[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M71FXVHJS8QA9Y8ZNSK3X2NN":3,"skill-same:01M71FXVHJS8QA9Y8ZNSK3X2NN":62},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":23,"publishedAt":30,"linkOnly":31,"markdownContent":32,"markdownBody":33,"frontMatter":34,"refName":35,"commitSha":36,"skillDirectory":37,"forksCount":14,"repositoryHtmlUrl":38,"repositoryHomepageUrl":6,"ownerHtmlUrl":39,"ownerBlogUrl":6,"ownerDescription":40,"updatedAt":41,"install":42,"resources":55},"01M71FXVHJS8QA9Y8ZNSK3X2NN","soc-data-logs-aggregate",null,"Soc Data Logs Aggregate.","DCx7C5\u002Fai-marketplace","DCx7C5","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F42419559?v=4","01M71C01G2AZV3NTNGWAWSHJPP","DC","01M71C01GQW6G50S2BYMS7PP3E",0,"MIT","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fsoc-data-logs-aggregate\u002FSKILL.md",[18],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000033","数据分析师","PROFESSION","适用职业",[24,25,26,27,28,29],"logs","soc","data","aggregate","soc data logs aggregate","cybersecurity","2026-11-10 10:12:30",false,"---\nname: soc-data-logs-aggregate\ndescription: \"Soc Data Logs Aggregate.\"\ndomain: cybersecurity\n---\n\n|\n| python-evtx | Python library for parsing Windows EVTX event log files |\n| evtxexport | Command-line EVTX export utility from libevtx |\n| LogParser | Microsoft SQL-like query engine for Windows logs |\n| ausearch | Linux audit log search utility |\n| jq | JSON query tool for parsing structured log formats |\n| ELK Stack | Elasticsearch, Logstash, Kibana for log aggregation and visualization |\n| Chainsaw | Sigma-based Windows Event Log analysis tool |\n| Hayabusa | Fast Windows Event Log forensic timeline generator |\n\n## Common Scenarios\n\n**Scenario 1: Brute Force Attack Detection**\nFilter Security.evtx for Event ID 4625 (failed logons), group by source IP and target account, identify patterns of rapid successive failures, find the successful logon (4624) that followed, trace subsequent activity from the compromised account.\n\n**Scenario 2: Insider Threat Investigation**\nCollect all log sources from the suspect's workstation and accessed servers, correlate file access events with authentication events, build timeline of data access during non-business hours, identify data transfers to external media or cloud storage.\n\n**Scenario 3: Web Application Compromise**\nParse web server access logs for SQLi, XSS, and path traversal patterns, identify the attack IP and timeline, correlate with application logs for successful exploitation, trace post-exploitation activity through system and auth logs.\n\n**Scenario 4: Ransomware Incident Timeline**\nIdentify the initial execution through process creation events (4688), trace privilege escalation through service installation (4697), map lateral movement via network logons (4624 Type 3), identify encryption start from file system activity, find the earliest IoC for remediation scoping.\n\n## Output Format\n\n```\nLog Analysis Summary:\n  Investigation Period: 2024-01-15 00:00 to 2024-01-20 23:59 UTC\n  Total Events Analyzed: 894,567\n  Log Sources: 6 (3 Windows, 3 Linux)\n\n  Critical Events:\n    Failed Logons:       1,234 (from 5 unique IPs)\n    Successful Logons:   456 (3 anomalous)\n    Account Changes:     12 (1 unauthorized admin creation)\n    Process Creations:   8,234 (15 suspicious)\n    Log Clearings:       2 (Security log cleared at 2024-01-18 03:00 UTC)\n    Service Installs:    3 (1 unknown service)\n\n  Attack Timeline:\n    2024-01-15 14:32 - Initial access via RDP brute force\n    2024-01-15 14:45 - Admin account \"svcbackup\" created\n    2024-01-16 02:15 - Lateral movement to 3 servers\n    2024-01-17 03:00 - Data staging in C:\\ProgramData\\temp\\\n    2024-01-18 01:30 - 4.2 GB exfiltrated to 185.x.x.x\n    2024-01-18 03:00 - Security logs cleared\n\n  Report: \u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Flog_analysis_report.txt\n```\n","|\n| python-evtx | Python library for parsing Windows EVTX event log files |\n| evtxexport | Command-line EVTX export utility from libevtx |\n| LogParser | Microsoft SQL-like query engine for Windows logs |\n| ausearch | Linux audit log search utility |\n| jq | JSON query tool for parsing structured log formats |\n| ELK Stack | Elasticsearch, Logstash, Kibana for log aggregation and visualization |\n| Chainsaw | Sigma-based Windows Event Log analysis tool |\n| Hayabusa | Fast Windows Event Log forensic timeline generator |\n\n## Common Scenarios\n\n**Scenario 1: Brute Force Attack Detection**\nFilter Security.evtx for Event ID 4625 (failed logons), group by source IP and target account, identify patterns of rapid successive failures, find the successful logon (4624) that followed, trace subsequent activity from the compromised account.\n\n**Scenario 2: Insider Threat Investigation**\nCollect all log sources from the suspect's workstation and accessed servers, correlate file access events with authentication events, build timeline of data access during non-business hours, identify data transfers to external media or cloud storage.\n\n**Scenario 3: Web Application Compromise**\nParse web server access logs for SQLi, XSS, and path traversal patterns, identify the attack IP and timeline, correlate with application logs for successful exploitation, trace post-exploitation activity through system and auth logs.\n\n**Scenario 4: Ransomware Incident Timeline**\nIdentify the initial execution through process creation events (4688), trace privilege escalation through service installation (4697), map lateral movement via network logons (4624 Type 3), identify encryption start from file system activity, find the earliest IoC for remediation scoping.\n\n## Output Format\n\n```\nLog Analysis Summary:\n  Investigation Period: 2024-01-15 00:00 to 2024-01-20 23:59 UTC\n  Total Events Analyzed: 894,567\n  Log Sources: 6 (3 Windows, 3 Linux)\n\n  Critical Events:\n    Failed Logons:       1,234 (from 5 unique IPs)\n    Successful Logons:   456 (3 anomalous)\n    Account Changes:     12 (1 unauthorized admin creation)\n    Process Creations:   8,234 (15 suspicious)\n    Log Clearings:       2 (Security log cleared at 2024-01-18 03:00 UTC)\n    Service Installs:    3 (1 unknown service)\n\n  Attack Timeline:\n    2024-01-15 14:32 - Initial access via RDP brute force\n    2024-01-15 14:45 - Admin account \"svcbackup\" created\n    2024-01-16 02:15 - Lateral movement to 3 servers\n    2024-01-17 03:00 - Data staging in C:\\ProgramData\\temp\\\n    2024-01-18 01:30 - 4.2 GB exfiltrated to 185.x.x.x\n    2024-01-18 03:00 - Security logs cleared\n\n  Report: \u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Flog_analysis_report.txt\n```\n",{"name":5,"domain":29,"description":7},"main","a91f1293287ffa9f4f1b8f486cd6e835a1568c84","skills\u002Fsoc-data-logs-aggregate","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace","https:\u002F\u002Fgithub.com\u002FDCx7C5","#Python","2026-09-01 11:21:00",{"source":8,"skillName":5,"commands":43,"prompt":53,"zipAvailable":54},[44,47,50],{"tool":45,"command":46},"npx","npx skills add DCx7C5\u002Fai-marketplace --skill soc-data-logs-aggregate",{"tool":48,"command":49},"bunx","bunx skills add DCx7C5\u002Fai-marketplace --skill soc-data-logs-aggregate",{"tool":51,"command":52},"pnpm","pnpm dlx skills add DCx7C5\u002Fai-marketplace --skill soc-data-logs-aggregate","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fsoc-data-logs-aggregate\u002FSKILL.md",true,[56],{"path":57,"resourceType":58,"resourceTypeDesc":59,"sizeBytes":60,"sourceHtmlUrl":61},"index.json","REFERENCE","参考文档",492,"https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fsoc-data-logs-aggregate\u002Findex.json",[63,88,111,133,155,171],{"skillNo":64,"name":65,"nameZh":6,"description":66,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":67,"categories":68,"keywords":69,"publishedAt":30},"01M71HAPZ01KQ30RKTB0FFSQ05","services-wmi-persistence-detect","Detect WMI event subscription persistence by enumerating ActiveScriptEventConsumer, CommandLineEventConsumer, and permanent subscriptions in the WMI repository.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fservices\u002Fwmi\u002Fpersistence\u002Fdetect\u002FSKILL.md",[],[70,71,72,73,74,75,76,77,78,79,80,81,82,83,84,85,86,29,87],"services","detect","services wmi persistence detect","wmi","persistence","de","cm","process","activescript","event","subscriptions","commandline-consumer","repository","subscription","event-subscription","t1546.003","forensics","process-forensics",{"skillNo":89,"name":90,"nameZh":6,"description":91,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":92,"categories":93,"keywords":94,"publishedAt":30},"01M71HAK6JTTTS229T17WJMMCG","services-wmi-exec-exploit","Perform lateral movement across Windows networks using WMI-based remote execution techniques including Impacket wmiexec.py, CrackMapExec, and native WMI commands for stealthy post-exploitation during red team engagements.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fservices\u002Fwmi\u002Fexec\u002Fexploit\u002FSKILL.md",[],[95,70,96,73,97,98,99,29,100,101,102,103,104,105,75,106,107,108,109,110],"exploit","services wmi exec exploit","exec","remote","traffic","Bash","analysis","team","across","crackmapexec","native","command","lateral movement","read","lateral-movement","Impacket",{"skillNo":112,"name":113,"nameZh":6,"description":114,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":115,"categories":116,"keywords":117,"publishedAt":30},"01M71HAG6MHKNQV8KDZKMT4886","registry-artifact-extract","Extract and analyze Windows Registry hives to uncover user activity, installed software, autostart entries, and evidence of system compromise.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fregistry\u002Fartifact\u002Fextract\u002FSKILL.md",[],[118,119,120,121,122,123,29,100,124,101,125,126,75,108,127,128,129,130,131,132],"artifact","registry","registry artifact extract","extract","evidence-collection","artifact-analysis","collection","analyze","uncover","software","activity","digital-forensics","windows-registry","regripper","sonnet",{"skillNo":134,"name":135,"nameZh":6,"description":136,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":137,"categories":138,"keywords":139,"publishedAt":30},"01M71HACR4A8XTWTTSXK4124AA","processes-token-impersonate-detect","Detect Windows token impersonation and privilege abuse including SeImpersonatePrivilege exploitation via Potato attacks and token stealing techniques.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fprocesses\u002Ftoken\u002Fimpersonate\u002Fdetect\u002FSKILL.md",[],[71,140,141,142,143,144,145,76,146,29,87,147,148,149,150,151,152,153,154,75],"processes token impersonate detect","token","processes","attacks","windows","escalation","techniques","privilege-escalation","seimpersonate","token-impersonation","printspoofer","exploitation","potato","impersonation","via",{"skillNo":156,"name":157,"nameZh":6,"description":158,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":159,"categories":160,"keywords":161,"publishedAt":30},"01M71HAABSB4Z6QFSXEG00R4RK","processes-thread-injection-detect","Detect Windows thread injection techniques including CreateRemoteThread, QueueUserAPC, NtCreateThreadEx, and thread hijacking via process memory analysis.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fprocesses\u002Fthread\u002Finjection\u002Fdetect\u002FSKILL.md",[],[162,163,71,164,142,144,165,76,166,146,29,87,101,167,168,169,170,154,75,77],"thread","processes thread injection detect","injection","memory","process-injection","api","apc-injection","thread-injection","nt-api",{"skillNo":172,"name":173,"nameZh":6,"description":174,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":175,"categories":176,"keywords":177,"publishedAt":30},"01M71HA7H311V5G14WMX58HQSS","processes-hollow-technique-detect","Detect process hollowing (RunPE) by identifying processes with mismatched image paths between PEB and VAD tree, or unmapped PE headers in memory.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fprocesses\u002Fhollow\u002Ftechnique\u002Fdetect\u002FSKILL.md",[],[178,71,142,179,165,76,180,181,29,87,182,183,184,185,186,187,75,77,188,189],"processes hollow technique detect","tree","memory-forensics","process-hollow","peb","runpe","image","pe-header","in memory","with","mismatched","headers"]