[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M71F81ASVEVP8YX9SXNPEP2H":3,"skill-same:01M71F81ASVEVP8YX9SXNPEP2H":96},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":18,"publishedAt":39,"linkOnly":40,"markdownContent":41,"markdownBody":42,"frontMatter":43,"refName":69,"commitSha":70,"skillDirectory":71,"forksCount":14,"repositoryHtmlUrl":72,"repositoryHomepageUrl":6,"ownerHtmlUrl":73,"ownerBlogUrl":6,"ownerDescription":74,"updatedAt":75,"install":76,"resources":89},"01M71F81ASVEVP8YX9SXNPEP2H","ransomware-response-respond",null,"Executes a structured ransomware incident response from initial detection through containment, forensic analysis, decryption assessment, recovery, and post-incident hardening. Addresses ransom negotiation considerations, backup integrity verification, and regulatory notification requirements. Activates for requests involving ransomware response, ransomware recovery, crypto-ransomware, data encryption attack, ransom payment decision, or ransomware containment.","DCx7C5\u002Fai-marketplace","DCx7C5","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F42419559?v=4","01M71C01G2AZV3NTNGWAWSHJPP","DC","01M71C01GQW6G50S2BYMS7PP3E",0,"MIT","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fmalware\u002Fransomware\u002Fresponse\u002Frespond\u002FSKILL.md",[],[19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38],"ransomware","ransomware response","ransomware response respond","respond","data","forensic","read","CISA","forensic analysis","verification","analysis","encryption","Bash","incident response","cybersecurity","data encryption","assessment","decision","incident","t1490","2026-11-10 10:12:30",false,"---\nname: ransomware-response-respond\ndescription: Executes a structured ransomware incident response from initial detection through containment, forensic analysis, decryption assessment, recovery, and post-incident hardening. Addresses ransom negotiation considerations, backup integrity verification, and regulatory notification requirements. Activates for requests involving ransomware response, ransomware recovery, crypto-ransomware, data encryption attack, ransom payment decision, or ransomware containment.\ndomain: cybersecurity\nsubdomain: incident-response\ntags:\n- ransomware\n- encryption-recovery\n- backup-restoration\n- ransom-negotiation\n- CISA-guidance\nnist_csf:\n- RS.MA-01\n- RS.MA-02\n- RS.AN-03\n- RC.RP-01\nmodel: sonnet\nmaxTurns: 20\ntools: [Read, Bash, Glob, Grep]\nmitre_attack:\n- T1486\n- T1490\n- T1489\n- T1021\n- T1570\n- T1059\ncapec: []\n---\n\n# Performing Ransomware Response\n\n## When to Use\n\n- Ransomware has been detected executing or file encryption is actively occurring\n- Users report inability to open files with unfamiliar extensions appended\n- A ransom note is discovered on one or more systems\n- EDR detects mass file modification patterns consistent with encryption behavior\n- Threat intelligence warns of an imminent ransomware campaign targeting the organization\n\n**Do not use** for general malware incidents that do not involve file encryption or extortion; use malware incident response procedures instead.\n\n## Prerequisites\n\n- Ransomware-specific incident response playbook reviewed and approved by executive leadership\n- Tested and verified offline backup strategy with air-gapped or immutable copies\n- Incident retainer with a specialized ransomware response firm (e.g., Mandiant, CrowdStrike Services, Kroll)\n- Legal counsel pre-engaged for OFAC sanctions screening and regulatory notification\n- Cyber insurance carrier contact information and policy coverage details\n- Bitcoin\u002Fcryptocurrency analysis capability or third-party engagement for payment tracing\n\n## Workflow\n\n### Step 1: Detect and Confirm Ransomware\n\nValidate that the incident is ransomware and determine the variant:\n\n- Identify the ransomware by analyzing the ransom note filename, extension appended to encrypted files, and note content\n- Upload the ransom note and a sample encrypted file to ID Ransomware (id-ransomware.malwarehunterteam.com)\n- Check NoMoreRansom.org for available free decryptors\n- Determine the ransomware deployment method from EDR\u002FSIEM logs\n- Identify the ransomware group (e.g., LockBit, BlackCat\u002FALPHV, Royal, Akira, Play)\n\n```\nRansomware Identification:\n━━━━━━━━━━━━━━━━━━━━━━━━━\nVariant:          LockBit 3.0 (Black)\nExtension:        .lockbit3\nRansom Note:      README-LOCKBIT.txt\nTor Site:         lockbit[redacted].onion\nDeployment:       Group Policy Object pushing ransomware.exe to all domain-joined systems\nInitial Access:   VPN credential compromise (no MFA)\nDwell Time:       12 days\nData Exfiltration: Yes - 47GB uploaded to MEGA via rclone prior to encryption\n```\n\n### Step 2: Immediate Containment\n\nStop ransomware propagation before assessing damage:\n\n- **Priority 1**: Disconnect affected network segments from core infrastructure (pull the network cable, not shutdown)\n- **Priority 2**: Isolate all domain controllers immediately if GPO-based deployment is suspected\n- **Priority 3**: Disable the compromised accounts used for deployment\n- **Priority 4**: Block lateral movement protocols (SMB TCP\u002F445, RDP TCP\u002F3389, WinRM TCP\u002F5985-5986)\n- **Priority 5**: Preserve at least one encrypted system live (do not power off) for memory forensics\n- **Do NOT**: Shut down encrypted systems; keep them powered on to preserve encryption keys in memory\n\n### Step 3: Assess Damage and Scope\n\nQuantify the impact to inform recovery and business decisions:\n\n- Count the number of encrypted systems (workstations, servers, domain controllers)\n- Determine which business-critical systems and data are affected\n- Verify backup integrity: check that backups were not encrypted, deleted, or corrupted\n- Assess whether data exfiltration occurred (check for rclone, WinSCP, MEGA, cloud storage activity)\n- Determine the ransom demand amount and payment deadline\n- Check OFAC sanctions lists to verify the ransomware group is not a sanctioned entity (paying is legally risky)\n\n```\nImpact Assessment:\nEncrypted Systems:      187 of 340 endpoints (55%)\nEncrypted Servers:      12 of 28 (43%) - includes 2 file servers, 1 database server\nDomain Controllers:     2 of 3 encrypted\nBackup Status:          Veeam repository intact (offline copy verified clean)\nData Exfiltration:      Confirmed - 47GB to MEGA (file listing under analysis)\nRansom Demand:          $2.5M in Bitcoin (72-hour deadline)\nOFAC Screening:         LockBit - not currently sanctioned entity (verify with counsel)\n```\n\n### Step 4: Recovery Decision Matrix\n\nEvaluate recovery options in consultation with legal, executive leadership, and cyber insurance:\n\n| Option | Pros | Cons | Recommended When |\n|--------|------|------|-----------------|\n| Restore from backup | No payment, no legal risk | Recovery time may be days | Clean backups available |\n| Free decryptor | No payment, fast | Rare availability | Variant has published decryptor |\n| Negotiate and pay | Potentially faster | No guarantee, legal risk, funds threat actors | No backups, business survival at stake |\n| Rebuild from scratch | Clean environment | Longest timeline, data loss | Backups compromised, willing to accept data loss |\n\n### Step 5: Execute Recovery\n\nImplement the chosen recovery strategy:\n\n**If restoring from backup:**\n1. Build a clean isolated network segment for recovery operations\n2. Rebuild domain controllers first from clean media (do NOT restore DC backups older than the dwell time)\n3. Reset ALL user and service account passwords before joining any system to the new domain\n4. Restore servers in priority order: authentication, DNS, DHCP, then business-critical applications\n5. Restore workstations via reimaging, not file-level restore\n6. Restore data from verified clean backups to rebuilt file servers\n7. Reconnect to production network only after validation\n\n**If using a decryptor:**\n1. Test the decryptor on a non-critical system first\n2. Decrypt in order of business priority\n3. Scan all decrypted systems for residual malware before reconnection\n\n### Step 6: Post-Ransomware Hardening\n\nImplement controls to prevent recurrence:\n\n- Enforce MFA on all remote access (VPN, RDP, cloud portals)\n- Implement 3-2-1-1-0 backup strategy (3 copies, 2 media types, 1 offsite, 1 immutable, 0 errors)\n- Deploy application whitelisting on servers\n- Implement network segmentation between workstation and server VLANs\n- Enable Protected Users security group for privileged accounts\n- Disable NTLM authentication where possible\n- Deploy LAPS (Local Administrator Password Solution) for local admin accounts\n\n## Key Concepts\n\n| Term | Definition |\n|------|------------|\n| **Double Extortion** | Ransomware tactic combining file encryption with data exfiltration and threat to publish stolen data |\n| **Immutable Backup** | Backup storage that cannot be modified or deleted for a defined retention period, protecting against ransomware targeting backups |\n| **OFAC Sanctions** | U.S. Office of Foreign Assets Control restrictions that may prohibit ransom payments to sanctioned entities or jurisdictions |\n| **Dwell Time** | Days the attacker was present before deploying ransomware; critical for determining which backups are clean |\n| **Ransomware-as-a-Service (RaaS)** | Criminal business model where ransomware developers lease their malware to affiliates who conduct attacks |\n| **Rclone** | Legitimate cloud sync tool commonly abused by ransomware operators for data exfiltration before encryption |\n| **3-2-1-1-0 Backup Rule** | Backup strategy requiring 3 copies, 2 media types, 1 offsite, 1 immutable\u002Fair-gapped, and 0 errors in recovery testing |\n\n## Tools & Systems\n\n- **ID Ransomware**: Online service to identify ransomware variant from ransom note or encrypted file sample\n- **NoMoreRansom.org**: Europol-backed project providing free decryption tools for certain ransomware families\n- **Veeam \u002F Commvault**: Enterprise backup platforms with immutable repository and instant VM recovery capabilities\n- **KAPE**: Rapid forensic triage collection from encrypted systems to determine initial access and dwell time\n- **Cado Response**: Cloud-native forensics platform for investigating ransomware that affects cloud infrastructure\n\n## Common Scenarios\n\n### Scenario: LockBit 3.0 via Compromised VPN\n\n**Context**: Attackers compromised VPN credentials (no MFA), spent 12 days performing reconnaissance, disabled antivirus via GPO, exfiltrated 47GB of data, and deployed LockBit 3.0 across the domain via GPO at 2:00 AM on a Sunday.\n\n**Approach**:\n1. Disconnect all network segments at the core switch level\n2. Verify offline backup integrity (Veeam repository on immutable storage)\n3. Preserve two encrypted servers powered on for memory forensics\n4. Engage incident response retainer and cyber insurance carrier\n5. Begin recovery in isolated network: rebuild DCs, reset all passwords, restore in priority order\n6. Conduct forensic investigation in parallel to determine initial access and full adversary activity\n\n**Pitfalls**:\n- Restoring from backups that were created during the 12-day dwell time (may contain backdoors)\n- Paying the ransom without OFAC screening and legal counsel review\n- Reconnecting recovered systems to the production network before full password reset\n- Not checking for data exfiltration, leaving the organization exposed to the extortion threat\n\n## Output Format\n\n```\nRANSOMWARE INCIDENT REPORT\n===========================\nIncident:           INC-2025-1892\nRansomware Family:  LockBit 3.0 (Black)\nDate Detected:      2025-11-17T06:45:00Z\nInitial Access:     VPN credential compromise (no MFA)\nDwell Time:         12 days\n\nIMPACT SUMMARY\nEncrypted Systems:  187 endpoints, 12 servers\nBusiness Impact:    Full operations disruption\nData Exfiltrated:   47GB (finance, HR, legal documents)\nRansom Demand:      $2.5M BTC (72-hour deadline)\nBackup Status:      Veeam immutable repository - CLEAN\n\nRECOVERY APPROACH\nDecision:           Restore from backup (no ransom payment)\nRecovery Start:     2025-11-17T10:00:00Z\nDC Rebuild:         Complete - 2025-11-17T18:00:00Z\nCritical Systems:   Restored - 2025-11-18T12:00:00Z\nFull Recovery:      Estimated 2025-11-21\n\nCONTAINMENT TIMELINE\n06:45 UTC - Ransomware detected by SOC analyst\n07:00 UTC - Network segments disconnected\n07:15 UTC - Incident commander activated IR plan\n07:30 UTC - Backup integrity verification started\n08:00 UTC - Memory forensics initiated on 2 live systems\n10:00 UTC - Recovery operations commenced in clean room\n\nPOST-INCIDENT ACTIONS\n1. MFA enforced on all VPN and remote access\n2. 3-2-1-1-0 backup architecture implemented\n3. Network segmentation between workstation\u002Fserver VLANs\n4. LAPS deployed for local administrator passwords\n5. Regulatory notifications filed (GDPR 72-hour, state AG)\n```\n","# Performing Ransomware Response\n\n## When to Use\n\n- Ransomware has been detected executing or file encryption is actively occurring\n- Users report inability to open files with unfamiliar extensions appended\n- A ransom note is discovered on one or more systems\n- EDR detects mass file modification patterns consistent with encryption behavior\n- Threat intelligence warns of an imminent ransomware campaign targeting the organization\n\n**Do not use** for general malware incidents that do not involve file encryption or extortion; use malware incident response procedures instead.\n\n## Prerequisites\n\n- Ransomware-specific incident response playbook reviewed and approved by executive leadership\n- Tested and verified offline backup strategy with air-gapped or immutable copies\n- Incident retainer with a specialized ransomware response firm (e.g., Mandiant, CrowdStrike Services, Kroll)\n- Legal counsel pre-engaged for OFAC sanctions screening and regulatory notification\n- Cyber insurance carrier contact information and policy coverage details\n- Bitcoin\u002Fcryptocurrency analysis capability or third-party engagement for payment tracing\n\n## Workflow\n\n### Step 1: Detect and Confirm Ransomware\n\nValidate that the incident is ransomware and determine the variant:\n\n- Identify the ransomware by analyzing the ransom note filename, extension appended to encrypted files, and note content\n- Upload the ransom note and a sample encrypted file to ID Ransomware (id-ransomware.malwarehunterteam.com)\n- Check NoMoreRansom.org for available free decryptors\n- Determine the ransomware deployment method from EDR\u002FSIEM logs\n- Identify the ransomware group (e.g., LockBit, BlackCat\u002FALPHV, Royal, Akira, Play)\n\n```\nRansomware Identification:\n━━━━━━━━━━━━━━━━━━━━━━━━━\nVariant:          LockBit 3.0 (Black)\nExtension:        .lockbit3\nRansom Note:      README-LOCKBIT.txt\nTor Site:         lockbit[redacted].onion\nDeployment:       Group Policy Object pushing ransomware.exe to all domain-joined systems\nInitial Access:   VPN credential compromise (no MFA)\nDwell Time:       12 days\nData Exfiltration: Yes - 47GB uploaded to MEGA via rclone prior to encryption\n```\n\n### Step 2: Immediate Containment\n\nStop ransomware propagation before assessing damage:\n\n- **Priority 1**: Disconnect affected network segments from core infrastructure (pull the network cable, not shutdown)\n- **Priority 2**: Isolate all domain controllers immediately if GPO-based deployment is suspected\n- **Priority 3**: Disable the compromised accounts used for deployment\n- **Priority 4**: Block lateral movement protocols (SMB TCP\u002F445, RDP TCP\u002F3389, WinRM TCP\u002F5985-5986)\n- **Priority 5**: Preserve at least one encrypted system live (do not power off) for memory forensics\n- **Do NOT**: Shut down encrypted systems; keep them powered on to preserve encryption keys in memory\n\n### Step 3: Assess Damage and Scope\n\nQuantify the impact to inform recovery and business decisions:\n\n- Count the number of encrypted systems (workstations, servers, domain controllers)\n- Determine which business-critical systems and data are affected\n- Verify backup integrity: check that backups were not encrypted, deleted, or corrupted\n- Assess whether data exfiltration occurred (check for rclone, WinSCP, MEGA, cloud storage activity)\n- Determine the ransom demand amount and payment deadline\n- Check OFAC sanctions lists to verify the ransomware group is not a sanctioned entity (paying is legally risky)\n\n```\nImpact Assessment:\nEncrypted Systems:      187 of 340 endpoints (55%)\nEncrypted Servers:      12 of 28 (43%) - includes 2 file servers, 1 database server\nDomain Controllers:     2 of 3 encrypted\nBackup Status:          Veeam repository intact (offline copy verified clean)\nData Exfiltration:      Confirmed - 47GB to MEGA (file listing under analysis)\nRansom Demand:          $2.5M in Bitcoin (72-hour deadline)\nOFAC Screening:         LockBit - not currently sanctioned entity (verify with counsel)\n```\n\n### Step 4: Recovery Decision Matrix\n\nEvaluate recovery options in consultation with legal, executive leadership, and cyber insurance:\n\n| Option | Pros | Cons | Recommended When |\n|--------|------|------|-----------------|\n| Restore from backup | No payment, no legal risk | Recovery time may be days | Clean backups available |\n| Free decryptor | No payment, fast | Rare availability | Variant has published decryptor |\n| Negotiate and pay | Potentially faster | No guarantee, legal risk, funds threat actors | No backups, business survival at stake |\n| Rebuild from scratch | Clean environment | Longest timeline, data loss | Backups compromised, willing to accept data loss |\n\n### Step 5: Execute Recovery\n\nImplement the chosen recovery strategy:\n\n**If restoring from backup:**\n1. Build a clean isolated network segment for recovery operations\n2. Rebuild domain controllers first from clean media (do NOT restore DC backups older than the dwell time)\n3. Reset ALL user and service account passwords before joining any system to the new domain\n4. Restore servers in priority order: authentication, DNS, DHCP, then business-critical applications\n5. Restore workstations via reimaging, not file-level restore\n6. Restore data from verified clean backups to rebuilt file servers\n7. Reconnect to production network only after validation\n\n**If using a decryptor:**\n1. Test the decryptor on a non-critical system first\n2. Decrypt in order of business priority\n3. Scan all decrypted systems for residual malware before reconnection\n\n### Step 6: Post-Ransomware Hardening\n\nImplement controls to prevent recurrence:\n\n- Enforce MFA on all remote access (VPN, RDP, cloud portals)\n- Implement 3-2-1-1-0 backup strategy (3 copies, 2 media types, 1 offsite, 1 immutable, 0 errors)\n- Deploy application whitelisting on servers\n- Implement network segmentation between workstation and server VLANs\n- Enable Protected Users security group for privileged accounts\n- Disable NTLM authentication where possible\n- Deploy LAPS (Local Administrator Password Solution) for local admin accounts\n\n## Key Concepts\n\n| Term | Definition |\n|------|------------|\n| **Double Extortion** | Ransomware tactic combining file encryption with data exfiltration and threat to publish stolen data |\n| **Immutable Backup** | Backup storage that cannot be modified or deleted for a defined retention period, protecting against ransomware targeting backups |\n| **OFAC Sanctions** | U.S. Office of Foreign Assets Control restrictions that may prohibit ransom payments to sanctioned entities or jurisdictions |\n| **Dwell Time** | Days the attacker was present before deploying ransomware; critical for determining which backups are clean |\n| **Ransomware-as-a-Service (RaaS)** | Criminal business model where ransomware developers lease their malware to affiliates who conduct attacks |\n| **Rclone** | Legitimate cloud sync tool commonly abused by ransomware operators for data exfiltration before encryption |\n| **3-2-1-1-0 Backup Rule** | Backup strategy requiring 3 copies, 2 media types, 1 offsite, 1 immutable\u002Fair-gapped, and 0 errors in recovery testing |\n\n## Tools & Systems\n\n- **ID Ransomware**: Online service to identify ransomware variant from ransom note or encrypted file sample\n- **NoMoreRansom.org**: Europol-backed project providing free decryption tools for certain ransomware families\n- **Veeam \u002F Commvault**: Enterprise backup platforms with immutable repository and instant VM recovery capabilities\n- **KAPE**: Rapid forensic triage collection from encrypted systems to determine initial access and dwell time\n- **Cado Response**: Cloud-native forensics platform for investigating ransomware that affects cloud infrastructure\n\n## Common Scenarios\n\n### Scenario: LockBit 3.0 via Compromised VPN\n\n**Context**: Attackers compromised VPN credentials (no MFA), spent 12 days performing reconnaissance, disabled antivirus via GPO, exfiltrated 47GB of data, and deployed LockBit 3.0 across the domain via GPO at 2:00 AM on a Sunday.\n\n**Approach**:\n1. Disconnect all network segments at the core switch level\n2. Verify offline backup integrity (Veeam repository on immutable storage)\n3. Preserve two encrypted servers powered on for memory forensics\n4. Engage incident response retainer and cyber insurance carrier\n5. Begin recovery in isolated network: rebuild DCs, reset all passwords, restore in priority order\n6. Conduct forensic investigation in parallel to determine initial access and full adversary activity\n\n**Pitfalls**:\n- Restoring from backups that were created during the 12-day dwell time (may contain backdoors)\n- Paying the ransom without OFAC screening and legal counsel review\n- Reconnecting recovered systems to the production network before full password reset\n- Not checking for data exfiltration, leaving the organization exposed to the extortion threat\n\n## Output Format\n\n```\nRANSOMWARE INCIDENT REPORT\n===========================\nIncident:           INC-2025-1892\nRansomware Family:  LockBit 3.0 (Black)\nDate Detected:      2025-11-17T06:45:00Z\nInitial Access:     VPN credential compromise (no MFA)\nDwell Time:         12 days\n\nIMPACT SUMMARY\nEncrypted Systems:  187 endpoints, 12 servers\nBusiness Impact:    Full operations disruption\nData Exfiltrated:   47GB (finance, HR, legal documents)\nRansom Demand:      $2.5M BTC (72-hour deadline)\nBackup Status:      Veeam immutable repository - CLEAN\n\nRECOVERY APPROACH\nDecision:           Restore from backup (no ransom payment)\nRecovery Start:     2025-11-17T10:00:00Z\nDC Rebuild:         Complete - 2025-11-17T18:00:00Z\nCritical Systems:   Restored - 2025-11-18T12:00:00Z\nFull Recovery:      Estimated 2025-11-21\n\nCONTAINMENT TIMELINE\n06:45 UTC - Ransomware detected by SOC analyst\n07:00 UTC - Network segments disconnected\n07:15 UTC - Incident commander activated IR plan\n07:30 UTC - Backup integrity verification started\n08:00 UTC - Memory forensics initiated on 2 live systems\n10:00 UTC - Recovery operations commenced in clean room\n\nPOST-INCIDENT ACTIONS\n1. MFA enforced on all VPN and remote access\n2. 3-2-1-1-0 backup architecture implemented\n3. Network segmentation between workstation\u002Fserver VLANs\n4. LAPS deployed for local administrator passwords\n5. Regulatory notifications filed (GDPR 72-hour, state AG)\n```\n",{"name":5,"tags":44,"capec":49,"model":50,"tools":51,"domain":33,"maxTurns":55,"nist_csf":56,"subdomain":61,"description":7,"mitre_attack":62},[19,45,46,47,48],"encryption-recovery","backup-restoration","ransom-negotiation","CISA-guidance",[],"sonnet",[52,31,53,54],"Read","Glob","Grep",20,[57,58,59,60],"RS.MA-01","RS.MA-02","RS.AN-03","RC.RP-01","incident-response",[63,64,65,66,67,68],"T1486","T1490","T1489","T1021","T1570","T1059","main","a91f1293287ffa9f4f1b8f486cd6e835a1568c84","skills\u002Fmalware\u002Fransomware\u002Fresponse\u002Frespond","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace","https:\u002F\u002Fgithub.com\u002FDCx7C5","#Python","2026-09-01 11:21:00",{"source":8,"skillName":5,"commands":77,"prompt":87,"zipAvailable":88},[78,81,84],{"tool":79,"command":80},"npx","npx skills add DCx7C5\u002Fai-marketplace --skill ransomware-response-respond",{"tool":82,"command":83},"bunx","bunx skills add DCx7C5\u002Fai-marketplace --skill ransomware-response-respond",{"tool":85,"command":86},"pnpm","pnpm dlx skills add DCx7C5\u002Fai-marketplace --skill ransomware-response-respond","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fmalware\u002Fransomware\u002Fresponse\u002Frespond\u002FSKILL.md",true,[90],{"path":91,"resourceType":92,"resourceTypeDesc":93,"sizeBytes":94,"sourceHtmlUrl":95},"index.json","REFERENCE","参考文档",696,"https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fmalware\u002Fransomware\u002Fresponse\u002Frespond\u002Findex.json",[97,122,142,163,185,201],{"skillNo":98,"name":99,"nameZh":6,"description":100,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":101,"categories":102,"keywords":103,"publishedAt":39},"01M71HAPZ01KQ30RKTB0FFSQ05","services-wmi-persistence-detect","Detect WMI event subscription persistence by enumerating ActiveScriptEventConsumer, CommandLineEventConsumer, and permanent subscriptions in the WMI repository.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fservices\u002Fwmi\u002Fpersistence\u002Fdetect\u002FSKILL.md",[],[104,105,106,107,108,109,110,111,112,113,114,115,116,117,118,119,120,33,121],"services","detect","services wmi persistence detect","wmi","persistence","de","cm","process","activescript","event","subscriptions","commandline-consumer","repository","subscription","event-subscription","t1546.003","forensics","process-forensics",{"skillNo":123,"name":124,"nameZh":6,"description":125,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":126,"categories":127,"keywords":128,"publishedAt":39},"01M71HAK6JTTTS229T17WJMMCG","services-wmi-exec-exploit","Perform lateral movement across Windows networks using WMI-based remote execution techniques including Impacket wmiexec.py, CrackMapExec, and native WMI commands for stealthy post-exploitation during red team engagements.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fservices\u002Fwmi\u002Fexec\u002Fexploit\u002FSKILL.md",[],[129,104,130,107,131,132,133,33,31,29,134,135,136,137,109,138,139,25,140,141],"exploit","services wmi exec exploit","exec","remote","traffic","team","across","crackmapexec","native","command","lateral movement","lateral-movement","Impacket",{"skillNo":143,"name":144,"nameZh":6,"description":145,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":146,"categories":147,"keywords":148,"publishedAt":39},"01M71HAG6MHKNQV8KDZKMT4886","registry-artifact-extract","Extract and analyze Windows Registry hives to uncover user activity, installed software, autostart entries, and evidence of system compromise.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fregistry\u002Fartifact\u002Fextract\u002FSKILL.md",[],[149,150,151,152,153,154,33,31,155,29,156,157,109,25,158,159,160,161,162,50],"artifact","registry","registry artifact extract","extract","evidence-collection","artifact-analysis","collection","analyze","uncover","software","activity","digital-forensics","windows-registry","regripper",{"skillNo":164,"name":165,"nameZh":6,"description":166,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":167,"categories":168,"keywords":169,"publishedAt":39},"01M71HACR4A8XTWTTSXK4124AA","processes-token-impersonate-detect","Detect Windows token impersonation and privilege abuse including SeImpersonatePrivilege exploitation via Potato attacks and token stealing techniques.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fprocesses\u002Ftoken\u002Fimpersonate\u002Fdetect\u002FSKILL.md",[],[105,170,171,172,173,174,175,110,176,33,121,177,178,179,180,181,182,183,184,109],"processes token impersonate detect","token","processes","attacks","windows","escalation","techniques","privilege-escalation","seimpersonate","token-impersonation","printspoofer","exploitation","potato","impersonation","via",{"skillNo":186,"name":187,"nameZh":6,"description":188,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":189,"categories":190,"keywords":191,"publishedAt":39},"01M71HAABSB4Z6QFSXEG00R4RK","processes-thread-injection-detect","Detect Windows thread injection techniques including CreateRemoteThread, QueueUserAPC, NtCreateThreadEx, and thread hijacking via process memory analysis.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fprocesses\u002Fthread\u002Finjection\u002Fdetect\u002FSKILL.md",[],[192,193,105,194,172,174,195,110,196,176,33,121,29,197,198,199,200,184,109,111],"thread","processes thread injection detect","injection","memory","process-injection","api","apc-injection","thread-injection","nt-api",{"skillNo":202,"name":203,"nameZh":6,"description":204,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":205,"categories":206,"keywords":207,"publishedAt":39},"01M71HA7H311V5G14WMX58HQSS","processes-hollow-technique-detect","Detect process hollowing (RunPE) by identifying processes with mismatched image paths between PEB and VAD tree, or unmapped PE headers in memory.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fprocesses\u002Fhollow\u002Ftechnique\u002Fdetect\u002FSKILL.md",[],[208,105,172,209,195,110,210,211,33,121,212,213,214,215,216,217,109,111,218,219],"processes hollow technique detect","tree","memory-forensics","process-hollow","peb","runpe","image","pe-header","in memory","with","mismatched","headers"]