[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M71FM1G90JB5GE945G8EXCHF":3,"skill-same:01M71FM1G90JB5GE945G8EXCHF":92},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":18,"publishedAt":39,"linkOnly":40,"markdownContent":41,"markdownBody":42,"frontMatter":43,"refName":65,"commitSha":66,"skillDirectory":67,"forksCount":14,"repositoryHtmlUrl":68,"repositoryHomepageUrl":6,"ownerHtmlUrl":69,"ownerBlogUrl":6,"ownerDescription":70,"updatedAt":71,"install":72,"resources":85},"01M71FM1G90JB5GE945G8EXCHF","dns-subfinder-exploit",null,"Enumerate subdomains of target domains using ProjectDiscovery's Subfinder passive reconnaissance tool to map the attack surface during security assessments.","DCx7C5\u002Fai-marketplace","DCx7C5","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F42419559?v=4","01M71C01G2AZV3NTNGWAWSHJPP","DC","01M71C01GQW6G50S2BYMS7PP3E",0,"MIT","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fnetwork\u002Fdns\u002Fsubfinder\u002Fexploit\u002FSKILL.md",[],[19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38],"exploit","dns subfinder exploit","subfinder","dns","web-application-security","sonnet","attack","security","bug","read","de","subdomain","Bash","cybersecurity","map","passive-recon","domains","attack-surface","cm","recon","2026-11-10 10:12:30",false,"---\nname: dns-subfinder-exploit\ndescription: Enumerate subdomains of target domains using ProjectDiscovery's Subfinder passive reconnaissance tool to map the attack surface during security assessments.\ndomain: cybersecurity\nsubdomain: web-application-security\ntags:\n- subdomain-enumeration\n- reconnaissance\n- bug-bounty\n- attack-surface\n- subfinder\n- passive-recon\n- osint\nnist_csf:\n- PR.PS-01\n- ID.RA-01\n- PR.DS-10\n- DE.CM-01\nmodel: sonnet\nmaxTurns: 20\ntools: [Read, Bash, Glob, Grep]\nmitre_attack:\n- T1046\n- T1593\n- T1595\n- T1595.002\ncapec: []\n---\n\n# Performing Subdomain Enumeration with Subfinder\n\n## When to Use\n- During the reconnaissance phase of penetration testing or bug bounty hunting\n- When mapping the external attack surface of a target organization\n- Before performing vulnerability scanning on discovered subdomains\n- When building an asset inventory for continuous security monitoring\n- During red team engagements requiring passive information gathering\n\n## Prerequisites\n- Go 1.21+ installed for building from source\n- Subfinder v2 installed (`go install -v github.com\u002Fprojectdiscovery\u002Fsubfinder\u002Fv2\u002Fcmd\u002Fsubfinder@latest`)\n- API keys configured for passive sources (Shodan, Censys, VirusTotal, SecurityTrails, Chaos)\n- Provider configuration file at `$HOME\u002F.config\u002Fsubfinder\u002Fprovider-config.yaml`\n- Network access to passive DNS and certificate transparency sources\n- httpx or httprobe for validating discovered subdomains\n\n## Workflow\n\n### Step 1 — Install and Configure Subfinder\n```bash\n# Install subfinder\ngo install -v github.com\u002Fprojectdiscovery\u002Fsubfinder\u002Fv2\u002Fcmd\u002Fsubfinder@latest\n\n# Verify installation\nsubfinder -version\n\n# Configure API keys for enhanced results\nmkdir -p $HOME\u002F.config\u002Fsubfinder\ncat > $HOME\u002F.config\u002Fsubfinder\u002Fprovider-config.yaml \u003C\u003C 'EOF'\nshodan:\n  - YOUR_SHODAN_API_KEY\ncensys:\n  - YOUR_CENSYS_API_ID:YOUR_CENSYS_API_SECRET\nvirustotal:\n  - YOUR_VT_API_KEY\nsecuritytrails:\n  - YOUR_ST_API_KEY\nchaos:\n  - YOUR_CHAOS_API_KEY\nEOF\n```\n\n### Step 2 — Run Basic Subdomain Enumeration\n```bash\n# Single domain enumeration\nsubfinder -d example.com -o subdomains.txt\n\n# Multiple domains from a file\nsubfinder -dL domains.txt -o all_subdomains.txt\n\n# Use all passive sources (slower but more thorough)\nsubfinder -d example.com -all -o subdomains_all.txt\n\n# Silent mode for piping to other tools\nsubfinder -d example.com -silent | httpx -silent -status-code\n```\n\n### Step 3 — Filter and Customize Source Selection\n```bash\n# Use specific sources only\nsubfinder -d example.com -s crtsh,virustotal,shodan -o filtered.txt\n\n# Exclude specific sources\nsubfinder -d example.com -es github -o results.txt\n\n# Enable recursive subdomain enumeration\nsubfinder -d example.com -recursive -o recursive_subs.txt\n\n# Match specific patterns\nsubfinder -d example.com -m \"api,dev,staging\" -o matched.txt\n```\n\n### Step 4 — Control Rate Limiting and Output Format\n```bash\n# Rate limit to avoid API throttling\nsubfinder -d example.com -rate-limit 10 -t 5 -o rate_limited.txt\n\n# JSON output for programmatic processing\nsubfinder -d example.com -oJ -o subdomains.json\n\n# Output with source information\nsubfinder -d example.com -cs -o subdomains_with_sources.txt\n\n# Collect results in a directory per domain\nsubfinder -dL domains.txt -oD .\u002Fresults\u002F\n```\n\n### Step 5 — Validate Discovered Subdomains with httpx\n```bash\n# Pipe subfinder output to httpx for live validation\nsubfinder -d example.com -silent | httpx -silent -status-code -title -tech-detect -o live_hosts.txt\n\n# Check for specific ports\nsubfinder -d example.com -silent | httpx -ports 80,443,8080,8443 -o web_services.txt\n\n# Resolve IP addresses\nsubfinder -d example.com -silent | dnsx -a -resp -o resolved.txt\n```\n\n### Step 6 — Integrate with Broader Recon Pipeline\n```bash\n# Chain with nuclei for vulnerability scanning\nsubfinder -d example.com -silent | httpx -silent | nuclei -t cves\u002F -o vulns.txt\n\n# Combine with amass for comprehensive enumeration\nsubfinder -d example.com -o subfinder_results.txt\namass enum -passive -d example.com -o amass_results.txt\ncat subfinder_results.txt amass_results.txt | sort -u > combined_subdomains.txt\n\n# Screenshot discovered hosts\nsubfinder -d example.com -silent | httpx -silent | gowitness file -f - -P screenshots\u002F\n```\n\n## Key Concepts\n\n| Concept | Description |\n|---------|-------------|\n| Passive Enumeration | Discovering subdomains without directly querying target DNS servers |\n| Certificate Transparency | Public logs of SSL\u002FTLS certificates revealing subdomain names |\n| DNS Aggregation | Collecting subdomain data from multiple passive DNS databases |\n| Recursive Enumeration | Discovering subdomains of subdomains for deeper coverage |\n| Source Providers | External APIs and databases queried for subdomain intelligence |\n| CNAME Records | Canonical name records that may reveal additional infrastructure |\n| Wildcard DNS | DNS configuration returning results for any subdomain query |\n\n## Tools & Systems\n\n| Tool | Purpose |\n|------|---------|\n| Subfinder | Primary passive subdomain enumeration engine |\n| httpx | HTTP probe tool for validating live subdomains |\n| dnsx | DNS resolution and validation toolkit |\n| Nuclei | Template-based vulnerability scanner for discovered hosts |\n| Amass | Complementary subdomain enumeration with active\u002Fpassive modes |\n| gowitness | Web screenshot utility for visual reconnaissance |\n| Shodan | Internet-wide scanning database for subdomain intelligence |\n| crt.sh | Certificate transparency log search engine |\n\n## Common Scenarios\n\n1. **Bug Bounty Reconnaissance** — Enumerate all subdomains of a target program scope to identify forgotten or misconfigured assets that may contain vulnerabilities\n2. **Attack Surface Mapping** — Build a comprehensive inventory of externally accessible subdomains for ongoing security monitoring and risk assessment\n3. **Cloud Asset Discovery** — Identify subdomains pointing to cloud services (AWS, Azure, GCP) that may be vulnerable to subdomain takeover\n4. **CI\u002FCD Integration** — Automate subdomain monitoring in pipelines to detect new subdomains and alert on changes to the attack surface\n5. **Merger & Acquisition Due Diligence** — Map the complete external footprint of an acquisition target during security assessment\n\n## Output Format\n\n```\n## Subdomain Enumeration Report\n- **Target Domain**: example.com\n- **Total Subdomains Found**: 247\n- **Live Hosts**: 183\n- **Unique IP Addresses**: 42\n- **Sources Used**: crt.sh, VirusTotal, Shodan, SecurityTrails, Censys\n\n### Discovered Subdomains\n| Subdomain | IP Address | Status Code | Technology |\n|-----------|-----------|-------------|------------|\n| api.example.com | 10.0.1.5 | 200 | Nginx, Node.js |\n| staging.example.com | 10.0.2.10 | 403 | Apache |\n| dev.example.com | 10.0.3.15 | 200 | Express |\n\n### Recommendations\n- Remove DNS records for decommissioned subdomains\n- Investigate subdomains with CNAME pointing to unclaimed services\n- Restrict access to development and staging environments\n```\n","# Performing Subdomain Enumeration with Subfinder\n\n## When to Use\n- During the reconnaissance phase of penetration testing or bug bounty hunting\n- When mapping the external attack surface of a target organization\n- Before performing vulnerability scanning on discovered subdomains\n- When building an asset inventory for continuous security monitoring\n- During red team engagements requiring passive information gathering\n\n## Prerequisites\n- Go 1.21+ installed for building from source\n- Subfinder v2 installed (`go install -v github.com\u002Fprojectdiscovery\u002Fsubfinder\u002Fv2\u002Fcmd\u002Fsubfinder@latest`)\n- API keys configured for passive sources (Shodan, Censys, VirusTotal, SecurityTrails, Chaos)\n- Provider configuration file at `$HOME\u002F.config\u002Fsubfinder\u002Fprovider-config.yaml`\n- Network access to passive DNS and certificate transparency sources\n- httpx or httprobe for validating discovered subdomains\n\n## Workflow\n\n### Step 1 — Install and Configure Subfinder\n```bash\n# Install subfinder\ngo install -v github.com\u002Fprojectdiscovery\u002Fsubfinder\u002Fv2\u002Fcmd\u002Fsubfinder@latest\n\n# Verify installation\nsubfinder -version\n\n# Configure API keys for enhanced results\nmkdir -p $HOME\u002F.config\u002Fsubfinder\ncat > $HOME\u002F.config\u002Fsubfinder\u002Fprovider-config.yaml \u003C\u003C 'EOF'\nshodan:\n  - YOUR_SHODAN_API_KEY\ncensys:\n  - YOUR_CENSYS_API_ID:YOUR_CENSYS_API_SECRET\nvirustotal:\n  - YOUR_VT_API_KEY\nsecuritytrails:\n  - YOUR_ST_API_KEY\nchaos:\n  - YOUR_CHAOS_API_KEY\nEOF\n```\n\n### Step 2 — Run Basic Subdomain Enumeration\n```bash\n# Single domain enumeration\nsubfinder -d example.com -o subdomains.txt\n\n# Multiple domains from a file\nsubfinder -dL domains.txt -o all_subdomains.txt\n\n# Use all passive sources (slower but more thorough)\nsubfinder -d example.com -all -o subdomains_all.txt\n\n# Silent mode for piping to other tools\nsubfinder -d example.com -silent | httpx -silent -status-code\n```\n\n### Step 3 — Filter and Customize Source Selection\n```bash\n# Use specific sources only\nsubfinder -d example.com -s crtsh,virustotal,shodan -o filtered.txt\n\n# Exclude specific sources\nsubfinder -d example.com -es github -o results.txt\n\n# Enable recursive subdomain enumeration\nsubfinder -d example.com -recursive -o recursive_subs.txt\n\n# Match specific patterns\nsubfinder -d example.com -m \"api,dev,staging\" -o matched.txt\n```\n\n### Step 4 — Control Rate Limiting and Output Format\n```bash\n# Rate limit to avoid API throttling\nsubfinder -d example.com -rate-limit 10 -t 5 -o rate_limited.txt\n\n# JSON output for programmatic processing\nsubfinder -d example.com -oJ -o subdomains.json\n\n# Output with source information\nsubfinder -d example.com -cs -o subdomains_with_sources.txt\n\n# Collect results in a directory per domain\nsubfinder -dL domains.txt -oD .\u002Fresults\u002F\n```\n\n### Step 5 — Validate Discovered Subdomains with httpx\n```bash\n# Pipe subfinder output to httpx for live validation\nsubfinder -d example.com -silent | httpx -silent -status-code -title -tech-detect -o live_hosts.txt\n\n# Check for specific ports\nsubfinder -d example.com -silent | httpx -ports 80,443,8080,8443 -o web_services.txt\n\n# Resolve IP addresses\nsubfinder -d example.com -silent | dnsx -a -resp -o resolved.txt\n```\n\n### Step 6 — Integrate with Broader Recon Pipeline\n```bash\n# Chain with nuclei for vulnerability scanning\nsubfinder -d example.com -silent | httpx -silent | nuclei -t cves\u002F -o vulns.txt\n\n# Combine with amass for comprehensive enumeration\nsubfinder -d example.com -o subfinder_results.txt\namass enum -passive -d example.com -o amass_results.txt\ncat subfinder_results.txt amass_results.txt | sort -u > combined_subdomains.txt\n\n# Screenshot discovered hosts\nsubfinder -d example.com -silent | httpx -silent | gowitness file -f - -P screenshots\u002F\n```\n\n## Key Concepts\n\n| Concept | Description |\n|---------|-------------|\n| Passive Enumeration | Discovering subdomains without directly querying target DNS servers |\n| Certificate Transparency | Public logs of SSL\u002FTLS certificates revealing subdomain names |\n| DNS Aggregation | Collecting subdomain data from multiple passive DNS databases |\n| Recursive Enumeration | Discovering subdomains of subdomains for deeper coverage |\n| Source Providers | External APIs and databases queried for subdomain intelligence |\n| CNAME Records | Canonical name records that may reveal additional infrastructure |\n| Wildcard DNS | DNS configuration returning results for any subdomain query |\n\n## Tools & Systems\n\n| Tool | Purpose |\n|------|---------|\n| Subfinder | Primary passive subdomain enumeration engine |\n| httpx | HTTP probe tool for validating live subdomains |\n| dnsx | DNS resolution and validation toolkit |\n| Nuclei | Template-based vulnerability scanner for discovered hosts |\n| Amass | Complementary subdomain enumeration with active\u002Fpassive modes |\n| gowitness | Web screenshot utility for visual reconnaissance |\n| Shodan | Internet-wide scanning database for subdomain intelligence |\n| crt.sh | Certificate transparency log search engine |\n\n## Common Scenarios\n\n1. **Bug Bounty Reconnaissance** — Enumerate all subdomains of a target program scope to identify forgotten or misconfigured assets that may contain vulnerabilities\n2. **Attack Surface Mapping** — Build a comprehensive inventory of externally accessible subdomains for ongoing security monitoring and risk assessment\n3. **Cloud Asset Discovery** — Identify subdomains pointing to cloud services (AWS, Azure, GCP) that may be vulnerable to subdomain takeover\n4. **CI\u002FCD Integration** — Automate subdomain monitoring in pipelines to detect new subdomains and alert on changes to the attack surface\n5. **Merger & Acquisition Due Diligence** — Map the complete external footprint of an acquisition target during security assessment\n\n## Output Format\n\n```\n## Subdomain Enumeration Report\n- **Target Domain**: example.com\n- **Total Subdomains Found**: 247\n- **Live Hosts**: 183\n- **Unique IP Addresses**: 42\n- **Sources Used**: crt.sh, VirusTotal, Shodan, SecurityTrails, Censys\n\n### Discovered Subdomains\n| Subdomain | IP Address | Status Code | Technology |\n|-----------|-----------|-------------|------------|\n| api.example.com | 10.0.1.5 | 200 | Nginx, Node.js |\n| staging.example.com | 10.0.2.10 | 403 | Apache |\n| dev.example.com | 10.0.3.15 | 200 | Express |\n\n### Recommendations\n- Remove DNS records for decommissioned subdomains\n- Investigate subdomains with CNAME pointing to unclaimed services\n- Restrict access to development and staging environments\n```\n",{"name":5,"tags":44,"capec":49,"model":24,"tools":50,"domain":32,"maxTurns":54,"nist_csf":55,"subdomain":23,"description":7,"mitre_attack":60},[45,46,47,36,21,34,48],"subdomain-enumeration","reconnaissance","bug-bounty","osint",[],[51,31,52,53],"Read","Glob","Grep",20,[56,57,58,59],"PR.PS-01","ID.RA-01","PR.DS-10","DE.CM-01",[61,62,63,64],"T1046","T1593","T1595","T1595.002","main","a91f1293287ffa9f4f1b8f486cd6e835a1568c84","skills\u002Fnetwork\u002Fdns\u002Fsubfinder\u002Fexploit","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace","https:\u002F\u002Fgithub.com\u002FDCx7C5","#Python","2026-09-01 11:21:00",{"source":8,"skillName":5,"commands":73,"prompt":83,"zipAvailable":84},[74,77,80],{"tool":75,"command":76},"npx","npx skills add DCx7C5\u002Fai-marketplace --skill dns-subfinder-exploit",{"tool":78,"command":79},"bunx","bunx skills add DCx7C5\u002Fai-marketplace --skill dns-subfinder-exploit",{"tool":81,"command":82},"pnpm","pnpm dlx skills add DCx7C5\u002Fai-marketplace --skill dns-subfinder-exploit","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fnetwork\u002Fdns\u002Fsubfinder\u002Fexploit\u002FSKILL.md",true,[86],{"path":87,"resourceType":88,"resourceTypeDesc":89,"sizeBytes":90,"sourceHtmlUrl":91},"index.json","REFERENCE","参考文档",634,"https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fnetwork\u002Fdns\u002Fsubfinder\u002Fexploit\u002Findex.json",[93,116,136,157,179,195],{"skillNo":94,"name":95,"nameZh":6,"description":96,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":97,"categories":98,"keywords":99,"publishedAt":39},"01M71HAPZ01KQ30RKTB0FFSQ05","services-wmi-persistence-detect","Detect WMI event subscription persistence by enumerating ActiveScriptEventConsumer, CommandLineEventConsumer, and permanent subscriptions in the WMI repository.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fservices\u002Fwmi\u002Fpersistence\u002Fdetect\u002FSKILL.md",[],[100,101,102,103,104,29,37,105,106,107,108,109,110,111,112,113,114,32,115],"services","detect","services wmi persistence detect","wmi","persistence","process","activescript","event","subscriptions","commandline-consumer","repository","subscription","event-subscription","t1546.003","forensics","process-forensics",{"skillNo":117,"name":118,"nameZh":6,"description":119,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":120,"categories":121,"keywords":122,"publishedAt":39},"01M71HAK6JTTTS229T17WJMMCG","services-wmi-exec-exploit","Perform lateral movement across Windows networks using WMI-based remote execution techniques including Impacket wmiexec.py, CrackMapExec, and native WMI commands for stealthy post-exploitation during red team engagements.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fservices\u002Fwmi\u002Fexec\u002Fexploit\u002FSKILL.md",[],[19,100,123,103,124,125,126,32,31,127,128,129,130,131,29,132,133,28,134,135],"services wmi exec exploit","exec","remote","traffic","analysis","team","across","crackmapexec","native","command","lateral movement","lateral-movement","Impacket",{"skillNo":137,"name":138,"nameZh":6,"description":139,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":140,"categories":141,"keywords":142,"publishedAt":39},"01M71HAG6MHKNQV8KDZKMT4886","registry-artifact-extract","Extract and analyze Windows Registry hives to uncover user activity, installed software, autostart entries, and evidence of system compromise.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fregistry\u002Fartifact\u002Fextract\u002FSKILL.md",[],[143,144,145,146,147,148,32,31,149,127,150,151,29,28,152,153,154,155,156,24],"artifact","registry","registry artifact extract","extract","evidence-collection","artifact-analysis","collection","analyze","uncover","software","activity","digital-forensics","windows-registry","regripper",{"skillNo":158,"name":159,"nameZh":6,"description":160,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":161,"categories":162,"keywords":163,"publishedAt":39},"01M71HACR4A8XTWTTSXK4124AA","processes-token-impersonate-detect","Detect Windows token impersonation and privilege abuse including SeImpersonatePrivilege exploitation via Potato attacks and token stealing techniques.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fprocesses\u002Ftoken\u002Fimpersonate\u002Fdetect\u002FSKILL.md",[],[101,164,165,166,167,168,169,37,170,32,115,171,172,173,174,175,176,177,178,29],"processes token impersonate detect","token","processes","attacks","windows","escalation","techniques","privilege-escalation","seimpersonate","token-impersonation","printspoofer","exploitation","potato","impersonation","via",{"skillNo":180,"name":181,"nameZh":6,"description":182,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":183,"categories":184,"keywords":185,"publishedAt":39},"01M71HAABSB4Z6QFSXEG00R4RK","processes-thread-injection-detect","Detect Windows thread injection techniques including CreateRemoteThread, QueueUserAPC, NtCreateThreadEx, and thread hijacking via process memory analysis.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fprocesses\u002Fthread\u002Finjection\u002Fdetect\u002FSKILL.md",[],[186,187,101,188,166,168,189,37,190,170,32,115,127,191,192,193,194,178,29,105],"thread","processes thread injection detect","injection","memory","process-injection","api","apc-injection","thread-injection","nt-api",{"skillNo":196,"name":197,"nameZh":6,"description":198,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":199,"categories":200,"keywords":201,"publishedAt":39},"01M71HA7H311V5G14WMX58HQSS","processes-hollow-technique-detect","Detect process hollowing (RunPE) by identifying processes with mismatched image paths between PEB and VAD tree, or unmapped PE headers in memory.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fprocesses\u002Fhollow\u002Ftechnique\u002Fdetect\u002FSKILL.md",[],[202,101,166,203,189,37,204,205,32,115,206,207,208,209,210,211,29,105,212,213],"processes hollow technique detect","tree","memory-forensics","process-hollow","peb","runpe","image","pe-header","in memory","with","mismatched","headers"]