Restic uses AES-256-CTR for encryption with Poly1305-AES for authentication, ensuring backup data is both confidential and tamper-evident.\n\n### Step 2: Configure Object Lock Retention\n\nEnable S3 Object Lock in Compliance mode on the backup bucket to prevent any principal (including root) from deleting or modifying objects during the retention period. Set retention to match your backup window requirements (typically 30-90 days).\n\n### Step 3: Automate Backup and Verification\n\nSchedule backup operations with post-backup integrity verification using `restic check --read-data` which downloads and verifies every data blob against its stored checksum. Log results and alert on any integrity failures.\n\n### Step 4: Test Restore Procedures\n\nPeriodically restore random files from backup snapshots to a temporary location and compare checksums against the original to validate end-to-end backup integrity. Document restore times for RTO planning.\n\n## Key Concepts\n\n| Term | Definition |\n|------|------------|\n| **Object Lock** | S3 feature that prevents object deletion or overwrite for a specified retention period |\n| **Compliance Mode** | Object Lock mode where even the root account cannot delete objects before retention expires |\n| **Deduplication** | Restic stores data in content-addressable chunks, deduplicating across all snapshots |\n| **3-2-1-1-0** | 3 copies, 2 media types, 1 offsite, 1 immutable, 0 errors in verification |\n\n## Tools & Systems\n\n- **restic**: Fast, secure, cross-platform backup tool with built-in encryption and deduplication\n- **resticpy**: Python wrapper for restic CLI operations\n- **AWS S3 Object Lock**: WORM storage for tamper-proof backup retention\n- **MinIO**: Self-hosted S3-compatible storage with Object Lock support\n\n## Output Format\n\n```\nBACKUP VERIFICATION REPORT\n===========================\nRepository: s3:s3.amazonaws.com\u002Fcompany-backups-immutable\nSnapshots: 45\nTotal Size: 2.3 TiB (deduplicated from 8.7 TiB)\nLast Backup: 2026-03-11T02:00:00Z\nIntegrity Check: PASSED (all packs verified)\nObject Lock: Compliance mode, 90-day retention\nRestore Test: PASSED (15 files verified)\n```\n",{"name":5,"tags":49,"capec":56,"model":57,"tools":58,"domain":37,"maxTurns":62,"nist_csf":63,"subdomain":68,"description":7,"nist_ai_rmf":69,"mitre_attack":73,"atlas_techniques":76},[50,51,26,27,52,53,54,55],"restic","backup","s3","object-lock","worm","recovery",[],"sonnet",[59,35,60,61],"Read","Glob","Grep",20,[64,65,66,67],"PR.DS-11","RS.MA-01","RC.RP-01","PR.IR-01","ransomware-defense",[70,71,72],"MEASURE-2.7","MAP-5.1","MANAGE-2.4",[74,75],"T1486","T1530",[77,78,79],"AML.T0070","AML.T0066","AML.T0082","main","a91f1293287ffa9f4f1b8f486cd6e835a1568c84","skills\u002Fmalware\u002Fransomware\u002Fimmutable\u002Fexploit","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace","https:\u002F\u002Fgithub.com\u002FDCx7C5","#Python","2026-09-01 11:21:00",{"source":8,"skillName":5,"commands":88,"prompt":98,"zipAvailable":99},[89,92,95],{"tool":90,"command":91},"npx","npx skills add DCx7C5\u002Fai-marketplace --skill ransomware-immutable-exploit",{"tool":93,"command":94},"bunx","bunx skills add DCx7C5\u002Fai-marketplace --skill ransomware-immutable-exploit",{"tool":96,"command":97},"pnpm","pnpm dlx skills add DCx7C5\u002Fai-marketplace --skill ransomware-immutable-exploit","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fmalware\u002Fransomware\u002Fimmutable\u002Fexploit\u002FSKILL.md",true,[101],{"path":102,"resourceType":103,"resourceTypeDesc":104,"sizeBytes":105,"sourceHtmlUrl":106},"index.json","REFERENCE","参考文档",699,"https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fmalware\u002Fransomware\u002Fimmutable\u002Fexploit\u002Findex.json",[108,133,153,174,196,212],{"skillNo":109,"name":110,"nameZh":6,"description":111,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":112,"categories":113,"keywords":114,"publishedAt":44},"01M71HAPZ01KQ30RKTB0FFSQ05","services-wmi-persistence-detect","Detect WMI event subscription persistence by enumerating ActiveScriptEventConsumer, CommandLineEventConsumer, and permanent subscriptions in the WMI repository.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fservices\u002Fwmi\u002Fpersistence\u002Fdetect\u002FSKILL.md",[],[115,116,117,118,119,120,121,122,123,124,125,126,127,128,129,130,131,37,132],"services","detect","services wmi persistence detect","wmi","persistence","de","cm","process","activescript","event","subscriptions","commandline-consumer","repository","subscription","event-subscription","t1546.003","forensics","process-forensics",{"skillNo":134,"name":135,"nameZh":6,"description":136,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":137,"categories":138,"keywords":139,"publishedAt":44},"01M71HAK6JTTTS229T17WJMMCG","services-wmi-exec-exploit","Perform lateral movement across Windows networks using WMI-based remote execution techniques including Impacket wmiexec.py, CrackMapExec, and native WMI commands for stealthy post-exploitation during red team engagements.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fservices\u002Fwmi\u002Fexec\u002Fexploit\u002FSKILL.md",[],[24,115,140,118,141,142,143,37,35,144,145,146,147,148,120,149,150,30,151,152],"services wmi exec exploit","exec","remote","traffic","analysis","team","across","crackmapexec","native","command","lateral movement","lateral-movement","Impacket",{"skillNo":154,"name":155,"nameZh":6,"description":156,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":157,"categories":158,"keywords":159,"publishedAt":44},"01M71HAG6MHKNQV8KDZKMT4886","registry-artifact-extract","Extract and analyze Windows Registry hives to uncover user activity, installed software, autostart entries, and evidence of system compromise.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fregistry\u002Fartifact\u002Fextract\u002FSKILL.md",[],[160,161,162,163,164,165,37,35,166,144,167,168,120,30,169,170,171,172,173,57],"artifact","registry","registry artifact extract","extract","evidence-collection","artifact-analysis","collection","analyze","uncover","software","activity","digital-forensics","windows-registry","regripper",{"skillNo":175,"name":176,"nameZh":6,"description":177,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":178,"categories":179,"keywords":180,"publishedAt":44},"01M71HACR4A8XTWTTSXK4124AA","processes-token-impersonate-detect","Detect Windows token impersonation and privilege abuse including SeImpersonatePrivilege exploitation via Potato attacks and token stealing techniques.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fprocesses\u002Ftoken\u002Fimpersonate\u002Fdetect\u002FSKILL.md",[],[116,181,182,183,184,185,186,121,187,37,132,188,189,190,191,192,193,194,195,120],"processes token impersonate detect","token","processes","attacks","windows","escalation","techniques","privilege-escalation","seimpersonate","token-impersonation","printspoofer","exploitation","potato","impersonation","via",{"skillNo":197,"name":198,"nameZh":6,"description":199,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":200,"categories":201,"keywords":202,"publishedAt":44},"01M71HAABSB4Z6QFSXEG00R4RK","processes-thread-injection-detect","Detect Windows thread injection techniques including CreateRemoteThread, QueueUserAPC, NtCreateThreadEx, and thread hijacking via process memory analysis.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fprocesses\u002Fthread\u002Finjection\u002Fdetect\u002FSKILL.md",[],[203,204,116,205,183,185,206,121,207,187,37,132,144,208,209,210,211,195,120,122],"thread","processes thread injection detect","injection","memory","process-injection","api","apc-injection","thread-injection","nt-api",{"skillNo":213,"name":214,"nameZh":6,"description":215,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":216,"categories":217,"keywords":218,"publishedAt":44},"01M71HA7H311V5G14WMX58HQSS","processes-hollow-technique-detect","Detect process hollowing (RunPE) by identifying processes with mismatched image paths between PEB and VAD tree, or unmapped PE headers in memory.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fprocesses\u002Fhollow\u002Ftechnique\u002Fdetect\u002FSKILL.md",[],[219,116,183,220,206,121,221,222,37,132,223,224,225,226,227,228,120,122,229,230],"processes hollow technique detect","tree","memory-forensics","process-hollow","peb","runpe","image","pe-header","in memory","with","mismatched","headers"]