[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M71F7RCXMVM9BNWYMAKW41BD":3,"skill-same:01M71F7RCXMVM9BNWYMAKW41BD":92},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":23,"publishedAt":44,"linkOnly":45,"markdownContent":46,"markdownBody":47,"frontMatter":48,"refName":65,"commitSha":66,"skillDirectory":67,"forksCount":14,"repositoryHtmlUrl":68,"repositoryHomepageUrl":6,"ownerHtmlUrl":69,"ownerBlogUrl":6,"ownerDescription":70,"updatedAt":71,"install":72,"resources":85},"01M71F7RCXMVM9BNWYMAKW41BD","ransomware-procedures-exploit",null,"Test and validate ransomware recovery procedures including backup restore operations, RTO\u002FRPO target verification, recovery sequencing, and clean restore validation to ensure organizational resilience against destructive ransomware attacks.","DCx7C5\u002Fai-marketplace","DCx7C5","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F42419559?v=4","01M71C01G2AZV3NTNGWAWSHJPP","DC","01M71C01GQW6G50S2BYMS7PP3E",0,"MIT","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fmalware\u002Fransomware\u002Fprocedures\u002Fexploit\u002FSKILL.md",[18],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000008","测试与质量","SCENARIO","使用场景",[24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43],"exploit","ransomware procedures exploit","ransomware","restore","backup restore","target","attacks","sonnet","read","rpo","rto","disaster-recovery","verification","resilience","Bash","sequencing","cybersecurity","clean","incident","test and validate","2026-11-10 10:12:30",false,"---\nname: ransomware-procedures-exploit\ndescription: Test and validate ransomware recovery procedures including backup restore operations, RTO\u002FRPO target verification, recovery sequencing, and clean restore validation to ensure organizational resilience against destructive ransomware attacks.\ndomain: cybersecurity\nsubdomain: incident-response\ntags:\n- incident-response\n- ransomware\n- disaster-recovery\n- backup\n- rto\n- rpo\n- resilience\nnist_csf:\n- RS.MA-01\n- RS.MA-02\n- RS.AN-03\n- RC.RP-01\nmodel: sonnet\nmaxTurns: 20\ntools: [Read, Bash, Glob, Grep]\nmitre_attack:\n- T1486\ncapec: []\n---\n\n# Testing Ransomware Recovery Procedures\n\n## When to Use\n\nUse this skill when:\n- Validating that ransomware recovery plans actually work under realistic conditions\n- Measuring RTO (Recovery Time Objective) and RPO (Recovery Point Objective) against business requirements\n- Testing backup restore operations to confirm data integrity and completeness after simulated encryption\n- Conducting tabletop exercises or live recovery drills for ransomware scenarios\n- Auditing disaster recovery readiness as part of compliance or cyber insurance requirements\n\n**Do not use** for active incident response during a live ransomware attack. Use dedicated IR playbooks instead.\n\n## Prerequisites\n\n- Isolated recovery test environment (air-gapped or network-segmented lab)\n- Access to backup infrastructure (Veeam, Commvault, Rubrik, AWS Backup, Azure Backup)\n- Documented RTO\u002FRPO targets per application tier from business impact analysis\n- Backup copies available for restore testing (production replicas or test snapshots)\n- Recovery runbooks with step-by-step procedures for each critical system\n\n## Workflow\n\n### Step 1: Define Recovery Test Scope\n\nIdentify critical systems and their tiered recovery targets:\n\n| Tier | System Type | RTO Target | RPO Target | Example |\n|------|------------|------------|------------|---------|\n| Tier 1 | Mission-critical | \u003C 1 hour | \u003C 15 min | Active Directory, core database |\n| Tier 2 | Business-critical | \u003C 4 hours | \u003C 1 hour | ERP, email, CRM |\n| Tier 3 | Business-operational | \u003C 24 hours | \u003C 4 hours | File shares, internal apps |\n| Tier 4 | Non-critical | \u003C 72 hours | \u003C 24 hours | Dev\u002Ftest, analytics |\n\n### Step 2: Prepare Test Environment\n\n```bash\n# Verify isolated recovery network is segmented\n# No routes to production should exist\nip route show | grep -v \"192.168.100.0\u002F24\"  # recovery VLAN only\n\n# Verify backup catalog is accessible\nrestic snapshots --repo s3:s3.amazonaws.com\u002Fbackup-bucket --password-file \u002Fetc\u002Frestic\u002Fpw\n# Or for Veeam:\n# Get-VBRBackup | Where-Object {$_.JobType -eq \"Backup\"} | Select Name, LastPointCreationTime\n```\n\n### Step 3: Execute Restore and Measure RTO\n\nFor each tiered system, measure the full recovery timeline:\n\n1. **Detection to Decision** - Time from simulated alert to restore decision\n2. **Backup Locate** - Time to identify and select the correct clean restore point\n3. **Restore Execution** - Time to restore data\u002FVM\u002Fapplication from backup\n4. **Validation** - Time to verify data integrity and application functionality\n5. **Service Restoration** - Time until the system is fully operational\n\n```\nRecovery Timeline Measurement:\n  T0: Incident declared (simulated ransomware detection)\n  T1: Recovery team assembled and backup identified\n  T2: Restore initiated from clean backup\n  T3: Restore completed, integrity checks passed\n  T4: Application validated and service restored\n\n  Actual RTO = T4 - T0\n  Actual RPO = T0 - backup_timestamp\n```\n\n### Step 4: Validate Data Integrity Post-Restore\n\n```bash\n# Compare file counts between backup manifest and restored data\nfind \u002Frestored\u002Fdata -type f | wc -l\n# Compare against pre-backup manifest\n\n# Verify database consistency after restore\npg_isready -h localhost -p 5432\npsql -c \"SELECT count(*) FROM critical_table;\" -d restored_db\n\n# Hash verification of critical files\nsha256sum \u002Frestored\u002Fdata\u002Fcritical_config.xml\n# Compare against known-good hash from backup manifest\n```\n\n### Step 5: Test Credential Rotation and Security Hardening\n\nAfter restore, validate that security controls are re-established:\n\n1. Rotate all service account passwords and API keys\n2. Verify MFA is enabled on all administrative accounts\n3. Confirm EDR\u002FAV agents are running and reporting to management console\n4. Validate firewall rules block known C2 indicators\n5. Check that restored systems have latest security patches\n\n### Step 6: Document Results and Calculate Gap\n\n```\nRecovery Test Report:\n  System: [Name]\n  Tier: [1-4]\n  RTO Target: [target]    Actual RTO: [measured]    Gap: [delta]\n  RPO Target: [target]    Actual RPO: [measured]    Gap: [delta]\n  Data Integrity: [PASS\u002FFAIL]\n  Application Validation: [PASS\u002FFAIL]\n  Security Controls Restored: [PASS\u002FFAIL]\n\n  Status: [MEETS TARGET \u002F EXCEEDS TARGET \u002F FAILS TARGET]\n  Remediation Required: [description if FAILS]\n```\n\n## Key Concepts\n\n| Term | Definition |\n|------|-----------|\n| **RTO** | Recovery Time Objective: maximum acceptable downtime for a system after a disaster |\n| **RPO** | Recovery Point Objective: maximum acceptable data loss measured in time |\n| **WRT** | Work Recovery Time: time to verify system integrity after restore completes |\n| **MTD** | Maximum Tolerable Downtime: absolute limit before unacceptable business impact |\n| **Clean Restore Point** | A backup verified to be free of ransomware artifacts or encryption |\n| **Recovery Sequencing** | The order in which interdependent systems must be restored |\n| **Air-Gapped Backup** | Backup stored on media physically disconnected from the network |\n\n## Tools & Systems\n\n| Tool | Purpose |\n|------|---------|\n| Veeam Backup & Replication | VM and physical server backup and restore |\n| Commvault | Enterprise data protection and recovery orchestration |\n| Rubrik | Cloud-native backup with ransomware recovery SLA |\n| AWS Backup | Centralized backup for AWS services |\n| Azure Backup | Microsoft cloud backup with immutable vault |\n| Restic | Open-source encrypted backup tool |\n| Velero | Kubernetes cluster backup and restore |\n\n## Common Pitfalls\n\n- **Not testing restores regularly**: Backups that are never tested often fail when needed. Test quarterly at minimum.\n- **Ignoring recovery sequencing**: Restoring an application before its database dependency causes cascading failures.\n- **Skipping credential rotation**: Restored systems may contain compromised credentials that allow re-infection.\n- **Using production network for testing**: Recovery tests on production networks risk spreading simulated or real infections.\n- **Measuring RTO without WRT**: Restore completion is not recovery completion. Include validation and hardening time.\n- **No immutable backups**: If ransomware can encrypt or delete backups, recovery is impossible. Use air-gapped or immutable storage.\n\n## References\n\n- NIST SP 800-184: Guide for Cybersecurity Event Recovery\n- CISA Ransomware Guide: https:\u002F\u002Fwww.cisa.gov\u002Fstopransomware\n- Veeam RTO\u002FRPO Best Practices: https:\u002F\u002Fwww.veeam.com\u002Fblog\u002Frecovery-time-recovery-point-objectives.html\n- NIST CSF 2.0 RC.RP (Recovery Planning)\n","# Testing Ransomware Recovery Procedures\n\n## When to Use\n\nUse this skill when:\n- Validating that ransomware recovery plans actually work under realistic conditions\n- Measuring RTO (Recovery Time Objective) and RPO (Recovery Point Objective) against business requirements\n- Testing backup restore operations to confirm data integrity and completeness after simulated encryption\n- Conducting tabletop exercises or live recovery drills for ransomware scenarios\n- Auditing disaster recovery readiness as part of compliance or cyber insurance requirements\n\n**Do not use** for active incident response during a live ransomware attack. Use dedicated IR playbooks instead.\n\n## Prerequisites\n\n- Isolated recovery test environment (air-gapped or network-segmented lab)\n- Access to backup infrastructure (Veeam, Commvault, Rubrik, AWS Backup, Azure Backup)\n- Documented RTO\u002FRPO targets per application tier from business impact analysis\n- Backup copies available for restore testing (production replicas or test snapshots)\n- Recovery runbooks with step-by-step procedures for each critical system\n\n## Workflow\n\n### Step 1: Define Recovery Test Scope\n\nIdentify critical systems and their tiered recovery targets:\n\n| Tier | System Type | RTO Target | RPO Target | Example |\n|------|------------|------------|------------|---------|\n| Tier 1 | Mission-critical | \u003C 1 hour | \u003C 15 min | Active Directory, core database |\n| Tier 2 | Business-critical | \u003C 4 hours | \u003C 1 hour | ERP, email, CRM |\n| Tier 3 | Business-operational | \u003C 24 hours | \u003C 4 hours | File shares, internal apps |\n| Tier 4 | Non-critical | \u003C 72 hours | \u003C 24 hours | Dev\u002Ftest, analytics |\n\n### Step 2: Prepare Test Environment\n\n```bash\n# Verify isolated recovery network is segmented\n# No routes to production should exist\nip route show | grep -v \"192.168.100.0\u002F24\"  # recovery VLAN only\n\n# Verify backup catalog is accessible\nrestic snapshots --repo s3:s3.amazonaws.com\u002Fbackup-bucket --password-file \u002Fetc\u002Frestic\u002Fpw\n# Or for Veeam:\n# Get-VBRBackup | Where-Object {$_.JobType -eq \"Backup\"} | Select Name, LastPointCreationTime\n```\n\n### Step 3: Execute Restore and Measure RTO\n\nFor each tiered system, measure the full recovery timeline:\n\n1. **Detection to Decision** - Time from simulated alert to restore decision\n2. **Backup Locate** - Time to identify and select the correct clean restore point\n3. **Restore Execution** - Time to restore data\u002FVM\u002Fapplication from backup\n4. **Validation** - Time to verify data integrity and application functionality\n5. **Service Restoration** - Time until the system is fully operational\n\n```\nRecovery Timeline Measurement:\n  T0: Incident declared (simulated ransomware detection)\n  T1: Recovery team assembled and backup identified\n  T2: Restore initiated from clean backup\n  T3: Restore completed, integrity checks passed\n  T4: Application validated and service restored\n\n  Actual RTO = T4 - T0\n  Actual RPO = T0 - backup_timestamp\n```\n\n### Step 4: Validate Data Integrity Post-Restore\n\n```bash\n# Compare file counts between backup manifest and restored data\nfind \u002Frestored\u002Fdata -type f | wc -l\n# Compare against pre-backup manifest\n\n# Verify database consistency after restore\npg_isready -h localhost -p 5432\npsql -c \"SELECT count(*) FROM critical_table;\" -d restored_db\n\n# Hash verification of critical files\nsha256sum \u002Frestored\u002Fdata\u002Fcritical_config.xml\n# Compare against known-good hash from backup manifest\n```\n\n### Step 5: Test Credential Rotation and Security Hardening\n\nAfter restore, validate that security controls are re-established:\n\n1. Rotate all service account passwords and API keys\n2. Verify MFA is enabled on all administrative accounts\n3. Confirm EDR\u002FAV agents are running and reporting to management console\n4. Validate firewall rules block known C2 indicators\n5. Check that restored systems have latest security patches\n\n### Step 6: Document Results and Calculate Gap\n\n```\nRecovery Test Report:\n  System: [Name]\n  Tier: [1-4]\n  RTO Target: [target]    Actual RTO: [measured]    Gap: [delta]\n  RPO Target: [target]    Actual RPO: [measured]    Gap: [delta]\n  Data Integrity: [PASS\u002FFAIL]\n  Application Validation: [PASS\u002FFAIL]\n  Security Controls Restored: [PASS\u002FFAIL]\n\n  Status: [MEETS TARGET \u002F EXCEEDS TARGET \u002F FAILS TARGET]\n  Remediation Required: [description if FAILS]\n```\n\n## Key Concepts\n\n| Term | Definition |\n|------|-----------|\n| **RTO** | Recovery Time Objective: maximum acceptable downtime for a system after a disaster |\n| **RPO** | Recovery Point Objective: maximum acceptable data loss measured in time |\n| **WRT** | Work Recovery Time: time to verify system integrity after restore completes |\n| **MTD** | Maximum Tolerable Downtime: absolute limit before unacceptable business impact |\n| **Clean Restore Point** | A backup verified to be free of ransomware artifacts or encryption |\n| **Recovery Sequencing** | The order in which interdependent systems must be restored |\n| **Air-Gapped Backup** | Backup stored on media physically disconnected from the network |\n\n## Tools & Systems\n\n| Tool | Purpose |\n|------|---------|\n| Veeam Backup & Replication | VM and physical server backup and restore |\n| Commvault | Enterprise data protection and recovery orchestration |\n| Rubrik | Cloud-native backup with ransomware recovery SLA |\n| AWS Backup | Centralized backup for AWS services |\n| Azure Backup | Microsoft cloud backup with immutable vault |\n| Restic | Open-source encrypted backup tool |\n| Velero | Kubernetes cluster backup and restore |\n\n## Common Pitfalls\n\n- **Not testing restores regularly**: Backups that are never tested often fail when needed. Test quarterly at minimum.\n- **Ignoring recovery sequencing**: Restoring an application before its database dependency causes cascading failures.\n- **Skipping credential rotation**: Restored systems may contain compromised credentials that allow re-infection.\n- **Using production network for testing**: Recovery tests on production networks risk spreading simulated or real infections.\n- **Measuring RTO without WRT**: Restore completion is not recovery completion. Include validation and hardening time.\n- **No immutable backups**: If ransomware can encrypt or delete backups, recovery is impossible. Use air-gapped or immutable storage.\n\n## References\n\n- NIST SP 800-184: Guide for Cybersecurity Event Recovery\n- CISA Ransomware Guide: https:\u002F\u002Fwww.cisa.gov\u002Fstopransomware\n- Veeam RTO\u002FRPO Best Practices: https:\u002F\u002Fwww.veeam.com\u002Fblog\u002Frecovery-time-recovery-point-objectives.html\n- NIST CSF 2.0 RC.RP (Recovery Planning)\n",{"name":5,"tags":49,"capec":52,"model":31,"tools":53,"domain":40,"maxTurns":57,"nist_csf":58,"subdomain":50,"description":7,"mitre_attack":63},[50,26,35,51,34,33,37],"incident-response","backup",[],[54,38,55,56],"Read","Glob","Grep",20,[59,60,61,62],"RS.MA-01","RS.MA-02","RS.AN-03","RC.RP-01",[64],"T1486","main","a91f1293287ffa9f4f1b8f486cd6e835a1568c84","skills\u002Fmalware\u002Fransomware\u002Fprocedures\u002Fexploit","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace","https:\u002F\u002Fgithub.com\u002FDCx7C5","#Python","2026-09-01 11:21:00",{"source":8,"skillName":5,"commands":73,"prompt":83,"zipAvailable":84},[74,77,80],{"tool":75,"command":76},"npx","npx skills add DCx7C5\u002Fai-marketplace --skill ransomware-procedures-exploit",{"tool":78,"command":79},"bunx","bunx skills add DCx7C5\u002Fai-marketplace --skill ransomware-procedures-exploit",{"tool":81,"command":82},"pnpm","pnpm dlx skills add DCx7C5\u002Fai-marketplace --skill ransomware-procedures-exploit","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fmalware\u002Fransomware\u002Fprocedures\u002Fexploit\u002FSKILL.md",true,[86],{"path":87,"resourceType":88,"resourceTypeDesc":89,"sizeBytes":90,"sourceHtmlUrl":91},"index.json","REFERENCE","参考文档",702,"https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fmalware\u002Fransomware\u002Fprocedures\u002Fexploit\u002Findex.json",[93,118,138,159,180,196],{"skillNo":94,"name":95,"nameZh":6,"description":96,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":97,"categories":98,"keywords":99,"publishedAt":44},"01M71HAPZ01KQ30RKTB0FFSQ05","services-wmi-persistence-detect","Detect WMI event subscription persistence by enumerating ActiveScriptEventConsumer, CommandLineEventConsumer, and permanent subscriptions in the WMI repository.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fservices\u002Fwmi\u002Fpersistence\u002Fdetect\u002FSKILL.md",[],[100,101,102,103,104,105,106,107,108,109,110,111,112,113,114,115,116,40,117],"services","detect","services wmi persistence detect","wmi","persistence","de","cm","process","activescript","event","subscriptions","commandline-consumer","repository","subscription","event-subscription","t1546.003","forensics","process-forensics",{"skillNo":119,"name":120,"nameZh":6,"description":121,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":122,"categories":123,"keywords":124,"publishedAt":44},"01M71HAK6JTTTS229T17WJMMCG","services-wmi-exec-exploit","Perform lateral movement across Windows networks using WMI-based remote execution techniques including Impacket wmiexec.py, CrackMapExec, and native WMI commands for stealthy post-exploitation during red team engagements.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fservices\u002Fwmi\u002Fexec\u002Fexploit\u002FSKILL.md",[],[24,100,125,103,126,127,128,40,38,129,130,131,132,133,105,134,135,32,136,137],"services wmi exec exploit","exec","remote","traffic","analysis","team","across","crackmapexec","native","command","lateral movement","lateral-movement","Impacket",{"skillNo":139,"name":140,"nameZh":6,"description":141,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":142,"categories":143,"keywords":144,"publishedAt":44},"01M71HAG6MHKNQV8KDZKMT4886","registry-artifact-extract","Extract and analyze Windows Registry hives to uncover user activity, installed software, autostart entries, and evidence of system compromise.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fregistry\u002Fartifact\u002Fextract\u002FSKILL.md",[],[145,146,147,148,149,150,40,38,151,129,152,153,105,32,154,155,156,157,158,31],"artifact","registry","registry artifact extract","extract","evidence-collection","artifact-analysis","collection","analyze","uncover","software","activity","digital-forensics","windows-registry","regripper",{"skillNo":160,"name":161,"nameZh":6,"description":162,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":163,"categories":164,"keywords":165,"publishedAt":44},"01M71HACR4A8XTWTTSXK4124AA","processes-token-impersonate-detect","Detect Windows token impersonation and privilege abuse including SeImpersonatePrivilege exploitation via Potato attacks and token stealing techniques.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fprocesses\u002Ftoken\u002Fimpersonate\u002Fdetect\u002FSKILL.md",[],[101,166,167,168,30,169,170,106,171,40,117,172,173,174,175,176,177,178,179,105],"processes token impersonate detect","token","processes","windows","escalation","techniques","privilege-escalation","seimpersonate","token-impersonation","printspoofer","exploitation","potato","impersonation","via",{"skillNo":181,"name":182,"nameZh":6,"description":183,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":184,"categories":185,"keywords":186,"publishedAt":44},"01M71HAABSB4Z6QFSXEG00R4RK","processes-thread-injection-detect","Detect Windows thread injection techniques including CreateRemoteThread, QueueUserAPC, NtCreateThreadEx, and thread hijacking via process memory analysis.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fprocesses\u002Fthread\u002Finjection\u002Fdetect\u002FSKILL.md",[],[187,188,101,189,168,169,190,106,191,171,40,117,129,192,193,194,195,179,105,107],"thread","processes thread injection detect","injection","memory","process-injection","api","apc-injection","thread-injection","nt-api",{"skillNo":197,"name":198,"nameZh":6,"description":199,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":200,"categories":201,"keywords":202,"publishedAt":44},"01M71HA7H311V5G14WMX58HQSS","processes-hollow-technique-detect","Detect process hollowing (RunPE) by identifying processes with mismatched image paths between PEB and VAD tree, or unmapped PE headers in memory.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fprocesses\u002Fhollow\u002Ftechnique\u002Fdetect\u002FSKILL.md",[],[203,101,168,204,190,106,205,206,40,117,207,208,209,210,211,212,105,107,213,214],"processes hollow technique detect","tree","memory-forensics","process-hollow","peb","runpe","image","pe-header","in memory","with","mismatched","headers"]