[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M71G19S4HBGJDGSZ8NWTQSMX":3,"skill-same:01M71G19S4HBGJDGSZ8NWTQSMX":55},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":18,"publishedAt":23,"linkOnly":24,"markdownContent":25,"markdownBody":26,"frontMatter":27,"refName":28,"commitSha":29,"skillDirectory":30,"forksCount":14,"repositoryHtmlUrl":31,"repositoryHomepageUrl":6,"ownerHtmlUrl":32,"ownerBlogUrl":6,"ownerDescription":33,"updatedAt":34,"install":35,"resources":48},"01M71G19S4HBGJDGSZ8NWTQSMX","soc-playbooks-otirplaybook-respond",null,"Soc Playbooks Otirplaybook Respond.","DCx7C5\u002Fai-marketplace","DCx7C5","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F42419559?v=4","01M71C01G2AZV3NTNGWAWSHJPP","DC","01M71C01GQW6G50S2BYMS7PP3E",0,"MIT","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fsoc-playbooks-otirplaybook-respond\u002FSKILL.md",[],[19,20,21,22],"soc playbooks otirplaybook respond","soc","respond","cybersecurity","2026-11-10 10:12:30",false,"---\nname: soc-playbooks-otirplaybook-respond\ndescription: \"Soc Playbooks Otirplaybook Respond.\"\ndomain: cybersecurity\n---\n\n|\n| PICERL | SANS incident response lifecycle: Preparation, Identification, Containment, Eradication, Recovery, Lessons Learned |\n| ICS4ICS | Incident Command System for Industrial Control Systems -- adapts FEMA ICS to OT cybersecurity response |\n| Safety Instrumented System (SIS) | Independent safety controller that prevents hazardous conditions; compromising SIS can cause physical harm |\n| Manual\u002FLocal Mode | Operating PLCs with local panel controls instead of remote SCADA; used when remote access is compromised |\n| CIRCIA | Cyber Incident Reporting for Critical Infrastructure Act requiring reporting to CISA within 72 hours |\n| Known-Good Backup | Verified, offline copy of PLC programs and configurations used as the trusted baseline for recovery |\n\n## Common Scenarios\n\n### Scenario: Ransomware Spreads from IT to OT Level 3\n\n**Context**: Ransomware encrypts enterprise IT systems and spreads through an inadequately protected IT\u002FOT conduit to Level 3 historian servers. HMIs at Level 2 begin showing connectivity errors.\n\n**Approach**:\n1. Activate the OT IR playbook for ransomware immediately\n2. Sever IT-OT connectivity at the DMZ firewall (both north and south firewalls)\n3. Verify PLCs are still running and process is stable (PLCs run independently of IT)\n4. Switch operators to local HMI panels if networked HMIs are affected\n5. Assess which Level 2\u002F3 systems are encrypted vs operational\n6. Prioritize restoring HMI visibility, then historian, then engineering workstations\n7. Restore from offline backups -- never attempt to decrypt using attacker-provided tools without sandbox testing\n8. Report to CISA within 72 hours per CIRCIA requirements\n\n**Pitfalls**: Do not shut down PLCs to \"protect\" them from ransomware -- PLCs run firmware, not Windows, and are typically unaffected by ransomware. Shutting down PLCs disrupts the physical process. Never reconnect IT-OT conduit until the IT side is fully remediated.\n\n## Output Format\n\n```\nOT INCIDENT RESPONSE REPORT\n==============================\nIncident ID: OT-IR-YYYYMMDD-HHMMSS\nSeverity: SEV[1-5]\nCategory: [category]\nStatus: [Active\u002FContained\u002FEradicated\u002FRecovered\u002FClosed]\n\nTIMELINE:\n  [timestamp] - [phase] - [action] - [actor]\n\nAFFECTED SYSTEMS:\n  Safety Systems: [status]\n  Process Controllers: [status]\n  HMI\u002FSCADA: [status]\n  Historian: [status]\n\nDECISIONS LOG:\n  [timestamp] - [decision] - [rationale] - [approver]\n\nCONTAINMENT ACTIONS TAKEN:\n  1. [action and timestamp]\n\nRECOVERY STATUS:\n  [system] - [restored\u002Fpending] - [ETA]\n```\n","|\n| PICERL | SANS incident response lifecycle: Preparation, Identification, Containment, Eradication, Recovery, Lessons Learned |\n| ICS4ICS | Incident Command System for Industrial Control Systems -- adapts FEMA ICS to OT cybersecurity response |\n| Safety Instrumented System (SIS) | Independent safety controller that prevents hazardous conditions; compromising SIS can cause physical harm |\n| Manual\u002FLocal Mode | Operating PLCs with local panel controls instead of remote SCADA; used when remote access is compromised |\n| CIRCIA | Cyber Incident Reporting for Critical Infrastructure Act requiring reporting to CISA within 72 hours |\n| Known-Good Backup | Verified, offline copy of PLC programs and configurations used as the trusted baseline for recovery |\n\n## Common Scenarios\n\n### Scenario: Ransomware Spreads from IT to OT Level 3\n\n**Context**: Ransomware encrypts enterprise IT systems and spreads through an inadequately protected IT\u002FOT conduit to Level 3 historian servers. HMIs at Level 2 begin showing connectivity errors.\n\n**Approach**:\n1. Activate the OT IR playbook for ransomware immediately\n2. Sever IT-OT connectivity at the DMZ firewall (both north and south firewalls)\n3. Verify PLCs are still running and process is stable (PLCs run independently of IT)\n4. Switch operators to local HMI panels if networked HMIs are affected\n5. Assess which Level 2\u002F3 systems are encrypted vs operational\n6. Prioritize restoring HMI visibility, then historian, then engineering workstations\n7. Restore from offline backups -- never attempt to decrypt using attacker-provided tools without sandbox testing\n8. Report to CISA within 72 hours per CIRCIA requirements\n\n**Pitfalls**: Do not shut down PLCs to \"protect\" them from ransomware -- PLCs run firmware, not Windows, and are typically unaffected by ransomware. Shutting down PLCs disrupts the physical process. Never reconnect IT-OT conduit until the IT side is fully remediated.\n\n## Output Format\n\n```\nOT INCIDENT RESPONSE REPORT\n==============================\nIncident ID: OT-IR-YYYYMMDD-HHMMSS\nSeverity: SEV[1-5]\nCategory: [category]\nStatus: [Active\u002FContained\u002FEradicated\u002FRecovered\u002FClosed]\n\nTIMELINE:\n  [timestamp] - [phase] - [action] - [actor]\n\nAFFECTED SYSTEMS:\n  Safety Systems: [status]\n  Process Controllers: [status]\n  HMI\u002FSCADA: [status]\n  Historian: [status]\n\nDECISIONS LOG:\n  [timestamp] - [decision] - [rationale] - [approver]\n\nCONTAINMENT ACTIONS TAKEN:\n  1. [action and timestamp]\n\nRECOVERY STATUS:\n  [system] - [restored\u002Fpending] - [ETA]\n```\n",{"name":5,"domain":22,"description":7},"main","a91f1293287ffa9f4f1b8f486cd6e835a1568c84","skills\u002Fsoc-playbooks-otirplaybook-respond","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace","https:\u002F\u002Fgithub.com\u002FDCx7C5","#Python","2026-09-01 11:21:00",{"source":8,"skillName":5,"commands":36,"prompt":46,"zipAvailable":47},[37,40,43],{"tool":38,"command":39},"npx","npx skills add DCx7C5\u002Fai-marketplace --skill soc-playbooks-otirplaybook-respond",{"tool":41,"command":42},"bunx","bunx skills add DCx7C5\u002Fai-marketplace --skill soc-playbooks-otirplaybook-respond",{"tool":44,"command":45},"pnpm","pnpm dlx skills add DCx7C5\u002Fai-marketplace --skill soc-playbooks-otirplaybook-respond","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fsoc-playbooks-otirplaybook-respond\u002FSKILL.md",true,[49],{"path":50,"resourceType":51,"resourceTypeDesc":52,"sizeBytes":53,"sourceHtmlUrl":54},"index.json","REFERENCE","参考文档",536,"https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fsoc-playbooks-otirplaybook-respond\u002Findex.json",[56,81,104,126,148,164],{"skillNo":57,"name":58,"nameZh":6,"description":59,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":60,"categories":61,"keywords":62,"publishedAt":23},"01M71HAPZ01KQ30RKTB0FFSQ05","services-wmi-persistence-detect","Detect WMI event subscription persistence by enumerating ActiveScriptEventConsumer, CommandLineEventConsumer, and permanent subscriptions in the WMI repository.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fservices\u002Fwmi\u002Fpersistence\u002Fdetect\u002FSKILL.md",[],[63,64,65,66,67,68,69,70,71,72,73,74,75,76,77,78,79,22,80],"services","detect","services wmi persistence detect","wmi","persistence","de","cm","process","activescript","event","subscriptions","commandline-consumer","repository","subscription","event-subscription","t1546.003","forensics","process-forensics",{"skillNo":82,"name":83,"nameZh":6,"description":84,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":85,"categories":86,"keywords":87,"publishedAt":23},"01M71HAK6JTTTS229T17WJMMCG","services-wmi-exec-exploit","Perform lateral movement across Windows networks using WMI-based remote execution techniques including Impacket wmiexec.py, CrackMapExec, and native WMI commands for stealthy post-exploitation during red team engagements.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fservices\u002Fwmi\u002Fexec\u002Fexploit\u002FSKILL.md",[],[88,63,89,66,90,91,92,22,93,94,95,96,97,98,68,99,100,101,102,103],"exploit","services wmi exec exploit","exec","remote","traffic","Bash","analysis","team","across","crackmapexec","native","command","lateral movement","read","lateral-movement","Impacket",{"skillNo":105,"name":106,"nameZh":6,"description":107,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":108,"categories":109,"keywords":110,"publishedAt":23},"01M71HAG6MHKNQV8KDZKMT4886","registry-artifact-extract","Extract and analyze Windows Registry hives to uncover user activity, installed software, autostart entries, and evidence of system compromise.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fregistry\u002Fartifact\u002Fextract\u002FSKILL.md",[],[111,112,113,114,115,116,22,93,117,94,118,119,68,101,120,121,122,123,124,125],"artifact","registry","registry artifact extract","extract","evidence-collection","artifact-analysis","collection","analyze","uncover","software","activity","digital-forensics","windows-registry","regripper","sonnet",{"skillNo":127,"name":128,"nameZh":6,"description":129,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":130,"categories":131,"keywords":132,"publishedAt":23},"01M71HACR4A8XTWTTSXK4124AA","processes-token-impersonate-detect","Detect Windows token impersonation and privilege abuse including SeImpersonatePrivilege exploitation via Potato attacks and token stealing techniques.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fprocesses\u002Ftoken\u002Fimpersonate\u002Fdetect\u002FSKILL.md",[],[64,133,134,135,136,137,138,69,139,22,80,140,141,142,143,144,145,146,147,68],"processes token impersonate detect","token","processes","attacks","windows","escalation","techniques","privilege-escalation","seimpersonate","token-impersonation","printspoofer","exploitation","potato","impersonation","via",{"skillNo":149,"name":150,"nameZh":6,"description":151,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":152,"categories":153,"keywords":154,"publishedAt":23},"01M71HAABSB4Z6QFSXEG00R4RK","processes-thread-injection-detect","Detect Windows thread injection techniques including CreateRemoteThread, QueueUserAPC, NtCreateThreadEx, and thread hijacking via process memory analysis.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fprocesses\u002Fthread\u002Finjection\u002Fdetect\u002FSKILL.md",[],[155,156,64,157,135,137,158,69,159,139,22,80,94,160,161,162,163,147,68,70],"thread","processes thread injection detect","injection","memory","process-injection","api","apc-injection","thread-injection","nt-api",{"skillNo":165,"name":166,"nameZh":6,"description":167,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":168,"categories":169,"keywords":170,"publishedAt":23},"01M71HA7H311V5G14WMX58HQSS","processes-hollow-technique-detect","Detect process hollowing (RunPE) by identifying processes with mismatched image paths between PEB and VAD tree, or unmapped PE headers in memory.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fprocesses\u002Fhollow\u002Ftechnique\u002Fdetect\u002FSKILL.md",[],[171,64,135,172,158,69,173,174,22,80,175,176,177,178,179,180,68,70,181,182],"processes hollow technique detect","tree","memory-forensics","process-hollow","peb","runpe","image","pe-header","in memory","with","mismatched","headers"]