[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M71FJG05JNE11YRG2C2CB7KR":3,"skill-same:01M71FJG05JNE11YRG2C2CB7KR":98},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":18,"publishedAt":39,"linkOnly":40,"markdownContent":41,"markdownBody":42,"frontMatter":43,"refName":71,"commitSha":72,"skillDirectory":73,"forksCount":14,"repositoryHtmlUrl":74,"repositoryHomepageUrl":6,"ownerHtmlUrl":75,"ownerBlogUrl":6,"ownerDescription":76,"updatedAt":77,"install":78,"resources":91},"01M71FJG05JNE11YRG2C2CB7KR","capture-network-analyze",null,"Perform forensic analysis of network packet captures (PCAP\u002FPCAPNG) using Wireshark, tshark, and tcpdump to reconstruct network communications, extract transferred files, identify malicious traffic, and establish evidence of data exfiltration or command-and-control activity.","DCx7C5\u002Fai-marketplace","DCx7C5","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F42419559?v=4","01M71C01G2AZV3NTNGWAWSHJPP","DC","01M71C01GQW6G50S2BYMS7PP3E",0,"MIT","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fnetwork\u002Fcapture\u002Fnetwork\u002Fanalyze\u002FSKILL.md",[],[19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38],"network","capture network analyze","capture","analyze","forensic","read","command","de","forensic analysis","network-forensics","communications","malicious","exfiltration","analysis","Bash","cybersecurity","traffic","files","protocol-analysis","command-and-control","2026-11-10 10:12:30",false,"---\nname: capture-network-analyze\ndescription: Perform forensic analysis of network packet captures (PCAP\u002FPCAPNG) using Wireshark, tshark, and tcpdump to reconstruct network communications, extract transferred files, identify malicious traffic, and establish evidence of data exfiltration or command-and-control activity.\ndomain: cybersecurity\nsubdomain: digital-forensics\ntags:\n- pcap\n- wireshark\n- tshark\n- tcpdump\n- network-forensics\n- packet-capture\n- protocol-analysis\n- traffic-analysis\n- pcapng\n- network-evidence\nnist_csf:\n- RS.AN-01\n- RS.AN-03\n- DE.AE-02\n- RS.MA-01\nmodel: sonnet\nmaxTurns: 20\ntools: [Read, Bash, Glob, Grep]\nmitre_attack:\n- T1021\n- T1040\n- T1041\n- T1071\ncapec: []\n---\n\n# Performing Network Packet Capture Analysis\n\n## Overview\n\nNetwork packet captures (PCAP\u002FPCAPNG files) represent the ultimate source of truth about network activity and provide irrefutable evidence of communications between hosts. PCAP files log every packet transmitted over a network segment, making them vital for forensic investigations involving data exfiltration, command-and-control communications, lateral movement, malware delivery, and unauthorized access. Wireshark is the primary tool for interactive analysis, while tshark provides command-line capabilities for automated processing and scripting. Modern PCAPNG format supports additional metadata including interface descriptions, capture comments, precise timestamps, and per-packet annotations.\n\n\n## When to Use\n\n- When conducting security assessments that involve performing network packet capture analysis\n- When following incident response procedures for related security events\n- When performing scheduled security testing or auditing activities\n- When validating security controls through hands-on testing\n\n## Prerequisites\n\n- Wireshark 4.x with protocol dissectors\n- tshark command-line tool (included with Wireshark)\n- tcpdump for capture and basic filtering\n- Python 3.8+ with scapy and pyshark libraries\n- Sufficient disk space for PCAP files (can be multi-GB)\n\n## Capture Techniques\n\n### tcpdump\n\n```bash\n# Capture all traffic on interface eth0\ntcpdump -i eth0 -w capture.pcap\n\n# Capture with rotation (100MB files, keep 10)\ntcpdump -i eth0 -w capture_%Y%m%d_%H%M%S.pcap -C 100 -W 10\n\n# Capture specific host traffic\ntcpdump -i eth0 host 192.168.1.100 -w host_traffic.pcap\n\n# Capture specific port traffic\ntcpdump -i eth0 port 443 -w https_traffic.pcap\n\n# Capture with BPF filter for suspicious ports\ntcpdump -i eth0 'port 4444 or port 8080 or port 1337' -w suspicious.pcap\n```\n\n### Wireshark Display Filters\n\n```\n# HTTP traffic\nhttp\n\n# DNS queries\ndns\n\n# SMB file transfers\nsmb2\n\n# Specific IP communication\nip.addr == 192.168.1.100\n\n# Failed TCP connections\ntcp.flags.syn == 1 && tcp.flags.ack == 0\n\n# Large data transfers (potential exfiltration)\ntcp.len > 1000\n\n# Specific protocol by port\ntcp.port == 4444\n\n# TLS handshakes (SNI extraction)\ntls.handshake.type == 1\n\n# HTTP POST requests\nhttp.request.method == \"POST\"\n\n# DNS queries to suspicious TLDs\ndns.qry.name contains \".xyz\" or dns.qry.name contains \".top\"\n\n# Beaconing detection (regular intervals)\nframe.time_delta_displayed > 55 && frame.time_delta_displayed \u003C 65\n```\n\n### tshark Analysis Commands\n\n```bash\n# Extract HTTP URLs from capture\ntshark -r capture.pcap -Y \"http.request\" -T fields -e http.host -e http.request.uri\n\n# Extract DNS queries\ntshark -r capture.pcap -Y \"dns.flags.response == 0\" -T fields -e dns.qry.name | sort -u\n\n# Extract file transfers (HTTP objects)\ntshark -r capture.pcap --export-objects http,exported_files\u002F\n\n# Extract SMB file transfers\ntshark -r capture.pcap --export-objects smb,smb_files\u002F\n\n# Protocol hierarchy statistics\ntshark -r capture.pcap -z io,phs\n\n# Conversation statistics\ntshark -r capture.pcap -z conv,tcp\n\n# Extract TLS SNI (Server Name Indication)\ntshark -r capture.pcap -Y \"tls.handshake.type == 1\" -T fields -e tls.handshake.extensions_server_name\n\n# Top talkers by bytes\ntshark -r capture.pcap -z endpoints,ip -q\n\n# Extract credentials (FTP, HTTP Basic)\ntshark -r capture.pcap -Y \"ftp.request.command == USER || ftp.request.command == PASS || http.authorization\" -T fields -e ftp.request.arg -e http.authorization\n```\n\n## Python PCAP Analysis\n\n```python\nfrom scapy.all import rdpcap, IP, TCP, UDP, DNS, DNSQR, Raw\nimport os\nimport sys\nimport json\nfrom collections import defaultdict, Counter\nfrom datetime import datetime\n\n\nclass PCAPForensicAnalyzer:\n    \"\"\"Forensic analysis of PCAP files using Scapy.\"\"\"\n\n    def __init__(self, pcap_path: str, output_dir: str):\n        self.pcap_path = pcap_path\n        self.output_dir = output_dir\n        os.makedirs(output_dir, exist_ok=True)\n        self.packets = rdpcap(pcap_path)\n\n    def get_conversations(self) -> list:\n        \"\"\"Extract unique IP conversations with byte counts.\"\"\"\n        convos = defaultdict(lambda: {\"packets\": 0, \"bytes\": 0})\n        for pkt in self.packets:\n            if IP in pkt:\n                key = tuple(sorted([pkt[IP].src, pkt[IP].dst]))\n                convos[key][\"packets\"] += 1\n                convos[key][\"bytes\"] += len(pkt)\n\n        return [\n            {\"src\": k[0], \"dst\": k[1], \"packets\": v[\"packets\"], \"bytes\": v[\"bytes\"]}\n            for k, v in sorted(convos.items(), key=lambda x: x[1][\"bytes\"], reverse=True)\n        ]\n\n    def extract_dns_queries(self) -> list:\n        \"\"\"Extract all DNS queries from the capture.\"\"\"\n        queries = []\n        for pkt in self.packets:\n            if DNS in pkt and pkt[DNS].qr == 0 and DNSQR in pkt:\n                queries.append({\n                    \"query\": pkt[DNSQR].qname.decode(errors=\"replace\").rstrip(\".\"),\n                    \"type\": pkt[DNSQR].qtype,\n                    \"src\": pkt[IP].src if IP in pkt else \"unknown\"\n                })\n        return queries\n\n    def detect_beaconing(self, threshold_seconds: float = 5.0) -> list:\n        \"\"\"Detect potential beaconing activity based on regular intervals.\"\"\"\n        ip_timestamps = defaultdict(list)\n        for pkt in self.packets:\n            if IP in pkt and TCP in pkt:\n                key = (pkt[IP].src, pkt[IP].dst, pkt[TCP].dport)\n                ip_timestamps[key].append(float(pkt.time))\n\n        beacons = []\n        for key, times in ip_timestamps.items():\n            if len(times) \u003C 5:\n                continue\n            deltas = [times[i+1] - times[i] for i in range(len(times)-1)]\n            if deltas:\n                avg_delta = sum(deltas) \u002F len(deltas)\n                variance = sum((d - avg_delta) ** 2 for d in deltas) \u002F len(deltas)\n                if variance \u003C threshold_seconds and avg_delta > 1:\n                    beacons.append({\n                        \"src\": key[0], \"dst\": key[1], \"port\": key[2],\n                        \"avg_interval\": round(avg_delta, 2),\n                        \"variance\": round(variance, 4),\n                        \"connection_count\": len(times)\n                    })\n        return sorted(beacons, key=lambda x: x[\"variance\"])\n\n    def get_protocol_distribution(self) -> dict:\n        \"\"\"Get protocol distribution statistics.\"\"\"\n        protocols = Counter()\n        for pkt in self.packets:\n            if TCP in pkt:\n                protocols[f\"TCP\u002F{pkt[TCP].dport}\"] += 1\n            elif UDP in pkt:\n                protocols[f\"UDP\u002F{pkt[UDP].dport}\"] += 1\n        return dict(protocols.most_common(50))\n\n    def generate_report(self) -> str:\n        \"\"\"Generate comprehensive PCAP analysis report.\"\"\"\n        report = {\n            \"analysis_timestamp\": datetime.now().isoformat(),\n            \"pcap_file\": self.pcap_path,\n            \"total_packets\": len(self.packets),\n            \"conversations\": self.get_conversations()[:50],\n            \"dns_queries\": self.extract_dns_queries()[:200],\n            \"potential_beacons\": self.detect_beaconing(),\n            \"protocol_distribution\": self.get_protocol_distribution()\n        }\n\n        report_path = os.path.join(self.output_dir, \"pcap_forensic_report.json\")\n        with open(report_path, \"w\") as f:\n            json.dump(report, f, indent=2)\n\n        print(f\"[*] Total packets: {report['total_packets']}\")\n        print(f\"[*] Conversations: {len(report['conversations'])}\")\n        print(f\"[*] DNS queries: {len(report['dns_queries'])}\")\n        print(f\"[*] Potential beacons: {len(report['potential_beacons'])}\")\n        return report_path\n\n\ndef main():\n    if len(sys.argv) \u003C 3:\n        print(\"Usage: python process.py \u003Cpcap_file> \u003Coutput_dir>\")\n        sys.exit(1)\n    analyzer = PCAPForensicAnalyzer(sys.argv[1], sys.argv[2])\n    analyzer.generate_report()\n\n\nif __name__ == \"__main__\":\n    main()\n```\n\n## References\n\n- Wireshark Documentation: https:\u002F\u002Fwww.wireshark.org\u002Fdocs\u002F\n- PCAP Analysis Mastery: https:\u002F\u002Finsanecyber.com\u002Fmastering-pcap-review\u002F\n- SANS Network Forensics: https:\u002F\u002Fwww.sans.org\u002Fcyber-security-courses\u002Fnetwork-forensics\u002F\n- Public PCAPs for Practice: https:\u002F\u002Fwww.netresec.com\u002F?page=PcapFiles\n","# Performing Network Packet Capture Analysis\n\n## Overview\n\nNetwork packet captures (PCAP\u002FPCAPNG files) represent the ultimate source of truth about network activity and provide irrefutable evidence of communications between hosts. PCAP files log every packet transmitted over a network segment, making them vital for forensic investigations involving data exfiltration, command-and-control communications, lateral movement, malware delivery, and unauthorized access. Wireshark is the primary tool for interactive analysis, while tshark provides command-line capabilities for automated processing and scripting. Modern PCAPNG format supports additional metadata including interface descriptions, capture comments, precise timestamps, and per-packet annotations.\n\n\n## When to Use\n\n- When conducting security assessments that involve performing network packet capture analysis\n- When following incident response procedures for related security events\n- When performing scheduled security testing or auditing activities\n- When validating security controls through hands-on testing\n\n## Prerequisites\n\n- Wireshark 4.x with protocol dissectors\n- tshark command-line tool (included with Wireshark)\n- tcpdump for capture and basic filtering\n- Python 3.8+ with scapy and pyshark libraries\n- Sufficient disk space for PCAP files (can be multi-GB)\n\n## Capture Techniques\n\n### tcpdump\n\n```bash\n# Capture all traffic on interface eth0\ntcpdump -i eth0 -w capture.pcap\n\n# Capture with rotation (100MB files, keep 10)\ntcpdump -i eth0 -w capture_%Y%m%d_%H%M%S.pcap -C 100 -W 10\n\n# Capture specific host traffic\ntcpdump -i eth0 host 192.168.1.100 -w host_traffic.pcap\n\n# Capture specific port traffic\ntcpdump -i eth0 port 443 -w https_traffic.pcap\n\n# Capture with BPF filter for suspicious ports\ntcpdump -i eth0 'port 4444 or port 8080 or port 1337' -w suspicious.pcap\n```\n\n### Wireshark Display Filters\n\n```\n# HTTP traffic\nhttp\n\n# DNS queries\ndns\n\n# SMB file transfers\nsmb2\n\n# Specific IP communication\nip.addr == 192.168.1.100\n\n# Failed TCP connections\ntcp.flags.syn == 1 && tcp.flags.ack == 0\n\n# Large data transfers (potential exfiltration)\ntcp.len > 1000\n\n# Specific protocol by port\ntcp.port == 4444\n\n# TLS handshakes (SNI extraction)\ntls.handshake.type == 1\n\n# HTTP POST requests\nhttp.request.method == \"POST\"\n\n# DNS queries to suspicious TLDs\ndns.qry.name contains \".xyz\" or dns.qry.name contains \".top\"\n\n# Beaconing detection (regular intervals)\nframe.time_delta_displayed > 55 && frame.time_delta_displayed \u003C 65\n```\n\n### tshark Analysis Commands\n\n```bash\n# Extract HTTP URLs from capture\ntshark -r capture.pcap -Y \"http.request\" -T fields -e http.host -e http.request.uri\n\n# Extract DNS queries\ntshark -r capture.pcap -Y \"dns.flags.response == 0\" -T fields -e dns.qry.name | sort -u\n\n# Extract file transfers (HTTP objects)\ntshark -r capture.pcap --export-objects http,exported_files\u002F\n\n# Extract SMB file transfers\ntshark -r capture.pcap --export-objects smb,smb_files\u002F\n\n# Protocol hierarchy statistics\ntshark -r capture.pcap -z io,phs\n\n# Conversation statistics\ntshark -r capture.pcap -z conv,tcp\n\n# Extract TLS SNI (Server Name Indication)\ntshark -r capture.pcap -Y \"tls.handshake.type == 1\" -T fields -e tls.handshake.extensions_server_name\n\n# Top talkers by bytes\ntshark -r capture.pcap -z endpoints,ip -q\n\n# Extract credentials (FTP, HTTP Basic)\ntshark -r capture.pcap -Y \"ftp.request.command == USER || ftp.request.command == PASS || http.authorization\" -T fields -e ftp.request.arg -e http.authorization\n```\n\n## Python PCAP Analysis\n\n```python\nfrom scapy.all import rdpcap, IP, TCP, UDP, DNS, DNSQR, Raw\nimport os\nimport sys\nimport json\nfrom collections import defaultdict, Counter\nfrom datetime import datetime\n\n\nclass PCAPForensicAnalyzer:\n    \"\"\"Forensic analysis of PCAP files using Scapy.\"\"\"\n\n    def __init__(self, pcap_path: str, output_dir: str):\n        self.pcap_path = pcap_path\n        self.output_dir = output_dir\n        os.makedirs(output_dir, exist_ok=True)\n        self.packets = rdpcap(pcap_path)\n\n    def get_conversations(self) -> list:\n        \"\"\"Extract unique IP conversations with byte counts.\"\"\"\n        convos = defaultdict(lambda: {\"packets\": 0, \"bytes\": 0})\n        for pkt in self.packets:\n            if IP in pkt:\n                key = tuple(sorted([pkt[IP].src, pkt[IP].dst]))\n                convos[key][\"packets\"] += 1\n                convos[key][\"bytes\"] += len(pkt)\n\n        return [\n            {\"src\": k[0], \"dst\": k[1], \"packets\": v[\"packets\"], \"bytes\": v[\"bytes\"]}\n            for k, v in sorted(convos.items(), key=lambda x: x[1][\"bytes\"], reverse=True)\n        ]\n\n    def extract_dns_queries(self) -> list:\n        \"\"\"Extract all DNS queries from the capture.\"\"\"\n        queries = []\n        for pkt in self.packets:\n            if DNS in pkt and pkt[DNS].qr == 0 and DNSQR in pkt:\n                queries.append({\n                    \"query\": pkt[DNSQR].qname.decode(errors=\"replace\").rstrip(\".\"),\n                    \"type\": pkt[DNSQR].qtype,\n                    \"src\": pkt[IP].src if IP in pkt else \"unknown\"\n                })\n        return queries\n\n    def detect_beaconing(self, threshold_seconds: float = 5.0) -> list:\n        \"\"\"Detect potential beaconing activity based on regular intervals.\"\"\"\n        ip_timestamps = defaultdict(list)\n        for pkt in self.packets:\n            if IP in pkt and TCP in pkt:\n                key = (pkt[IP].src, pkt[IP].dst, pkt[TCP].dport)\n                ip_timestamps[key].append(float(pkt.time))\n\n        beacons = []\n        for key, times in ip_timestamps.items():\n            if len(times) \u003C 5:\n                continue\n            deltas = [times[i+1] - times[i] for i in range(len(times)-1)]\n            if deltas:\n                avg_delta = sum(deltas) \u002F len(deltas)\n                variance = sum((d - avg_delta) ** 2 for d in deltas) \u002F len(deltas)\n                if variance \u003C threshold_seconds and avg_delta > 1:\n                    beacons.append({\n                        \"src\": key[0], \"dst\": key[1], \"port\": key[2],\n                        \"avg_interval\": round(avg_delta, 2),\n                        \"variance\": round(variance, 4),\n                        \"connection_count\": len(times)\n                    })\n        return sorted(beacons, key=lambda x: x[\"variance\"])\n\n    def get_protocol_distribution(self) -> dict:\n        \"\"\"Get protocol distribution statistics.\"\"\"\n        protocols = Counter()\n        for pkt in self.packets:\n            if TCP in pkt:\n                protocols[f\"TCP\u002F{pkt[TCP].dport}\"] += 1\n            elif UDP in pkt:\n                protocols[f\"UDP\u002F{pkt[UDP].dport}\"] += 1\n        return dict(protocols.most_common(50))\n\n    def generate_report(self) -> str:\n        \"\"\"Generate comprehensive PCAP analysis report.\"\"\"\n        report = {\n            \"analysis_timestamp\": datetime.now().isoformat(),\n            \"pcap_file\": self.pcap_path,\n            \"total_packets\": len(self.packets),\n            \"conversations\": self.get_conversations()[:50],\n            \"dns_queries\": self.extract_dns_queries()[:200],\n            \"potential_beacons\": self.detect_beaconing(),\n            \"protocol_distribution\": self.get_protocol_distribution()\n        }\n\n        report_path = os.path.join(self.output_dir, \"pcap_forensic_report.json\")\n        with open(report_path, \"w\") as f:\n            json.dump(report, f, indent=2)\n\n        print(f\"[*] Total packets: {report['total_packets']}\")\n        print(f\"[*] Conversations: {len(report['conversations'])}\")\n        print(f\"[*] DNS queries: {len(report['dns_queries'])}\")\n        print(f\"[*] Potential beacons: {len(report['potential_beacons'])}\")\n        return report_path\n\n\ndef main():\n    if len(sys.argv) \u003C 3:\n        print(\"Usage: python process.py \u003Cpcap_file> \u003Coutput_dir>\")\n        sys.exit(1)\n    analyzer = PCAPForensicAnalyzer(sys.argv[1], sys.argv[2])\n    analyzer.generate_report()\n\n\nif __name__ == \"__main__\":\n    main()\n```\n\n## References\n\n- Wireshark Documentation: https:\u002F\u002Fwww.wireshark.org\u002Fdocs\u002F\n- PCAP Analysis Mastery: https:\u002F\u002Finsanecyber.com\u002Fmastering-pcap-review\u002F\n- SANS Network Forensics: https:\u002F\u002Fwww.sans.org\u002Fcyber-security-courses\u002Fnetwork-forensics\u002F\n- Public PCAPs for Practice: https:\u002F\u002Fwww.netresec.com\u002F?page=PcapFiles\n",{"name":5,"tags":44,"capec":53,"model":54,"tools":55,"domain":34,"maxTurns":59,"nist_csf":60,"subdomain":65,"description":7,"mitre_attack":66},[45,46,47,48,28,49,37,50,51,52],"pcap","wireshark","tshark","tcpdump","packet-capture","traffic-analysis","pcapng","network-evidence",[],"sonnet",[56,33,57,58],"Read","Glob","Grep",20,[61,62,63,64],"RS.AN-01","RS.AN-03","DE.AE-02","RS.MA-01","digital-forensics",[67,68,69,70],"T1021","T1040","T1041","T1071","main","a91f1293287ffa9f4f1b8f486cd6e835a1568c84","skills\u002Fnetwork\u002Fcapture\u002Fnetwork\u002Fanalyze","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace","https:\u002F\u002Fgithub.com\u002FDCx7C5","#Python","2026-09-01 11:21:00",{"source":8,"skillName":5,"commands":79,"prompt":89,"zipAvailable":90},[80,83,86],{"tool":81,"command":82},"npx","npx skills add DCx7C5\u002Fai-marketplace --skill capture-network-analyze",{"tool":84,"command":85},"bunx","bunx skills add DCx7C5\u002Fai-marketplace --skill capture-network-analyze",{"tool":87,"command":88},"pnpm","pnpm dlx skills add DCx7C5\u002Fai-marketplace --skill capture-network-analyze","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fnetwork\u002Fcapture\u002Fnetwork\u002Fanalyze\u002FSKILL.md",true,[92],{"path":93,"resourceType":94,"resourceTypeDesc":95,"sizeBytes":96,"sourceHtmlUrl":97},"index.json","REFERENCE","参考文档",684,"https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fnetwork\u002Fcapture\u002Fnetwork\u002Fanalyze\u002Findex.json",[99,123,141,160,182,198],{"skillNo":100,"name":101,"nameZh":6,"description":102,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":103,"categories":104,"keywords":105,"publishedAt":39},"01M71HAPZ01KQ30RKTB0FFSQ05","services-wmi-persistence-detect","Detect WMI event subscription persistence by enumerating ActiveScriptEventConsumer, CommandLineEventConsumer, and permanent subscriptions in the WMI repository.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fservices\u002Fwmi\u002Fpersistence\u002Fdetect\u002FSKILL.md",[],[106,107,108,109,110,26,111,112,113,114,115,116,117,118,119,120,121,34,122],"services","detect","services wmi persistence detect","wmi","persistence","cm","process","activescript","event","subscriptions","commandline-consumer","repository","subscription","event-subscription","t1546.003","forensics","process-forensics",{"skillNo":124,"name":125,"nameZh":6,"description":126,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":127,"categories":128,"keywords":129,"publishedAt":39},"01M71HAK6JTTTS229T17WJMMCG","services-wmi-exec-exploit","Perform lateral movement across Windows networks using WMI-based remote execution techniques including Impacket wmiexec.py, CrackMapExec, and native WMI commands for stealthy post-exploitation during red team engagements.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fservices\u002Fwmi\u002Fexec\u002Fexploit\u002FSKILL.md",[],[130,106,131,109,132,133,35,34,33,32,134,135,136,137,26,25,138,24,139,140],"exploit","services wmi exec exploit","exec","remote","team","across","crackmapexec","native","lateral movement","lateral-movement","Impacket",{"skillNo":142,"name":143,"nameZh":6,"description":144,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":145,"categories":146,"keywords":147,"publishedAt":39},"01M71HAG6MHKNQV8KDZKMT4886","registry-artifact-extract","Extract and analyze Windows Registry hives to uncover user activity, installed software, autostart entries, and evidence of system compromise.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fregistry\u002Fartifact\u002Fextract\u002FSKILL.md",[],[148,149,150,151,152,153,34,33,154,32,22,155,26,24,156,157,65,158,159,54],"artifact","registry","registry artifact extract","extract","evidence-collection","artifact-analysis","collection","uncover","software","activity","windows-registry","regripper",{"skillNo":161,"name":162,"nameZh":6,"description":163,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":164,"categories":165,"keywords":166,"publishedAt":39},"01M71HACR4A8XTWTTSXK4124AA","processes-token-impersonate-detect","Detect Windows token impersonation and privilege abuse including SeImpersonatePrivilege exploitation via Potato attacks and token stealing techniques.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fprocesses\u002Ftoken\u002Fimpersonate\u002Fdetect\u002FSKILL.md",[],[107,167,168,169,170,171,172,111,173,34,122,174,175,176,177,178,179,180,181,26],"processes token impersonate detect","token","processes","attacks","windows","escalation","techniques","privilege-escalation","seimpersonate","token-impersonation","printspoofer","exploitation","potato","impersonation","via",{"skillNo":183,"name":184,"nameZh":6,"description":185,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":186,"categories":187,"keywords":188,"publishedAt":39},"01M71HAABSB4Z6QFSXEG00R4RK","processes-thread-injection-detect","Detect Windows thread injection techniques including CreateRemoteThread, QueueUserAPC, NtCreateThreadEx, and thread hijacking via process memory analysis.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fprocesses\u002Fthread\u002Finjection\u002Fdetect\u002FSKILL.md",[],[189,190,107,191,169,171,192,111,193,173,34,122,32,194,195,196,197,181,26,112],"thread","processes thread injection detect","injection","memory","process-injection","api","apc-injection","thread-injection","nt-api",{"skillNo":199,"name":200,"nameZh":6,"description":201,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":202,"categories":203,"keywords":204,"publishedAt":39},"01M71HA7H311V5G14WMX58HQSS","processes-hollow-technique-detect","Detect process hollowing (RunPE) by identifying processes with mismatched image paths between PEB and VAD tree, or unmapped PE headers in memory.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fprocesses\u002Fhollow\u002Ftechnique\u002Fdetect\u002FSKILL.md",[],[205,107,169,206,192,111,207,208,34,122,209,210,211,212,213,214,26,112,215,216],"processes hollow technique detect","tree","memory-forensics","process-hollow","peb","runpe","image","pe-header","in memory","with","mismatched","headers"]