[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M71FRRSCAR44BP76KTQV3PQT":3,"skill-same:01M71FRRSCAR44BP76KTQV3PQT":97},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":23,"publishedAt":44,"linkOnly":45,"markdownContent":46,"markdownBody":47,"frontMatter":48,"refName":70,"commitSha":71,"skillDirectory":72,"forksCount":14,"repositoryHtmlUrl":73,"repositoryHomepageUrl":6,"ownerHtmlUrl":74,"ownerBlogUrl":6,"ownerDescription":75,"updatedAt":76,"install":77,"resources":90},"01M71FRRSCAR44BP76KTQV3PQT","security-monitoring-deploy",null,"Network forensic reconnaissance. Active connection inventory, suspicious listeners, routing anomalies, DNS\u002FmDNS analysis, ARP cache poisoning detection, firewall rule audit, and IOC infrastructure correlation.","DCx7C5\u002Fai-marketplace","DCx7C5","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F42419559?v=4","01M71C01G2AZV3NTNGWAWSHJPP","DC","01M71C01GQW6G50S2BYMS7PP3E",0,"MIT","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fnetwork\u002Fsecurity\u002Fmonitoring\u002Fdeploy\u002FSKILL.md",[18],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000011","运维与部署","SCENARIO","使用场景",[24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43],"monitoring","security","deploy","security monitoring deploy","listeners","suspicious","mitre-attack","websearch","dns","analysis","Bash","tls","network-recon","monitoring2","inventory","memory","sslkeylog","recon","firewall","shared","2026-11-10 10:12:30",false,"---\nname: security-monitoring-deploy\ndescription: Network forensic reconnaissance. Active connection inventory, suspicious listeners, routing anomalies, DNS\u002FmDNS analysis, ARP cache poisoning detection, firewall rule audit, and IOC infrastructure correlation.\nmodel: sonnet\nmaxTurns: 30\ntools:\n  - Read\n  - Bash\n  - Glob\n  - Grep\n  - WebSearch\n  - WebFetch\nskills:\n  - shared-memory\n  - tls\u002Fsslkeylog\n  - threats\u002Fmitre-attack-mapper\ntags:\n- network\n- monitoring2\n- network-recon\nmitre_attack:\n- T1059\n- T1071\n- T1562.004\n- T1595\nnist_csf: []\ncapec: []\n---\n\n# Network Recon\n\n**Purpose:** Rapid network-state triage with IOC-first correlation. Establishes connection baseline, detects C2 channels, identifies rogue listeners, and maps network anomalies to MITRE techniques.\n\n---\n\n## Core Focus Areas\n\n- **Active connections**: TCP\u002FUDP state, established\u002Flistening inventory, raw socket holders\n- **Suspicious listeners**: Unexpected ports, listeners bound to `0.0.0.0`, unusual services\n- **DNS anomalies**: Unusual resolvers, DNS tunneling patterns, mDNS\u002FLLMNR abuse\n- **ARP\u002FMAC layer**: ARP cache poisoning, duplicate MAC addresses, MITM indicators\n- **Routing anomalies**: Unexpected routes, policy routing, tunnel interfaces\n- **Firewall audit**: iptables\u002Fnftables\u002Fufw rule gaps, unexpected ACCEPTs\n- **IOC correlation**: Match active connections and DNS queries against known-bad infrastructure\n- **Wireless**: Rogue AP detection, promiscuous mode interfaces, monitor interfaces\n\n---\n\n## Key Techniques & Tools\n\n### Connection Inventory\n```bash\n# All TCP\u002FUDP connections with process info\nss -tulpn 2>\u002Fdev\u002Fnull\nss -tulpna 2>\u002Fdev\u002Fnull | sort -k5 | head -50\n\n# Established connections (potential C2)\nss -tnp state established 2>\u002Fdev\u002Fnull | \\\n  awk 'NR>1 {print $5, $6, $7}' | sort | uniq -c | sort -rn | head -20\n\n# Raw socket holders (packet capture \u002F injection capability)\nss -a --raw 2>\u002Fdev\u002Fnull | head -10\n\n# Connections on non-standard high ports\nss -tnp state established 2>\u002Fdev\u002Fnull | \\\n  awk 'NR>1 && $5 ~ \u002F:[0-9]+$\u002F {port=$5; sub(\u002F.*:\u002F,\"\",port); if(port+0>1024 && port+0!=443 && port+0!=80) print}' | \\\n  sort | uniq -c | sort -rn | head -20\n\n# netstat for legacy compatibility\nnetstat -tulpn 2>\u002Fdev\u002Fnull | head -30\n```\n\n### IOC Infrastructure Correlation\n```bash\n# Extract all remote IPs from established connections\nREMOTE_IPS=$(ss -tnp state established 2>\u002Fdev\u002Fnull | \\\n  awk 'NR>1 {ip=$5; sub(\u002F:[^:]*$\u002F,\"\",ip); print ip}' | sort -u)\n\n# Lookup each IP against IOC database\nfor ip in $REMOTE_IPS; do\n  result=$(grep -r \"$ip\" .\u002Fcybersec-shared\u002Fintelligence\u002Fioc-db.md 2>\u002Fdev\u002Fnull | head -1)\n  [ -n \"$result\" ] && echo \"IOC MATCH: $ip → $result\"\ndone\n\n# Reverse DNS lookup for all remote IPs\necho \"$REMOTE_IPS\" | while read ip; do\n  host \"$ip\" 2>\u002Fdev\u002Fnull | grep \"domain name\" | head -1\ndone\n\n# GeoIP \u002F ASN lookup (requires geoiplookup or similar)\necho \"$REMOTE_IPS\" | while read ip; do\n  geoiplookup \"$ip\" 2>\u002Fdev\u002Fnull | head -1\ndone\n```\n\n### DNS Analysis\n```bash\n# Current DNS resolver configuration\ncat \u002Fetc\u002Fresolv.conf 2>\u002Fdev\u002Fnull\nsystemd-resolve --status 2>\u002Fdev\u002Fnull | grep -E \"(DNS Servers|DNSSEC|Link)\" | head -10\n\n# Active DNS queries (requires tcpdump or sshdump)\nsudo tcpdump -i any -c 200 -n 'port 53' 2>\u002Fdev\u002Fnull | \\\n  awk 'NF && \u002FA\\?|AAAA\\?|TXT\\?|MX\\?\u002F' | sort | uniq -c | sort -rn | head -30\n\n# DNS cache inspection\nsystemd-resolve --statistics 2>\u002Fdev\u002Fnull\nresolvectl query --cache=yes google.com 2>\u002Fdev\u002Fnull\n\n# Long\u002Fhigh-entropy subdomains (DNS tunneling indicator)\nsudo tcpdump -i any -c 500 -n 'port 53' 2>\u002Fdev\u002Fnull | \\\n  grep -oE '[a-zA-Z0-9_-]{25,}\\.[a-zA-Z0-9_.-]+' | sort | uniq -c | sort -rn | head -10\n\n# mDNS\u002FLLMNR traffic (lateral movement via name resolution)\nsudo tcpdump -i any -c 100 -n 'port 5353 or port 5355' 2>\u002Fdev\u002Fnull | head -20\n```\n\n### ARP & MAC Layer\n```bash\n# ARP cache — look for duplicate IPs or gateway MAC changes\narp -n 2>\u002Fdev\u002Fnull\nip neigh show 2>\u002Fdev\u002Fnull\n\n# Detect ARP cache poisoning (same IP, multiple MACs or vice versa)\narp -n 2>\u002Fdev\u002Fnull | awk 'NR>1 {print $3}' | sort | uniq -d | \\\n  while read mac; do\n    echo \"DUPLICATE MAC: $mac\"\n    arp -n | grep \"$mac\"\n  done\n\n# Monitor for ARP changes (static watch)\nip -s neigh 2>\u002Fdev\u002Fnull | grep \"STALE\\|FAILED\" | head -10\n\n# Promiscuous mode interfaces (packet capture risk)\nip link 2>\u002Fdev\u002Fnull | grep PROMISC\n```\n\n### Routing & Interfaces\n```bash\n# Full routing table\nip route show table all 2>\u002Fdev\u002Fnull | head -30\n\n# Policy routing (potential traffic interception)\nip rule list 2>\u002Fdev\u002Fnull\n\n# Tunnel interfaces (potential exfil or C2)\nip link show type gre 2>\u002Fdev\u002Fnull\nip link show type tun 2>\u002Fdev\u002Fnull\nip link show type wireguard 2>\u002Fdev\u002Fnull\nip tunnel show 2>\u002Fdev\u002Fnull\n\n# Interfaces in unexpected states\nip link 2>\u002Fdev\u002Fnull | grep -E \"UNKNOWN|DORMANT|PROMISC|ALLMULTI\"\n\n# IPv6 — check for unexpected global addresses (privacy leak)\nip -6 addr show 2>\u002Fdev\u002Fnull | grep \"global\"\n```\n\n### Firewall Audit\n```bash\n# iptables rules (all tables)\nsudo iptables-save 2>\u002Fdev\u002Fnull | grep -v \"^#\"\nsudo ip6tables-save 2>\u002Fdev\u002Fnull | grep -v \"^#\"\n\n# nftables (modern replacement)\nsudo nft list ruleset 2>\u002Fdev\u002Fnull\n\n# ufw status\nsudo ufw status verbose 2>\u002Fdev\u002Fnull\n\n# Check for ACCEPT all rules (dangerous)\nsudo iptables -L -n -v 2>\u002Fdev\u002Fnull | grep -E \"ACCEPT.*0\\.0\\.0\\.0\u002F0.*0\\.0\\.0\\.0\u002F0\"\n\n# Firewall logging — recent blocked connections\nsudo iptables -L -n -v --line-numbers 2>\u002Fdev\u002Fnull | grep -E \"DROP|REJECT|LOG\" | head -10\njournalctl -k --since \"1 hour ago\" 2>\u002Fdev\u002Fnull | grep -iE \"(iptables|nft|DROP|REJECT)\" | head -20\n```\n\n### Live Traffic Capture\n```bash\n# Quick capture for IOC correlation\nsudo tcpdump -i any -c 1000 -n -w \u002Ftmp\u002Fquick_capture.pcap 2>\u002Fdev\u002Fnull\n\n# HTTP plaintext (C2 \u002F exfil indicator)\nsudo tcpdump -i any -c 500 -n -A 'tcp port 80' 2>\u002Fdev\u002Fnull | \\\n  grep -E \"(GET|POST|Host:|User-Agent:)\" | head -20\n\n# Non-standard HTTPS ports\nsudo tcpdump -i any -c 200 -n 'tcp and not port 443 and not port 80' 2>\u002Fdev\u002Fnull | \\\n  grep \"Flags \\[S\\]\" | awk '{print $3}' | sort | uniq -c | sort -rn | head -20\n\n# Suricata alert log (if running)\ntail -50 \u002Fvar\u002Flog\u002Fsuricata\u002Ffast.log 2>\u002Fdev\u002Fnull\ntail -20 \u002Fvar\u002Flog\u002Fsuricata\u002Feve.json 2>\u002Fdev\u002Fnull | python3 -m json.tool 2>\u002Fdev\u002Fnull | \\\n  grep -E \"(signature|src_ip|dest_ip|category)\" | head -30\n```\n\n### Wireless Recon\n```bash\n# Wireless interfaces and mode\niwconfig 2>\u002Fdev\u002Fnull | grep -E \"(Mode|ESSID|Access Point|Freq|Rate)\"\niw dev 2>\u002Fdev\u002Fnull\n\n# Monitor mode interfaces (unauthorized packet capture)\niw dev 2>\u002Fdev\u002Fnull | grep \"type monitor\"\n\n# Scan for rogue APs\nsudo iw dev wlan0 scan 2>\u002Fdev\u002Fnull | grep -E \"(SSID|BSSID|signal|freq)\" | head -20\n```\n\n---\n\n## MITRE ATT&CK Mapping\n\n| Finding | Technique |\n|---------|-----------|\n| Unexpected listener on high port | T1071 – Application Layer Protocol |\n| DNS tunneling \u002F long subdomains | T1071.004 – DNS |\n| ARP cache poisoning | T1557.002 – ARP Cache Poisoning |\n| Established connection to IOC IP | T1041 – Exfiltration Over C2 Channel |\n| GRE\u002FTUN tunnel interface | T1572 – Protocol Tunneling |\n| Firewall rule disabled | T1562.004 – Disable or Modify System Firewall |\n| Promiscuous mode interface | T1040 – Network Sniffing |\n| mDNS\u002FLLMNR response poisoning | T1557.001 – LLMNR\u002FNBT-NS Poisoning |\n\n---\n\n## Rules for Agents\n\n1. Always correlate all remote IPs against `ioc-db.md` before proceeding\n2. Any connection to IOC-listed IP = **HIGH** minimum, escalate to CYBERSEC-AGENT\n3. Unexpected listeners on ports \u003C 1024 = **HIGH**\n4. ARP cache with duplicate IPs = **MEDIUM+** MITM indicator\n5. Tunnel interfaces not in NetworkBaseline = **HIGH**\n6. Log all remote IPs, listening ports, and anomalous routes to `iocs.md`\n7. Sync all network IOCs to shared memory at session end\n","# Network Recon\n\n**Purpose:** Rapid network-state triage with IOC-first correlation. Establishes connection baseline, detects C2 channels, identifies rogue listeners, and maps network anomalies to MITRE techniques.\n\n---\n\n## Core Focus Areas\n\n- **Active connections**: TCP\u002FUDP state, established\u002Flistening inventory, raw socket holders\n- **Suspicious listeners**: Unexpected ports, listeners bound to `0.0.0.0`, unusual services\n- **DNS anomalies**: Unusual resolvers, DNS tunneling patterns, mDNS\u002FLLMNR abuse\n- **ARP\u002FMAC layer**: ARP cache poisoning, duplicate MAC addresses, MITM indicators\n- **Routing anomalies**: Unexpected routes, policy routing, tunnel interfaces\n- **Firewall audit**: iptables\u002Fnftables\u002Fufw rule gaps, unexpected ACCEPTs\n- **IOC correlation**: Match active connections and DNS queries against known-bad infrastructure\n- **Wireless**: Rogue AP detection, promiscuous mode interfaces, monitor interfaces\n\n---\n\n## Key Techniques & Tools\n\n### Connection Inventory\n```bash\n# All TCP\u002FUDP connections with process info\nss -tulpn 2>\u002Fdev\u002Fnull\nss -tulpna 2>\u002Fdev\u002Fnull | sort -k5 | head -50\n\n# Established connections (potential C2)\nss -tnp state established 2>\u002Fdev\u002Fnull | \\\n  awk 'NR>1 {print $5, $6, $7}' | sort | uniq -c | sort -rn | head -20\n\n# Raw socket holders (packet capture \u002F injection capability)\nss -a --raw 2>\u002Fdev\u002Fnull | head -10\n\n# Connections on non-standard high ports\nss -tnp state established 2>\u002Fdev\u002Fnull | \\\n  awk 'NR>1 && $5 ~ \u002F:[0-9]+$\u002F {port=$5; sub(\u002F.*:\u002F,\"\",port); if(port+0>1024 && port+0!=443 && port+0!=80) print}' | \\\n  sort | uniq -c | sort -rn | head -20\n\n# netstat for legacy compatibility\nnetstat -tulpn 2>\u002Fdev\u002Fnull | head -30\n```\n\n### IOC Infrastructure Correlation\n```bash\n# Extract all remote IPs from established connections\nREMOTE_IPS=$(ss -tnp state established 2>\u002Fdev\u002Fnull | \\\n  awk 'NR>1 {ip=$5; sub(\u002F:[^:]*$\u002F,\"\",ip); print ip}' | sort -u)\n\n# Lookup each IP against IOC database\nfor ip in $REMOTE_IPS; do\n  result=$(grep -r \"$ip\" .\u002Fcybersec-shared\u002Fintelligence\u002Fioc-db.md 2>\u002Fdev\u002Fnull | head -1)\n  [ -n \"$result\" ] && echo \"IOC MATCH: $ip → $result\"\ndone\n\n# Reverse DNS lookup for all remote IPs\necho \"$REMOTE_IPS\" | while read ip; do\n  host \"$ip\" 2>\u002Fdev\u002Fnull | grep \"domain name\" | head -1\ndone\n\n# GeoIP \u002F ASN lookup (requires geoiplookup or similar)\necho \"$REMOTE_IPS\" | while read ip; do\n  geoiplookup \"$ip\" 2>\u002Fdev\u002Fnull | head -1\ndone\n```\n\n### DNS Analysis\n```bash\n# Current DNS resolver configuration\ncat \u002Fetc\u002Fresolv.conf 2>\u002Fdev\u002Fnull\nsystemd-resolve --status 2>\u002Fdev\u002Fnull | grep -E \"(DNS Servers|DNSSEC|Link)\" | head -10\n\n# Active DNS queries (requires tcpdump or sshdump)\nsudo tcpdump -i any -c 200 -n 'port 53' 2>\u002Fdev\u002Fnull | \\\n  awk 'NF && \u002FA\\?|AAAA\\?|TXT\\?|MX\\?\u002F' | sort | uniq -c | sort -rn | head -30\n\n# DNS cache inspection\nsystemd-resolve --statistics 2>\u002Fdev\u002Fnull\nresolvectl query --cache=yes google.com 2>\u002Fdev\u002Fnull\n\n# Long\u002Fhigh-entropy subdomains (DNS tunneling indicator)\nsudo tcpdump -i any -c 500 -n 'port 53' 2>\u002Fdev\u002Fnull | \\\n  grep -oE '[a-zA-Z0-9_-]{25,}\\.[a-zA-Z0-9_.-]+' | sort | uniq -c | sort -rn | head -10\n\n# mDNS\u002FLLMNR traffic (lateral movement via name resolution)\nsudo tcpdump -i any -c 100 -n 'port 5353 or port 5355' 2>\u002Fdev\u002Fnull | head -20\n```\n\n### ARP & MAC Layer\n```bash\n# ARP cache — look for duplicate IPs or gateway MAC changes\narp -n 2>\u002Fdev\u002Fnull\nip neigh show 2>\u002Fdev\u002Fnull\n\n# Detect ARP cache poisoning (same IP, multiple MACs or vice versa)\narp -n 2>\u002Fdev\u002Fnull | awk 'NR>1 {print $3}' | sort | uniq -d | \\\n  while read mac; do\n    echo \"DUPLICATE MAC: $mac\"\n    arp -n | grep \"$mac\"\n  done\n\n# Monitor for ARP changes (static watch)\nip -s neigh 2>\u002Fdev\u002Fnull | grep \"STALE\\|FAILED\" | head -10\n\n# Promiscuous mode interfaces (packet capture risk)\nip link 2>\u002Fdev\u002Fnull | grep PROMISC\n```\n\n### Routing & Interfaces\n```bash\n# Full routing table\nip route show table all 2>\u002Fdev\u002Fnull | head -30\n\n# Policy routing (potential traffic interception)\nip rule list 2>\u002Fdev\u002Fnull\n\n# Tunnel interfaces (potential exfil or C2)\nip link show type gre 2>\u002Fdev\u002Fnull\nip link show type tun 2>\u002Fdev\u002Fnull\nip link show type wireguard 2>\u002Fdev\u002Fnull\nip tunnel show 2>\u002Fdev\u002Fnull\n\n# Interfaces in unexpected states\nip link 2>\u002Fdev\u002Fnull | grep -E \"UNKNOWN|DORMANT|PROMISC|ALLMULTI\"\n\n# IPv6 — check for unexpected global addresses (privacy leak)\nip -6 addr show 2>\u002Fdev\u002Fnull | grep \"global\"\n```\n\n### Firewall Audit\n```bash\n# iptables rules (all tables)\nsudo iptables-save 2>\u002Fdev\u002Fnull | grep -v \"^#\"\nsudo ip6tables-save 2>\u002Fdev\u002Fnull | grep -v \"^#\"\n\n# nftables (modern replacement)\nsudo nft list ruleset 2>\u002Fdev\u002Fnull\n\n# ufw status\nsudo ufw status verbose 2>\u002Fdev\u002Fnull\n\n# Check for ACCEPT all rules (dangerous)\nsudo iptables -L -n -v 2>\u002Fdev\u002Fnull | grep -E \"ACCEPT.*0\\.0\\.0\\.0\u002F0.*0\\.0\\.0\\.0\u002F0\"\n\n# Firewall logging — recent blocked connections\nsudo iptables -L -n -v --line-numbers 2>\u002Fdev\u002Fnull | grep -E \"DROP|REJECT|LOG\" | head -10\njournalctl -k --since \"1 hour ago\" 2>\u002Fdev\u002Fnull | grep -iE \"(iptables|nft|DROP|REJECT)\" | head -20\n```\n\n### Live Traffic Capture\n```bash\n# Quick capture for IOC correlation\nsudo tcpdump -i any -c 1000 -n -w \u002Ftmp\u002Fquick_capture.pcap 2>\u002Fdev\u002Fnull\n\n# HTTP plaintext (C2 \u002F exfil indicator)\nsudo tcpdump -i any -c 500 -n -A 'tcp port 80' 2>\u002Fdev\u002Fnull | \\\n  grep -E \"(GET|POST|Host:|User-Agent:)\" | head -20\n\n# Non-standard HTTPS ports\nsudo tcpdump -i any -c 200 -n 'tcp and not port 443 and not port 80' 2>\u002Fdev\u002Fnull | \\\n  grep \"Flags \\[S\\]\" | awk '{print $3}' | sort | uniq -c | sort -rn | head -20\n\n# Suricata alert log (if running)\ntail -50 \u002Fvar\u002Flog\u002Fsuricata\u002Ffast.log 2>\u002Fdev\u002Fnull\ntail -20 \u002Fvar\u002Flog\u002Fsuricata\u002Feve.json 2>\u002Fdev\u002Fnull | python3 -m json.tool 2>\u002Fdev\u002Fnull | \\\n  grep -E \"(signature|src_ip|dest_ip|category)\" | head -30\n```\n\n### Wireless Recon\n```bash\n# Wireless interfaces and mode\niwconfig 2>\u002Fdev\u002Fnull | grep -E \"(Mode|ESSID|Access Point|Freq|Rate)\"\niw dev 2>\u002Fdev\u002Fnull\n\n# Monitor mode interfaces (unauthorized packet capture)\niw dev 2>\u002Fdev\u002Fnull | grep \"type monitor\"\n\n# Scan for rogue APs\nsudo iw dev wlan0 scan 2>\u002Fdev\u002Fnull | grep -E \"(SSID|BSSID|signal|freq)\" | head -20\n```\n\n---\n\n## MITRE ATT&CK Mapping\n\n| Finding | Technique |\n|---------|-----------|\n| Unexpected listener on high port | T1071 – Application Layer Protocol |\n| DNS tunneling \u002F long subdomains | T1071.004 – DNS |\n| ARP cache poisoning | T1557.002 – ARP Cache Poisoning |\n| Established connection to IOC IP | T1041 – Exfiltration Over C2 Channel |\n| GRE\u002FTUN tunnel interface | T1572 – Protocol Tunneling |\n| Firewall rule disabled | T1562.004 – Disable or Modify System Firewall |\n| Promiscuous mode interface | T1040 – Network Sniffing |\n| mDNS\u002FLLMNR response poisoning | T1557.001 – LLMNR\u002FNBT-NS Poisoning |\n\n---\n\n## Rules for Agents\n\n1. Always correlate all remote IPs against `ioc-db.md` before proceeding\n2. Any connection to IOC-listed IP = **HIGH** minimum, escalate to CYBERSEC-AGENT\n3. Unexpected listeners on ports \u003C 1024 = **HIGH**\n4. ARP cache with duplicate IPs = **MEDIUM+** MITM indicator\n5. Tunnel interfaces not in NetworkBaseline = **HIGH**\n6. Log all remote IPs, listening ports, and anomalous routes to `iocs.md`\n7. Sync all network IOCs to shared memory at session end\n",{"name":5,"tags":49,"capec":51,"model":52,"tools":53,"skills":59,"maxTurns":63,"nist_csf":64,"description":7,"mitre_attack":65},[50,37,36],"network",[],"sonnet",[54,34,55,56,57,58],"Read","Glob","Grep","WebSearch","WebFetch",[60,61,62],"shared-memory","tls\u002Fsslkeylog","threats\u002Fmitre-attack-mapper",30,[],[66,67,68,69],"T1059","T1071","T1562.004","T1595","main","a91f1293287ffa9f4f1b8f486cd6e835a1568c84","skills\u002Fnetwork\u002Fsecurity\u002Fmonitoring\u002Fdeploy","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace","https:\u002F\u002Fgithub.com\u002FDCx7C5","#Python","2026-09-01 11:21:00",{"source":8,"skillName":5,"commands":78,"prompt":88,"zipAvailable":89},[79,82,85],{"tool":80,"command":81},"npx","npx skills add DCx7C5\u002Fai-marketplace --skill security-monitoring-deploy",{"tool":83,"command":84},"bunx","bunx skills add DCx7C5\u002Fai-marketplace --skill security-monitoring-deploy",{"tool":86,"command":87},"pnpm","pnpm dlx skills add DCx7C5\u002Fai-marketplace --skill security-monitoring-deploy","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fnetwork\u002Fsecurity\u002Fmonitoring\u002Fdeploy\u002FSKILL.md",true,[91],{"path":92,"resourceType":93,"resourceTypeDesc":94,"sizeBytes":95,"sourceHtmlUrl":96},"index.json","REFERENCE","参考文档",693,"https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fnetwork\u002Fsecurity\u002Fmonitoring\u002Fdeploy\u002Findex.json",[98,124,145,166,188,203],{"skillNo":99,"name":100,"nameZh":6,"description":101,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":102,"categories":103,"keywords":104,"publishedAt":44},"01M71HAPZ01KQ30RKTB0FFSQ05","services-wmi-persistence-detect","Detect WMI event subscription persistence by enumerating ActiveScriptEventConsumer, CommandLineEventConsumer, and permanent subscriptions in the WMI repository.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fservices\u002Fwmi\u002Fpersistence\u002Fdetect\u002FSKILL.md",[],[105,106,107,108,109,110,111,112,113,114,115,116,117,118,119,120,121,122,123],"services","detect","services wmi persistence detect","wmi","persistence","de","cm","process","activescript","event","subscriptions","commandline-consumer","repository","subscription","event-subscription","t1546.003","forensics","cybersecurity","process-forensics",{"skillNo":125,"name":126,"nameZh":6,"description":127,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":128,"categories":129,"keywords":130,"publishedAt":44},"01M71HAK6JTTTS229T17WJMMCG","services-wmi-exec-exploit","Perform lateral movement across Windows networks using WMI-based remote execution techniques including Impacket wmiexec.py, CrackMapExec, and native WMI commands for stealthy post-exploitation during red team engagements.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fservices\u002Fwmi\u002Fexec\u002Fexploit\u002FSKILL.md",[],[131,105,132,108,133,134,135,122,34,33,136,137,138,139,110,140,141,142,143,144],"exploit","services wmi exec exploit","exec","remote","traffic","team","across","crackmapexec","native","command","lateral movement","read","lateral-movement","Impacket",{"skillNo":146,"name":147,"nameZh":6,"description":148,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":149,"categories":150,"keywords":151,"publishedAt":44},"01M71HAG6MHKNQV8KDZKMT4886","registry-artifact-extract","Extract and analyze Windows Registry hives to uncover user activity, installed software, autostart entries, and evidence of system compromise.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fregistry\u002Fartifact\u002Fextract\u002FSKILL.md",[],[152,153,154,155,156,157,122,34,158,33,159,160,110,142,161,162,163,164,165,52],"artifact","registry","registry artifact extract","extract","evidence-collection","artifact-analysis","collection","analyze","uncover","software","activity","digital-forensics","windows-registry","regripper",{"skillNo":167,"name":168,"nameZh":6,"description":169,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":170,"categories":171,"keywords":172,"publishedAt":44},"01M71HACR4A8XTWTTSXK4124AA","processes-token-impersonate-detect","Detect Windows token impersonation and privilege abuse including SeImpersonatePrivilege exploitation via Potato attacks and token stealing techniques.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fprocesses\u002Ftoken\u002Fimpersonate\u002Fdetect\u002FSKILL.md",[],[106,173,174,175,176,177,178,111,179,122,123,180,181,182,183,184,185,186,187,110],"processes token impersonate detect","token","processes","attacks","windows","escalation","techniques","privilege-escalation","seimpersonate","token-impersonation","printspoofer","exploitation","potato","impersonation","via",{"skillNo":189,"name":190,"nameZh":6,"description":191,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":192,"categories":193,"keywords":194,"publishedAt":44},"01M71HAABSB4Z6QFSXEG00R4RK","processes-thread-injection-detect","Detect Windows thread injection techniques including CreateRemoteThread, QueueUserAPC, NtCreateThreadEx, and thread hijacking via process memory analysis.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fprocesses\u002Fthread\u002Finjection\u002Fdetect\u002FSKILL.md",[],[195,196,106,197,175,177,39,111,198,179,122,123,33,199,200,201,202,187,110,112],"thread","processes thread injection detect","injection","process-injection","api","apc-injection","thread-injection","nt-api",{"skillNo":204,"name":205,"nameZh":6,"description":206,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":207,"categories":208,"keywords":209,"publishedAt":44},"01M71HA7H311V5G14WMX58HQSS","processes-hollow-technique-detect","Detect process hollowing (RunPE) by identifying processes with mismatched image paths between PEB and VAD tree, or unmapped PE headers in memory.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fprocesses\u002Fhollow\u002Ftechnique\u002Fdetect\u002FSKILL.md",[],[210,106,175,211,39,111,212,213,122,123,214,215,216,217,218,219,110,112,220,221],"processes hollow technique detect","tree","memory-forensics","process-hollow","peb","runpe","image","pe-header","in memory","with","mismatched","headers"]