[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M71FR52DBGESNZXBBVTQWPCC":3,"skill-same:01M71FR52DBGESNZXBBVTQWPCC":93},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":18,"publishedAt":39,"linkOnly":40,"markdownContent":41,"markdownBody":42,"frontMatter":43,"refName":66,"commitSha":67,"skillDirectory":68,"forksCount":14,"repositoryHtmlUrl":69,"repositoryHomepageUrl":6,"ownerHtmlUrl":70,"ownerBlogUrl":6,"ownerDescription":71,"updatedAt":72,"install":73,"resources":86},"01M71FR52DBGESNZXBBVTQWPCC","recon-easm-exploit",null,"Implements external attack surface management (EASM) using Shodan, Censys, and ProjectDiscovery tools (subfinder, httpx, nuclei) for asset discovery, subdomain enumeration, service fingerprinting, and exposure scoring. Includes a weighted risk scoring algorithm based on OWASP attack surface analysis methodology and the Relative Attack Surface Quotient (RSQ). Use when building continuous ASM programs or performing external reconnaissance for security assessments.","DCx7C5\u002Fai-marketplace","DCx7C5","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F42419559?v=4","01M71C01G2AZV3NTNGWAWSHJPP","DC","01M71C01GQW6G50S2BYMS7PP3E",0,"MIT","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fnetwork\u002Frecon\u002Feasm\u002Fexploit\u002FSKILL.md",[],[19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38],"exploit","recon easm exploit","recon","attack surface management","security","risk scoring","asset","owasp","read","de","exposure","fingerprinting","subdomain","scoring","analysis","Bash","when","cybersecurity","attack-surface","asset-discovery","2026-11-10 10:12:30",false,"---\nname: recon-easm-exploit\ndescription: Implements external attack surface management (EASM) using Shodan, Censys, and ProjectDiscovery tools (subfinder, httpx, nuclei) for asset discovery, subdomain enumeration, service fingerprinting, and exposure scoring. Includes a weighted risk scoring algorithm based on OWASP attack surface analysis methodology and the Relative Attack Surface Quotient (RSQ). Use when building continuous ASM programs or performing external reconnaissance for security assessments.\ndomain: cybersecurity\nsubdomain: offensive-security\ntags:\n- attack-surface\n- reconnaissance\n- shodan\n- censys\n- subfinder\n- nuclei\n- asset-discovery\nnist_csf:\n- ID.RA-01\n- GV.OV-02\n- DE.AE-07\nmodel: sonnet\nmaxTurns: 20\ntools: [Read, Bash, Glob, Grep]\nmitre_attack:\n- T1082\n- T1595\n- T1595.002\ncapec: []\n---\n\n# Implementing Attack Surface Management\n\n## When to Use\n\n- When building an external attack surface management (EASM) program from scratch\n- When performing authorized external reconnaissance for penetration testing engagements\n- When continuously monitoring organizational exposure across internet-facing assets\n- When scoring and prioritizing external attack surface risks for remediation\n- When integrating multiple discovery tools into an automated ASM pipeline\n\n## Prerequisites\n\n- Python 3.8+ with requests, shodan, censys libraries installed\n- Shodan API key (free tier provides 100 queries\u002Fmonth)\n- Censys API ID and Secret (free tier available)\n- ProjectDiscovery tools installed: subfinder, httpx, nuclei\n- Go 1.21+ for building ProjectDiscovery tools from source\n- Appropriate authorization for all external scanning activities\n- Target domains and IP ranges with written scope documentation\n\n## Instructions\n\n### Phase 1: Subdomain Enumeration with Multiple Sources\n\nUse subfinder for passive subdomain discovery leveraging dozens of data sources\nincluding certificate transparency logs, DNS datasets, and search engines.\n\n```bash\n# Install ProjectDiscovery tools\ngo install -v github.com\u002Fprojectdiscovery\u002Fsubfinder\u002Fv2\u002Fcmd\u002Fsubfinder@latest\ngo install -v github.com\u002Fprojectdiscovery\u002Fhttpx\u002Fcmd\u002Fhttpx@latest\ngo install -v github.com\u002Fprojectdiscovery\u002Fnuclei\u002Fv3\u002Fcmd\u002Fnuclei@latest\n\n# Basic subdomain enumeration\nsubfinder -d example.com -o subdomains.txt\n\n# Verbose with all sources and recursive enumeration\nsubfinder -d example.com -all -recursive -o subdomains_full.txt\n\n# Multi-domain enumeration from file\nsubfinder -dL domains.txt -o all_subdomains.txt\n\n# Using OWASP Amass for deeper enumeration\namass enum -d example.com -passive -o amass_subdomains.txt\n\n# Merge and deduplicate results\ncat subdomains.txt amass_subdomains.txt | sort -u > combined_subdomains.txt\n```\n\n### Phase 2: Live Host Discovery and Service Fingerprinting\n\nProbe discovered subdomains to identify live hosts, technologies, and services.\n\n```bash\n# HTTP probing with technology detection\ncat combined_subdomains.txt | httpx -sc -cl -ct -title -tech-detect \\\n    -follow-redirects -json -o httpx_results.json\n\n# Detailed service fingerprinting\ncat combined_subdomains.txt | httpx -sc -cl -ct -title -tech-detect \\\n    -favicon -hash sha256 -jarm -cdn -cname \\\n    -follow-redirects -json -o httpx_detailed.json\n```\n\n### Phase 3: Shodan Asset Discovery\n\nQuery Shodan for exposed services, open ports, and known vulnerabilities\nassociated with discovered assets.\n\n```python\nimport shodan\n\napi = shodan.Shodan(\"YOUR_SHODAN_API_KEY\")\n\n# Search by organization\nresults = api.search(\"org:\\\"Example Corp\\\"\")\nfor service in results[\"matches\"]:\n    print(f\"{service['ip_str']}:{service['port']} - {service.get('product', 'unknown')}\")\n    if service.get(\"vulns\"):\n        for cve in service[\"vulns\"]:\n            print(f\"  CVE: {cve}\")\n\n# Search by hostname\nresults = api.search(\"hostname:example.com\")\n\n# Search by SSL certificate\nresults = api.search(\"ssl.cert.subject.cn:example.com\")\n\n# Get host details with all services\nhost = api.host(\"93.184.216.34\")\nprint(f\"IP: {host['ip_str']}\")\nprint(f\"Ports: {host['ports']}\")\nprint(f\"Vulns: {host.get('vulns', [])}\")\n```\n\n### Phase 4: Censys Asset Discovery\n\nUse Censys to discover internet-facing assets through certificate and host search.\n\n```python\nfrom censys.search import CensysHosts, CensysCerts\n\n# Host search\nhosts = CensysHosts()\nquery = hosts.search(\"services.tls.certificates.leaf.subject.common_name: example.com\")\nfor page in query:\n    for host in page:\n        print(f\"IP: {host['ip']}\")\n        for service in host.get(\"services\", []):\n            print(f\"  Port: {service['port']} Protocol: {service['transport_protocol']}\")\n            print(f\"  Service: {service.get('service_name', 'unknown')}\")\n\n# Certificate transparency search\ncerts = CensysCerts()\nquery = certs.search(\"parsed.names: example.com\")\nfor page in query:\n    for cert in page:\n        print(f\"Fingerprint: {cert['fingerprint_sha256']}\")\n        print(f\"Names: {cert.get('parsed', {}).get('names', [])}\")\n```\n\n### Phase 5: Vulnerability Scanning with Nuclei\n\nRun targeted vulnerability scans against discovered assets using Nuclei templates.\n\n```bash\n# Update nuclei plugins\nnuclei -ut\n\n# Scan with all plugins\ncat combined_subdomains.txt | httpx -silent | nuclei -o nuclei_results.txt\n\n# Scan with specific severity\ncat combined_subdomains.txt | httpx -silent | \\\n    nuclei -severity critical,high -o critical_findings.txt\n\n# Scan with specific template categories\ncat combined_subdomains.txt | httpx -silent | \\\n    nuclei -tags cve,misconfig,exposure -o categorized_findings.txt\n\n# Scan for exposed panels and sensitive files\ncat combined_subdomains.txt | httpx -silent | \\\n    nuclei -tags panel,exposure,config -o exposed_panels.txt\n```\n\n### Phase 6: Exposure Scoring Algorithm\n\nScore each asset based on OWASP attack surface analysis principles, using\na weighted formula derived from the Relative Attack Surface Quotient (RSQ)\nand damage-potential-to-effort ratio.\n\nThe scoring algorithm considers:\n1. **Open ports and services** - weighted by service risk (management ports score higher)\n2. **Known vulnerabilities** - weighted by CVSS score\n3. **Technology age** - outdated software increases score\n4. **Exposure level** - internet-facing vs. authenticated access\n5. **Data sensitivity** - based on service type and content indicators\n\n```python\n# Exposure Score = sum of weighted factors, normalized to 0-100\n# See agent.py for the full implementation\n```\n\n## Examples\n\n```bash\n# Run complete ASM pipeline against a target domain\npython agent.py \\\n    --domain example.com \\\n    --action full_scan \\\n    --shodan-key YOUR_KEY \\\n    --censys-id YOUR_ID \\\n    --censys-secret YOUR_SECRET \\\n    --output asm_report.json\n\n# Subdomain enumeration only\npython agent.py \\\n    --domain example.com \\\n    --action enumerate \\\n    --output subdomains.json\n\n# Exposure scoring on previously discovered assets\npython agent.py \\\n    --domain example.com \\\n    --action score \\\n    --input previous_scan.json \\\n    --output scored_assets.json\n\n# Multi-domain scan from file\npython agent.py \\\n    --domain-list targets.txt \\\n    --action full_scan \\\n    --output multi_domain_report.json\n```\n","# Implementing Attack Surface Management\n\n## When to Use\n\n- When building an external attack surface management (EASM) program from scratch\n- When performing authorized external reconnaissance for penetration testing engagements\n- When continuously monitoring organizational exposure across internet-facing assets\n- When scoring and prioritizing external attack surface risks for remediation\n- When integrating multiple discovery tools into an automated ASM pipeline\n\n## Prerequisites\n\n- Python 3.8+ with requests, shodan, censys libraries installed\n- Shodan API key (free tier provides 100 queries\u002Fmonth)\n- Censys API ID and Secret (free tier available)\n- ProjectDiscovery tools installed: subfinder, httpx, nuclei\n- Go 1.21+ for building ProjectDiscovery tools from source\n- Appropriate authorization for all external scanning activities\n- Target domains and IP ranges with written scope documentation\n\n## Instructions\n\n### Phase 1: Subdomain Enumeration with Multiple Sources\n\nUse subfinder for passive subdomain discovery leveraging dozens of data sources\nincluding certificate transparency logs, DNS datasets, and search engines.\n\n```bash\n# Install ProjectDiscovery tools\ngo install -v github.com\u002Fprojectdiscovery\u002Fsubfinder\u002Fv2\u002Fcmd\u002Fsubfinder@latest\ngo install -v github.com\u002Fprojectdiscovery\u002Fhttpx\u002Fcmd\u002Fhttpx@latest\ngo install -v github.com\u002Fprojectdiscovery\u002Fnuclei\u002Fv3\u002Fcmd\u002Fnuclei@latest\n\n# Basic subdomain enumeration\nsubfinder -d example.com -o subdomains.txt\n\n# Verbose with all sources and recursive enumeration\nsubfinder -d example.com -all -recursive -o subdomains_full.txt\n\n# Multi-domain enumeration from file\nsubfinder -dL domains.txt -o all_subdomains.txt\n\n# Using OWASP Amass for deeper enumeration\namass enum -d example.com -passive -o amass_subdomains.txt\n\n# Merge and deduplicate results\ncat subdomains.txt amass_subdomains.txt | sort -u > combined_subdomains.txt\n```\n\n### Phase 2: Live Host Discovery and Service Fingerprinting\n\nProbe discovered subdomains to identify live hosts, technologies, and services.\n\n```bash\n# HTTP probing with technology detection\ncat combined_subdomains.txt | httpx -sc -cl -ct -title -tech-detect \\\n    -follow-redirects -json -o httpx_results.json\n\n# Detailed service fingerprinting\ncat combined_subdomains.txt | httpx -sc -cl -ct -title -tech-detect \\\n    -favicon -hash sha256 -jarm -cdn -cname \\\n    -follow-redirects -json -o httpx_detailed.json\n```\n\n### Phase 3: Shodan Asset Discovery\n\nQuery Shodan for exposed services, open ports, and known vulnerabilities\nassociated with discovered assets.\n\n```python\nimport shodan\n\napi = shodan.Shodan(\"YOUR_SHODAN_API_KEY\")\n\n# Search by organization\nresults = api.search(\"org:\\\"Example Corp\\\"\")\nfor service in results[\"matches\"]:\n    print(f\"{service['ip_str']}:{service['port']} - {service.get('product', 'unknown')}\")\n    if service.get(\"vulns\"):\n        for cve in service[\"vulns\"]:\n            print(f\"  CVE: {cve}\")\n\n# Search by hostname\nresults = api.search(\"hostname:example.com\")\n\n# Search by SSL certificate\nresults = api.search(\"ssl.cert.subject.cn:example.com\")\n\n# Get host details with all services\nhost = api.host(\"93.184.216.34\")\nprint(f\"IP: {host['ip_str']}\")\nprint(f\"Ports: {host['ports']}\")\nprint(f\"Vulns: {host.get('vulns', [])}\")\n```\n\n### Phase 4: Censys Asset Discovery\n\nUse Censys to discover internet-facing assets through certificate and host search.\n\n```python\nfrom censys.search import CensysHosts, CensysCerts\n\n# Host search\nhosts = CensysHosts()\nquery = hosts.search(\"services.tls.certificates.leaf.subject.common_name: example.com\")\nfor page in query:\n    for host in page:\n        print(f\"IP: {host['ip']}\")\n        for service in host.get(\"services\", []):\n            print(f\"  Port: {service['port']} Protocol: {service['transport_protocol']}\")\n            print(f\"  Service: {service.get('service_name', 'unknown')}\")\n\n# Certificate transparency search\ncerts = CensysCerts()\nquery = certs.search(\"parsed.names: example.com\")\nfor page in query:\n    for cert in page:\n        print(f\"Fingerprint: {cert['fingerprint_sha256']}\")\n        print(f\"Names: {cert.get('parsed', {}).get('names', [])}\")\n```\n\n### Phase 5: Vulnerability Scanning with Nuclei\n\nRun targeted vulnerability scans against discovered assets using Nuclei templates.\n\n```bash\n# Update nuclei plugins\nnuclei -ut\n\n# Scan with all plugins\ncat combined_subdomains.txt | httpx -silent | nuclei -o nuclei_results.txt\n\n# Scan with specific severity\ncat combined_subdomains.txt | httpx -silent | \\\n    nuclei -severity critical,high -o critical_findings.txt\n\n# Scan with specific template categories\ncat combined_subdomains.txt | httpx -silent | \\\n    nuclei -tags cve,misconfig,exposure -o categorized_findings.txt\n\n# Scan for exposed panels and sensitive files\ncat combined_subdomains.txt | httpx -silent | \\\n    nuclei -tags panel,exposure,config -o exposed_panels.txt\n```\n\n### Phase 6: Exposure Scoring Algorithm\n\nScore each asset based on OWASP attack surface analysis principles, using\na weighted formula derived from the Relative Attack Surface Quotient (RSQ)\nand damage-potential-to-effort ratio.\n\nThe scoring algorithm considers:\n1. **Open ports and services** - weighted by service risk (management ports score higher)\n2. **Known vulnerabilities** - weighted by CVSS score\n3. **Technology age** - outdated software increases score\n4. **Exposure level** - internet-facing vs. authenticated access\n5. **Data sensitivity** - based on service type and content indicators\n\n```python\n# Exposure Score = sum of weighted factors, normalized to 0-100\n# See agent.py for the full implementation\n```\n\n## Examples\n\n```bash\n# Run complete ASM pipeline against a target domain\npython agent.py \\\n    --domain example.com \\\n    --action full_scan \\\n    --shodan-key YOUR_KEY \\\n    --censys-id YOUR_ID \\\n    --censys-secret YOUR_SECRET \\\n    --output asm_report.json\n\n# Subdomain enumeration only\npython agent.py \\\n    --domain example.com \\\n    --action enumerate \\\n    --output subdomains.json\n\n# Exposure scoring on previously discovered assets\npython agent.py \\\n    --domain example.com \\\n    --action score \\\n    --input previous_scan.json \\\n    --output scored_assets.json\n\n# Multi-domain scan from file\npython agent.py \\\n    --domain-list targets.txt \\\n    --action full_scan \\\n    --output multi_domain_report.json\n```\n",{"name":5,"tags":44,"capec":50,"model":51,"tools":52,"domain":36,"maxTurns":56,"nist_csf":57,"subdomain":61,"description":7,"mitre_attack":62},[37,45,46,47,48,49,38],"reconnaissance","shodan","censys","subfinder","nuclei",[],"sonnet",[53,34,54,55],"Read","Glob","Grep",20,[58,59,60],"ID.RA-01","GV.OV-02","DE.AE-07","offensive-security",[63,64,65],"T1082","T1595","T1595.002","main","a91f1293287ffa9f4f1b8f486cd6e835a1568c84","skills\u002Fnetwork\u002Frecon\u002Feasm\u002Fexploit","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace","https:\u002F\u002Fgithub.com\u002FDCx7C5","#Python","2026-09-01 11:21:00",{"source":8,"skillName":5,"commands":74,"prompt":84,"zipAvailable":85},[75,78,81],{"tool":76,"command":77},"npx","npx skills add DCx7C5\u002Fai-marketplace --skill recon-easm-exploit",{"tool":79,"command":80},"bunx","bunx skills add DCx7C5\u002Fai-marketplace --skill recon-easm-exploit",{"tool":82,"command":83},"pnpm","pnpm dlx skills add DCx7C5\u002Fai-marketplace --skill recon-easm-exploit","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fnetwork\u002Frecon\u002Feasm\u002Fexploit\u002FSKILL.md",true,[87],{"path":88,"resourceType":89,"resourceTypeDesc":90,"sizeBytes":91,"sourceHtmlUrl":92},"index.json","REFERENCE","参考文档",669,"https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fnetwork\u002Frecon\u002Feasm\u002Fexploit\u002Findex.json",[94,118,137,158,180,196],{"skillNo":95,"name":96,"nameZh":6,"description":97,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":98,"categories":99,"keywords":100,"publishedAt":39},"01M71HAPZ01KQ30RKTB0FFSQ05","services-wmi-persistence-detect","Detect WMI event subscription persistence by enumerating ActiveScriptEventConsumer, CommandLineEventConsumer, and permanent subscriptions in the WMI repository.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fservices\u002Fwmi\u002Fpersistence\u002Fdetect\u002FSKILL.md",[],[101,102,103,104,105,28,106,107,108,109,110,111,112,113,114,115,116,36,117],"services","detect","services wmi persistence detect","wmi","persistence","cm","process","activescript","event","subscriptions","commandline-consumer","repository","subscription","event-subscription","t1546.003","forensics","process-forensics",{"skillNo":119,"name":120,"nameZh":6,"description":121,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":122,"categories":123,"keywords":124,"publishedAt":39},"01M71HAK6JTTTS229T17WJMMCG","services-wmi-exec-exploit","Perform lateral movement across Windows networks using WMI-based remote execution techniques including Impacket wmiexec.py, CrackMapExec, and native WMI commands for stealthy post-exploitation during red team engagements.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fservices\u002Fwmi\u002Fexec\u002Fexploit\u002FSKILL.md",[],[19,101,125,104,126,127,128,36,34,33,129,130,131,132,28,133,134,27,135,136],"services wmi exec exploit","exec","remote","traffic","team","across","crackmapexec","native","command","lateral movement","lateral-movement","Impacket",{"skillNo":138,"name":139,"nameZh":6,"description":140,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":141,"categories":142,"keywords":143,"publishedAt":39},"01M71HAG6MHKNQV8KDZKMT4886","registry-artifact-extract","Extract and analyze Windows Registry hives to uncover user activity, installed software, autostart entries, and evidence of system compromise.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fregistry\u002Fartifact\u002Fextract\u002FSKILL.md",[],[144,145,146,147,148,149,36,34,150,33,151,152,28,27,153,154,155,156,157,51],"artifact","registry","registry artifact extract","extract","evidence-collection","artifact-analysis","collection","analyze","uncover","software","activity","digital-forensics","windows-registry","regripper",{"skillNo":159,"name":160,"nameZh":6,"description":161,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":162,"categories":163,"keywords":164,"publishedAt":39},"01M71HACR4A8XTWTTSXK4124AA","processes-token-impersonate-detect","Detect Windows token impersonation and privilege abuse including SeImpersonatePrivilege exploitation via Potato attacks and token stealing techniques.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fprocesses\u002Ftoken\u002Fimpersonate\u002Fdetect\u002FSKILL.md",[],[102,165,166,167,168,169,170,106,171,36,117,172,173,174,175,176,177,178,179,28],"processes token impersonate detect","token","processes","attacks","windows","escalation","techniques","privilege-escalation","seimpersonate","token-impersonation","printspoofer","exploitation","potato","impersonation","via",{"skillNo":181,"name":182,"nameZh":6,"description":183,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":184,"categories":185,"keywords":186,"publishedAt":39},"01M71HAABSB4Z6QFSXEG00R4RK","processes-thread-injection-detect","Detect Windows thread injection techniques including CreateRemoteThread, QueueUserAPC, NtCreateThreadEx, and thread hijacking via process memory analysis.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fprocesses\u002Fthread\u002Finjection\u002Fdetect\u002FSKILL.md",[],[187,188,102,189,167,169,190,106,191,171,36,117,33,192,193,194,195,179,28,107],"thread","processes thread injection detect","injection","memory","process-injection","api","apc-injection","thread-injection","nt-api",{"skillNo":197,"name":198,"nameZh":6,"description":199,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":200,"categories":201,"keywords":202,"publishedAt":39},"01M71HA7H311V5G14WMX58HQSS","processes-hollow-technique-detect","Detect process hollowing (RunPE) by identifying processes with mismatched image paths between PEB and VAD tree, or unmapped PE headers in memory.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fprocesses\u002Fhollow\u002Ftechnique\u002Fdetect\u002FSKILL.md",[],[203,102,167,204,190,106,205,206,36,117,207,208,209,210,211,212,28,107,213,214],"processes hollow technique detect","tree","memory-forensics","process-hollow","peb","runpe","image","pe-header","in memory","with","mismatched","headers"]