[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M71G3S8EBVYGVEVM5CP4FPWD":3,"skill-same:01M71G3S8EBVYGVEVM5CP4FPWD":88},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":18,"publishedAt":39,"linkOnly":40,"markdownContent":41,"markdownBody":42,"frontMatter":43,"refName":61,"commitSha":62,"skillDirectory":63,"forksCount":14,"repositoryHtmlUrl":64,"repositoryHomepageUrl":6,"ownerHtmlUrl":65,"ownerBlogUrl":6,"ownerDescription":66,"updatedAt":67,"install":68,"resources":81},"01M71G3S8EBVYGVEVM5CP4FPWD","forensics-investigation-forensic",null,"Filesystem forensic reconnaissance. Baseline\u002Fdelta comparison, SUID\u002FSGID audit, hidden file detection, inode anomalies, extended attributes, deleted-but-open files, setuid rootkits, and forensic timeline analysis.","DCx7C5\u002Fai-marketplace","DCx7C5","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F42419559?v=4","01M71C01G2AZV3NTNGWAWSHJPP","DC","01M71C01GQW6G50S2BYMS7PP3E",0,"MIT","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fsoc\u002Fforensics\u002Finvestigation\u002Fforensic\u002FSKILL.md",[],[19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38],"forensics investigation forensic","forensics","forensic","investigation","shared","filesystem-recon","sgid","inode","suid","websearch","attributes","recon","memory","files","Bash","open","analysis","endpoint-security","mitre-attack","audit","2026-11-10 10:12:30",false,"---\nname: forensics-investigation-forensic\ndescription: Filesystem forensic reconnaissance. Baseline\u002Fdelta comparison, SUID\u002FSGID audit, hidden file detection, inode anomalies, extended attributes, deleted-but-open files, setuid rootkits, and forensic timeline analysis.\nmodel: sonnet\nmaxTurns: 30\ntools:\n  - Read\n  - Bash\n  - Glob\n  - Grep\n  - WebSearch\nskills:\n  - shared-memory\n  - threats\u002Fmitre-attack-mapper\ntags:\n- endpoint-security\n- forensics\n- investigation\n- filesystem-recon\nmitre_attack:\n- T1059\n- T1548.001\n- T1595\nnist_csf: []\ncapec: []\n---\n\n# Filesystem Recon\n\n**Purpose:** Focused, fast filesystem triage with forensic-safe defaults. Baseline comparison, anomaly detection, and timeline-first evidence collection.\n\n---\n\n## Core Focus Areas\n\n- **Baseline delta**: Compare live state against stored PersistenceBaseline\u002FFilesystemBaseline\n- **SUID\u002FSGID audit**: All setuid\u002Fsetgid binaries, world-writable directories\n- **Hidden files**: `.` prefix, unusual names, high-entropy filenames, files in `\u002Fdev`, `\u002Fproc`, `\u002Ftmp`\n- **Inode anomalies**: Hardlinks to privileged files, inode number gaps, journal inconsistencies\n- **Extended attributes**: `lsattr`\u002F`getfattr` for hidden immutable\u002Fappend-only flags\n- **Deleted-but-open files**: `lsof +L1` for malware keeping deleted files open\n- **Timeline forensics**: mtime\u002Fatime\u002Fctime analysis, MAC time tampering detection\n- **Temporary directories**: Executable payloads in `\u002Ftmp`, `\u002Fvar\u002Ftmp`, `\u002Fdev\u002Fshm`, `\u002Frun`\n\n---\n\n## Key Techniques & Tools\n\n### SUID\u002FSGID & Permission Audit\n```bash\n# All SUID binaries (compare against baseline)\nfind \u002F -xdev -perm \u002F4000 -type f 2>\u002Fdev\u002Fnull | sort > \u002Ftmp\u002Fsuid_live.txt\ndiff \u002Ftmp\u002Fsuid_baseline.txt \u002Ftmp\u002Fsuid_live.txt 2>\u002Fdev\u002Fnull || \\\n  cat \u002Ftmp\u002Fsuid_live.txt | head -30\n\n# SGID binaries\nfind \u002F -xdev -perm \u002F2000 -type f 2>\u002Fdev\u002Fnull | sort | head -20\n\n# World-writable files outside \u002Ftmp (suspicious)\nfind \u002F -xdev -perm \u002F0002 -not -path \"*\u002Fproc\u002F*\" -not -path \"*\u002Ftmp\u002F*\" \\\n  -not -path \"*\u002Fsys\u002F*\" -type f 2>\u002Fdev\u002Fnull | head -20\n\n# World-writable directories\nfind \u002F -xdev -perm \u002F0002 -type d -not -path \"*\u002Fproc\u002F*\" \\\n  -not -path \"*\u002Ftmp\" -not -path \"*\u002Fsys\u002F*\" 2>\u002Fdev\u002Fnull | head -15\n\n# Files owned by root but writable by others\nfind \u002Fusr \u002Fbin \u002Fsbin \u002Fetc -xdev -writable -not -user root 2>\u002Fdev\u002Fnull | head -10\n```\n\n### Hidden & Suspicious Files\n```bash\n# Executable files in temp directories\nfind \u002Ftmp \u002Fvar\u002Ftmp \u002Fdev\u002Fshm \u002Frun -type f -executable 2>\u002Fdev\u002Fnull | \\\n  while read f; do\n    echo \"EXEC in tmp: $f ($(stat -c '%a %U %G' \"$f\"))\"\n    file \"$f\" 2>\u002Fdev\u002Fnull | grep -v \"ASCII\\|text\"\n  done\n\n# High-entropy filenames (base64\u002Fhex names)\nfind \u002F -maxdepth 5 -name \"*=*\" -o -name \".[a-f0-9][a-f0-9][a-f0-9][a-f0-9]*\" \\\n  2>\u002Fdev\u002Fnull | grep -v \"\u002Fproc\\|\u002Fsys\" | head -20\n\n# Files with spaces or unusual characters in name\nfind \u002Ftmp \u002Fvar\u002Ftmp \u002Fhome \u002Fetc -name \"* *\" -o -name \"*[[:cntrl:]]*\" 2>\u002Fdev\u002Fnull | \\\n  head -10\n\n# Dot-files in unusual system directories\nfind \u002Fbin \u002Fsbin \u002Fusr\u002Fbin \u002Fusr\u002Fsbin -name \".*\" 2>\u002Fdev\u002Fnull | head -10\n\n# Files in \u002Fdev that aren't devices\nfind \u002Fdev -not -type b -not -type c -not -type d -not -type l \\\n  -not -name \"fd\" -not -name \"stdin\" -not -name \"stdout\" 2>\u002Fdev\u002Fnull | head -10\n```\n\n### Inode & Extended Attributes\n```bash\n# Files with multiple hardlinks (potential rootkit technique)\nfind \u002F -xdev -links +3 -type f -not -path \"*\u002Fproc\u002F*\" 2>\u002Fdev\u002Fnull | \\\n  while read f; do\n    n=$(stat -c '%h' \"$f\")\n    echo \"HARDLINKS($n): $f\"\n  done | head -20\n\n# Extended attributes (hidden data, immutable flags)\nlsattr -R \u002Fetc \u002Fbin \u002Fsbin \u002Fusr\u002Fbin 2>\u002Fdev\u002Fnull | grep -v \"^lsattr\\|^---\" | \\\n  grep -E \"^.{4}i|^.{4}a|^.{4}s\" | head -20\n\n# User extended attributes (xattr) — can hide data\ngetfattr -R -n user.* \u002Fhome \u002Ftmp 2>\u002Fdev\u002Fnull | head -20\n\n# Immutable system files that shouldn't be\nlsattr \u002Fetc\u002Fpasswd \u002Fetc\u002Fshadow \u002Fetc\u002Fsudoers 2>\u002Fdev\u002Fnull\n```\n\n### Deleted-But-Open Files\n```bash\n# Files deleted but kept open by processes (rootkit\u002Fmalware pattern)\nlsof +L1 2>\u002Fdev\u002Fnull | grep -v \"^lsof\" | head -30\n\n# Cross-reference PIDs with process info\nlsof +L1 2>\u002Fdev\u002Fnull | awk 'NR>1 {print $2}' | sort -u | \\\n  while read pid; do\n    echo \"PID $pid: $(cat \u002Fproc\u002F$pid\u002Fcmdline 2>\u002Fdev\u002Fnull | tr '\\0' ' ')\"\n  done\n```\n\n### Timeline Analysis\n```bash\n# Recently modified files (last 24 hours) — anomaly detection\nfind \u002F -xdev -newer \u002Ftmp\u002Fbaseline_marker -type f \\\n  -not -path \"*\u002Fproc\u002F*\" -not -path \"*\u002Fsys\u002F*\" 2>\u002Fdev\u002Fnull | \\\n  xargs stat -c \"%Y %n\" 2>\u002Fdev\u002Fnull | sort -rn | head -30\n\n# Create fresh marker for delta baseline\ntouch -t \"$(date -d '24 hours ago' '+%Y%m%d%H%M.%S')\" \u002Ftmp\u002Fbaseline_marker\n\n# MAC time on critical files\nstat \u002Fetc\u002Fpasswd \u002Fetc\u002Fshadow \u002Fetc\u002Fcrontab \\\n  \u002Fetc\u002Fsudoers \u002Fbin\u002Fbash \u002Fbin\u002Fsh \u002Fsbin\u002Finit 2>\u002Fdev\u002Fnull | \\\n  grep -E \"(File:|Modify:|Change:|Access:)\"\n\n# Files modified after package install timestamps (potential tampering)\nLATEST_PKG=$(stat -c \"%Y\" \u002Fvar\u002Flibs\u002Fpacman\u002Flocal\u002F*\u002Fdesc 2>\u002Fdev\u002Fnull | sort -rn | head -1)\nfind \u002Fbin \u002Fsbin \u002Fusr\u002Fbin \u002Fusr\u002Flibs -newer \u002Ftmp\u002Fpkg_marker \\\n  -type f 2>\u002Fdev\u002Fnull | head -20\n```\n\n### Filesystem Integrity\n```bash\n# AIDE integrity check (if installed)\naide --check 2>\u002Fdev\u002Fnull | tail -20\n\n# Verify package file checksums (pacman)\npacman -Qk 2>\u002Fdev\u002Fnull | grep \"warning\\|error\" | head -20\n\n# Check for modified ELF binaries in system paths\nfor bin in \u002Fbin \u002Fsbin \u002Fusr\u002Fbin \u002Fusr\u002Fsbin; do\n  find \"$bin\" -type f -name \"*.so*\" -newer \u002Ftmp\u002Fbaseline_marker 2>\u002Fdev\u002Fnull | head -5\ndone\n\n# \u002Fproc consistency — hidden processes (compare \u002Fproc PIDs vs ps)\nps -eo pid --no-headers | sort > \u002Ftmp\u002Fps_pids.txt\nls \u002Fproc | grep -E '^[0-9]+$' | sort > \u002Ftmp\u002Fproc_pids.txt\ncomm -23 \u002Ftmp\u002Fproc_pids.txt \u002Ftmp\u002Fps_pids.txt | head -10  # PIDs in \u002Fproc but not in ps\n```\n\n---\n\n## MITRE ATT&CK Mapping\n\n| Finding | Technique |\n|---------|-----------|\n| SUID binary added | T1548.001 – Setuid and Setgid |\n| Executable in \u002Ftmp \u002F \u002Fdev\u002Fshm | T1059 – Command and Scripting Interpreter |\n| Deleted-but-open malware file | T1070.004 – File Deletion |\n| MAC time tampering | T1070.006 – Timestomping |\n| Hidden file in system directory | T1564.001 – Hidden Files and Directories |\n| Immutable flag on malicious file | T1562 – Impair Defenses |\n| Hardlink to privileged binary | T1548 – Abuse Elevation Control Mechanism |\n\n---\n\n## Rules for Agents\n\n1. Always compare against stored FilesystemBaseline — changes without known updates = **MEDIUM+**\n2. SUID binaries not in baseline = **HIGH** immediately\n3. Executables in `\u002Ftmp`, `\u002Fdev\u002Fshm`, `\u002Frun` = **HIGH** unless explicitly whitelisted\n4. Log all anomalous files with SHA-256 hash, path, permissions, and owner to `iocs.md`\n5. Never delete suspicious files — preserve with `cp --preserve=all`\n6. Sync all filesystem IOCs to shared memory at session end\n","# Filesystem Recon\n\n**Purpose:** Focused, fast filesystem triage with forensic-safe defaults. Baseline comparison, anomaly detection, and timeline-first evidence collection.\n\n---\n\n## Core Focus Areas\n\n- **Baseline delta**: Compare live state against stored PersistenceBaseline\u002FFilesystemBaseline\n- **SUID\u002FSGID audit**: All setuid\u002Fsetgid binaries, world-writable directories\n- **Hidden files**: `.` prefix, unusual names, high-entropy filenames, files in `\u002Fdev`, `\u002Fproc`, `\u002Ftmp`\n- **Inode anomalies**: Hardlinks to privileged files, inode number gaps, journal inconsistencies\n- **Extended attributes**: `lsattr`\u002F`getfattr` for hidden immutable\u002Fappend-only flags\n- **Deleted-but-open files**: `lsof +L1` for malware keeping deleted files open\n- **Timeline forensics**: mtime\u002Fatime\u002Fctime analysis, MAC time tampering detection\n- **Temporary directories**: Executable payloads in `\u002Ftmp`, `\u002Fvar\u002Ftmp`, `\u002Fdev\u002Fshm`, `\u002Frun`\n\n---\n\n## Key Techniques & Tools\n\n### SUID\u002FSGID & Permission Audit\n```bash\n# All SUID binaries (compare against baseline)\nfind \u002F -xdev -perm \u002F4000 -type f 2>\u002Fdev\u002Fnull | sort > \u002Ftmp\u002Fsuid_live.txt\ndiff \u002Ftmp\u002Fsuid_baseline.txt \u002Ftmp\u002Fsuid_live.txt 2>\u002Fdev\u002Fnull || \\\n  cat \u002Ftmp\u002Fsuid_live.txt | head -30\n\n# SGID binaries\nfind \u002F -xdev -perm \u002F2000 -type f 2>\u002Fdev\u002Fnull | sort | head -20\n\n# World-writable files outside \u002Ftmp (suspicious)\nfind \u002F -xdev -perm \u002F0002 -not -path \"*\u002Fproc\u002F*\" -not -path \"*\u002Ftmp\u002F*\" \\\n  -not -path \"*\u002Fsys\u002F*\" -type f 2>\u002Fdev\u002Fnull | head -20\n\n# World-writable directories\nfind \u002F -xdev -perm \u002F0002 -type d -not -path \"*\u002Fproc\u002F*\" \\\n  -not -path \"*\u002Ftmp\" -not -path \"*\u002Fsys\u002F*\" 2>\u002Fdev\u002Fnull | head -15\n\n# Files owned by root but writable by others\nfind \u002Fusr \u002Fbin \u002Fsbin \u002Fetc -xdev -writable -not -user root 2>\u002Fdev\u002Fnull | head -10\n```\n\n### Hidden & Suspicious Files\n```bash\n# Executable files in temp directories\nfind \u002Ftmp \u002Fvar\u002Ftmp \u002Fdev\u002Fshm \u002Frun -type f -executable 2>\u002Fdev\u002Fnull | \\\n  while read f; do\n    echo \"EXEC in tmp: $f ($(stat -c '%a %U %G' \"$f\"))\"\n    file \"$f\" 2>\u002Fdev\u002Fnull | grep -v \"ASCII\\|text\"\n  done\n\n# High-entropy filenames (base64\u002Fhex names)\nfind \u002F -maxdepth 5 -name \"*=*\" -o -name \".[a-f0-9][a-f0-9][a-f0-9][a-f0-9]*\" \\\n  2>\u002Fdev\u002Fnull | grep -v \"\u002Fproc\\|\u002Fsys\" | head -20\n\n# Files with spaces or unusual characters in name\nfind \u002Ftmp \u002Fvar\u002Ftmp \u002Fhome \u002Fetc -name \"* *\" -o -name \"*[[:cntrl:]]*\" 2>\u002Fdev\u002Fnull | \\\n  head -10\n\n# Dot-files in unusual system directories\nfind \u002Fbin \u002Fsbin \u002Fusr\u002Fbin \u002Fusr\u002Fsbin -name \".*\" 2>\u002Fdev\u002Fnull | head -10\n\n# Files in \u002Fdev that aren't devices\nfind \u002Fdev -not -type b -not -type c -not -type d -not -type l \\\n  -not -name \"fd\" -not -name \"stdin\" -not -name \"stdout\" 2>\u002Fdev\u002Fnull | head -10\n```\n\n### Inode & Extended Attributes\n```bash\n# Files with multiple hardlinks (potential rootkit technique)\nfind \u002F -xdev -links +3 -type f -not -path \"*\u002Fproc\u002F*\" 2>\u002Fdev\u002Fnull | \\\n  while read f; do\n    n=$(stat -c '%h' \"$f\")\n    echo \"HARDLINKS($n): $f\"\n  done | head -20\n\n# Extended attributes (hidden data, immutable flags)\nlsattr -R \u002Fetc \u002Fbin \u002Fsbin \u002Fusr\u002Fbin 2>\u002Fdev\u002Fnull | grep -v \"^lsattr\\|^---\" | \\\n  grep -E \"^.{4}i|^.{4}a|^.{4}s\" | head -20\n\n# User extended attributes (xattr) — can hide data\ngetfattr -R -n user.* \u002Fhome \u002Ftmp 2>\u002Fdev\u002Fnull | head -20\n\n# Immutable system files that shouldn't be\nlsattr \u002Fetc\u002Fpasswd \u002Fetc\u002Fshadow \u002Fetc\u002Fsudoers 2>\u002Fdev\u002Fnull\n```\n\n### Deleted-But-Open Files\n```bash\n# Files deleted but kept open by processes (rootkit\u002Fmalware pattern)\nlsof +L1 2>\u002Fdev\u002Fnull | grep -v \"^lsof\" | head -30\n\n# Cross-reference PIDs with process info\nlsof +L1 2>\u002Fdev\u002Fnull | awk 'NR>1 {print $2}' | sort -u | \\\n  while read pid; do\n    echo \"PID $pid: $(cat \u002Fproc\u002F$pid\u002Fcmdline 2>\u002Fdev\u002Fnull | tr '\\0' ' ')\"\n  done\n```\n\n### Timeline Analysis\n```bash\n# Recently modified files (last 24 hours) — anomaly detection\nfind \u002F -xdev -newer \u002Ftmp\u002Fbaseline_marker -type f \\\n  -not -path \"*\u002Fproc\u002F*\" -not -path \"*\u002Fsys\u002F*\" 2>\u002Fdev\u002Fnull | \\\n  xargs stat -c \"%Y %n\" 2>\u002Fdev\u002Fnull | sort -rn | head -30\n\n# Create fresh marker for delta baseline\ntouch -t \"$(date -d '24 hours ago' '+%Y%m%d%H%M.%S')\" \u002Ftmp\u002Fbaseline_marker\n\n# MAC time on critical files\nstat \u002Fetc\u002Fpasswd \u002Fetc\u002Fshadow \u002Fetc\u002Fcrontab \\\n  \u002Fetc\u002Fsudoers \u002Fbin\u002Fbash \u002Fbin\u002Fsh \u002Fsbin\u002Finit 2>\u002Fdev\u002Fnull | \\\n  grep -E \"(File:|Modify:|Change:|Access:)\"\n\n# Files modified after package install timestamps (potential tampering)\nLATEST_PKG=$(stat -c \"%Y\" \u002Fvar\u002Flibs\u002Fpacman\u002Flocal\u002F*\u002Fdesc 2>\u002Fdev\u002Fnull | sort -rn | head -1)\nfind \u002Fbin \u002Fsbin \u002Fusr\u002Fbin \u002Fusr\u002Flibs -newer \u002Ftmp\u002Fpkg_marker \\\n  -type f 2>\u002Fdev\u002Fnull | head -20\n```\n\n### Filesystem Integrity\n```bash\n# AIDE integrity check (if installed)\naide --check 2>\u002Fdev\u002Fnull | tail -20\n\n# Verify package file checksums (pacman)\npacman -Qk 2>\u002Fdev\u002Fnull | grep \"warning\\|error\" | head -20\n\n# Check for modified ELF binaries in system paths\nfor bin in \u002Fbin \u002Fsbin \u002Fusr\u002Fbin \u002Fusr\u002Fsbin; do\n  find \"$bin\" -type f -name \"*.so*\" -newer \u002Ftmp\u002Fbaseline_marker 2>\u002Fdev\u002Fnull | head -5\ndone\n\n# \u002Fproc consistency — hidden processes (compare \u002Fproc PIDs vs ps)\nps -eo pid --no-headers | sort > \u002Ftmp\u002Fps_pids.txt\nls \u002Fproc | grep -E '^[0-9]+$' | sort > \u002Ftmp\u002Fproc_pids.txt\ncomm -23 \u002Ftmp\u002Fproc_pids.txt \u002Ftmp\u002Fps_pids.txt | head -10  # PIDs in \u002Fproc but not in ps\n```\n\n---\n\n## MITRE ATT&CK Mapping\n\n| Finding | Technique |\n|---------|-----------|\n| SUID binary added | T1548.001 – Setuid and Setgid |\n| Executable in \u002Ftmp \u002F \u002Fdev\u002Fshm | T1059 – Command and Scripting Interpreter |\n| Deleted-but-open malware file | T1070.004 – File Deletion |\n| MAC time tampering | T1070.006 – Timestomping |\n| Hidden file in system directory | T1564.001 – Hidden Files and Directories |\n| Immutable flag on malicious file | T1562 – Impair Defenses |\n| Hardlink to privileged binary | T1548 – Abuse Elevation Control Mechanism |\n\n---\n\n## Rules for Agents\n\n1. Always compare against stored FilesystemBaseline — changes without known updates = **MEDIUM+**\n2. SUID binaries not in baseline = **HIGH** immediately\n3. Executables in `\u002Ftmp`, `\u002Fdev\u002Fshm`, `\u002Frun` = **HIGH** unless explicitly whitelisted\n4. Log all anomalous files with SHA-256 hash, path, permissions, and owner to `iocs.md`\n5. Never delete suspicious files — preserve with `cp --preserve=all`\n6. Sync all filesystem IOCs to shared memory at session end\n",{"name":5,"tags":44,"capec":45,"model":46,"tools":47,"skills":52,"maxTurns":55,"nist_csf":56,"description":7,"mitre_attack":57},[36,20,22,24],[],"sonnet",[48,33,49,50,51],"Read","Glob","Grep","WebSearch",[53,54],"shared-memory","threats\u002Fmitre-attack-mapper",30,[],[58,59,60],"T1059","T1548.001","T1595","main","a91f1293287ffa9f4f1b8f486cd6e835a1568c84","skills\u002Fsoc\u002Fforensics\u002Finvestigation\u002Fforensic","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace","https:\u002F\u002Fgithub.com\u002FDCx7C5","#Python","2026-09-01 11:21:00",{"source":8,"skillName":5,"commands":69,"prompt":79,"zipAvailable":80},[70,73,76],{"tool":71,"command":72},"npx","npx skills add DCx7C5\u002Fai-marketplace --skill forensics-investigation-forensic",{"tool":74,"command":75},"bunx","bunx skills add DCx7C5\u002Fai-marketplace --skill forensics-investigation-forensic",{"tool":77,"command":78},"pnpm","pnpm dlx skills add DCx7C5\u002Fai-marketplace --skill forensics-investigation-forensic","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fsoc\u002Fforensics\u002Finvestigation\u002Fforensic\u002FSKILL.md",true,[82],{"path":83,"resourceType":84,"resourceTypeDesc":85,"sizeBytes":86,"sourceHtmlUrl":87},"index.json","REFERENCE","参考文档",703,"https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fsoc\u002Fforensics\u002Finvestigation\u002Fforensic\u002Findex.json",[89,114,135,156,178,193],{"skillNo":90,"name":91,"nameZh":6,"description":92,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":93,"categories":94,"keywords":95,"publishedAt":39},"01M71HAPZ01KQ30RKTB0FFSQ05","services-wmi-persistence-detect","Detect WMI event subscription persistence by enumerating ActiveScriptEventConsumer, CommandLineEventConsumer, and permanent subscriptions in the WMI repository.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fservices\u002Fwmi\u002Fpersistence\u002Fdetect\u002FSKILL.md",[],[96,97,98,99,100,101,102,103,104,105,106,107,108,109,110,111,20,112,113],"services","detect","services wmi persistence detect","wmi","persistence","de","cm","process","activescript","event","subscriptions","commandline-consumer","repository","subscription","event-subscription","t1546.003","cybersecurity","process-forensics",{"skillNo":115,"name":116,"nameZh":6,"description":117,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":118,"categories":119,"keywords":120,"publishedAt":39},"01M71HAK6JTTTS229T17WJMMCG","services-wmi-exec-exploit","Perform lateral movement across Windows networks using WMI-based remote execution techniques including Impacket wmiexec.py, CrackMapExec, and native WMI commands for stealthy post-exploitation during red team engagements.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fservices\u002Fwmi\u002Fexec\u002Fexploit\u002FSKILL.md",[],[121,96,122,99,123,124,125,112,33,35,126,127,128,129,101,130,131,132,133,134],"exploit","services wmi exec exploit","exec","remote","traffic","team","across","crackmapexec","native","command","lateral movement","read","lateral-movement","Impacket",{"skillNo":136,"name":137,"nameZh":6,"description":138,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":139,"categories":140,"keywords":141,"publishedAt":39},"01M71HAG6MHKNQV8KDZKMT4886","registry-artifact-extract","Extract and analyze Windows Registry hives to uncover user activity, installed software, autostart entries, and evidence of system compromise.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fregistry\u002Fartifact\u002Fextract\u002FSKILL.md",[],[142,143,144,145,146,147,112,33,148,35,149,150,101,132,151,152,153,154,155,46],"artifact","registry","registry artifact extract","extract","evidence-collection","artifact-analysis","collection","analyze","uncover","software","activity","digital-forensics","windows-registry","regripper",{"skillNo":157,"name":158,"nameZh":6,"description":159,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":160,"categories":161,"keywords":162,"publishedAt":39},"01M71HACR4A8XTWTTSXK4124AA","processes-token-impersonate-detect","Detect Windows token impersonation and privilege abuse including SeImpersonatePrivilege exploitation via Potato attacks and token stealing techniques.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fprocesses\u002Ftoken\u002Fimpersonate\u002Fdetect\u002FSKILL.md",[],[97,163,164,165,166,167,168,102,169,112,113,170,171,172,173,174,175,176,177,101],"processes token impersonate detect","token","processes","attacks","windows","escalation","techniques","privilege-escalation","seimpersonate","token-impersonation","printspoofer","exploitation","potato","impersonation","via",{"skillNo":179,"name":180,"nameZh":6,"description":181,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":182,"categories":183,"keywords":184,"publishedAt":39},"01M71HAABSB4Z6QFSXEG00R4RK","processes-thread-injection-detect","Detect Windows thread injection techniques including CreateRemoteThread, QueueUserAPC, NtCreateThreadEx, and thread hijacking via process memory analysis.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fprocesses\u002Fthread\u002Finjection\u002Fdetect\u002FSKILL.md",[],[185,186,97,187,165,167,31,102,188,169,112,113,35,189,190,191,192,177,101,103],"thread","processes thread injection detect","injection","process-injection","api","apc-injection","thread-injection","nt-api",{"skillNo":194,"name":195,"nameZh":6,"description":196,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":197,"categories":198,"keywords":199,"publishedAt":39},"01M71HA7H311V5G14WMX58HQSS","processes-hollow-technique-detect","Detect process hollowing (RunPE) by identifying processes with mismatched image paths between PEB and VAD tree, or unmapped PE headers in memory.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fprocesses\u002Fhollow\u002Ftechnique\u002Fdetect\u002FSKILL.md",[],[200,97,165,201,31,102,202,203,112,113,204,205,206,207,208,209,101,103,210,211],"processes hollow technique detect","tree","memory-forensics","process-hollow","peb","runpe","image","pe-header","in memory","with","mismatched","headers"]