[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M71G9VYWZ2P7WRPYRHJJCDEX":3,"skill-same:01M71G9VYWZ2P7WRPYRHJJCDEX":96},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":18,"publishedAt":39,"linkOnly":40,"markdownContent":41,"markdownBody":42,"frontMatter":43,"refName":69,"commitSha":70,"skillDirectory":71,"forksCount":14,"repositoryHtmlUrl":72,"repositoryHomepageUrl":6,"ownerHtmlUrl":73,"ownerBlogUrl":6,"ownerDescription":74,"updatedAt":75,"install":76,"resources":89},"01M71G9VYWZ2P7WRPYRHJJCDEX","tuning-false-positive-reduction-detect",null,"Perform systematic SIEM false positive reduction through rule tuning, threshold adjustment, correlation refinement, and threat intelligence enrichment to combat alert fatigue.","DCx7C5\u002Fai-marketplace","DCx7C5","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F42419559?v=4","01M71C01G2AZV3NTNGWAWSHJPP","DC","01M71C01GQW6G50S2BYMS7PP3E",0,"MIT","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fsoc\u002Ftuning\u002Ffalse-positive-reduction\u002Fdetect\u002FSKILL.md",[],[19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38],"tuning false positive reduction detect","tuning","detect","false","false-positive","token","alert-fatigue","read","systematic","de","threat intelligence","siem","ComBat","soc","Bash","access","cybersecurity","authentication","cm","detection-engineering","2026-11-10 10:12:30",false,"---\nname: tuning-false-positive-reduction-detect\ndescription: Perform systematic SIEM false positive reduction through rule tuning, threshold adjustment, correlation refinement, and threat intelligence enrichment to combat alert fatigue.\ndomain: cybersecurity\nsubdomain: soc-operations\ntags:\n- siem\n- false-positive\n- alert-tuning\n- detection-engineering\n- alert-fatigue\n- soc\n- correlation\nd3fend_techniques:\n- Token Binding\n- Restore Access\n- Password Authentication\n- Reissue Credential\n- Strong Password Policy\nnist_csf:\n- DE.CM-01\n- DE.AE-02\n- RS.MA-01\n- DE.AE-06\nmodel: sonnet\nmaxTurns: 20\ntools: [Read, Bash, Glob, Grep]\nmitre_attack:\n- T1059\n- T1070\ncapec: []\n---\n\n# Performing False Positive Reduction in SIEM\n\n## Overview\n\nFalse positive alerts are non-malicious events that trigger security rules, overwhelming SOC analysts with noise. Studies show that up to 45% of SIEM alerts are false positives, and a typical SOC analyst can only investigate 20-25 alerts per shift effectively. Reducing false positives requires systematic tuning across thresholds, correlation logic, allowlists, enrichment, and continuous validation. SIEM rules should be reviewed on a quarterly cycle at minimum.\n\n\n## When to Use\n\n- When conducting security assessments that involve performing false positive reduction in siem\n- When following incident response procedures for related security events\n- When performing scheduled security testing or auditing activities\n- When validating security controls through hands-on testing\n\n## Prerequisites\n\n- Familiarity with soc operations concepts and tools\n- Access to a test or lab environment for safe execution\n- Python 3.8+ with required dependencies installed\n- Appropriate authorization for any testing activities\n\n## False Positive Reduction Techniques\n\n### 1. Identify the Noisiest Rules\n\n```spl\n# Splunk - Top 10 noisiest correlation searches\nindex=notable\n| stats count by rule_name\n| sort -count\n| head 10\n| eval pct=round(count \u002F total * 100, 1)\n```\n\n```spl\n# False positive rate per rule\nindex=notable\n| stats count as total\n    count(eval(status_label=\"Closed - False Positive\")) as false_positives\n    count(eval(status_label=\"Closed - True Positive\")) as true_positives\n    by rule_name\n| eval fp_rate=round(false_positives \u002F total * 100, 1)\n| sort -fp_rate\n| where total > 10\n```\n\n### 2. Threshold Tuning\n\n```spl\n# Before: Too sensitive - fires on 5 failed logins\nindex=wineventlog EventCode=4625\n| stats count by src_ip\n| where count > 5\n\n# After: Tuned - requires 20+ failures across 3+ accounts in 10 minutes\nindex=wineventlog EventCode=4625\n| bin _time span=10m\n| stats count dc(TargetUserName) as unique_accounts by src_ip, _time\n| where count > 20 AND unique_accounts > 3\n```\n\n### 3. Allowlist\u002FExclusion Management\n\n```spl\n# Create allowlist lookup for known benign sources\n| inputlookup fp_allowlist.csv\n| fields src_ip, reason, approved_by, expiry_date\n\n# Apply allowlist in detection rule\nindex=wineventlog EventCode=4625\n| lookup fp_allowlist src_ip OUTPUT reason as allowlisted_reason\n| where isnull(allowlisted_reason)\n| stats count dc(TargetUserName) as unique_accounts by src_ip\n| where count > 20 AND unique_accounts > 3\n```\n\n### 4. Correlation Enhancement\n\n```spl\n# Before: Single-event detection (noisy)\nindex=wineventlog EventCode=4688 New_Process_Name=\"*powershell.exe\"\n| eval severity=\"medium\"\n\n# After: Multi-signal correlation (precise)\nindex=wineventlog EventCode=4688 New_Process_Name=\"*powershell.exe\"\n| join src_ip type=left [\n    search index=wineventlog EventCode=4625\n    | stats count as failed_logins by src_ip\n]\n| join Computer type=left [\n    search index=sysmon EventCode=3\n    | stats dc(DestinationIp) as unique_external_connections by Computer\n    | where unique_external_connections > 10\n]\n| where isnotnull(failed_logins) OR unique_external_connections > 10\n| eval severity=case(\n    failed_logins > 10 AND unique_external_connections > 10, \"critical\",\n    failed_logins > 5 OR unique_external_connections > 5, \"high\",\n    true(), \"medium\"\n)\n```\n\n### 5. Time-Based Exclusions\n\n```spl\n# Exclude known maintenance windows\n| eval hour=strftime(_time, \"%H\")\n| eval day=strftime(_time, \"%A\")\n| where NOT (hour >= \"02\" AND hour \u003C= \"04\" AND day=\"Sunday\")\n\n# Exclude known batch job schedules\n| lookup scheduled_tasks_allowlist process_name, schedule_time\n    OUTPUT is_scheduled\n| where isnull(is_scheduled)\n```\n\n### 6. Behavioral Baseline Integration\n\n```spl\n# Build baseline for user login patterns\nindex=wineventlog EventCode=4624\n| bin _time span=1h\n| stats count as logins dc(Computer) as unique_hosts by TargetUserName, _time\n| eventstats avg(logins) as avg_logins stdev(logins) as stdev_logins\n    avg(unique_hosts) as avg_hosts stdev(unique_hosts) as stdev_hosts\n    by TargetUserName\n| where logins > (avg_logins + 3 * stdev_logins)\n    OR unique_hosts > (avg_hosts + 3 * stdev_hosts)\n```\n\n### 7. Threat Intelligence Filtering\n\n```spl\n# Only alert when destination matches known threat intelligence\nindex=firewall action=allowed direction=outbound\n| lookup ip_threat_intel_lookup ip as dest_ip OUTPUT threat_type, confidence\n| where isnotnull(threat_type) AND confidence > 70\n# This eliminates FPs from flagging connections to benign IPs\n```\n\n## Tuning Process Framework\n\n### Step 1: Identify (Weekly)\n- Pull top 10 rules by alert volume\n- Calculate FP rate for each\n- Identify rules with FP rate > 30%\n\n### Step 2: Analyze (Weekly)\n- Sample 20 false positives per rule\n- Categorize root cause of each FP\n- Identify common patterns\n\n### Step 3: Tune (Bi-weekly)\n- Adjust thresholds based on baseline data\n- Add allowlist entries for benign patterns\n- Enhance correlation logic\n- Add enrichment context\n\n### Step 4: Validate (Monthly)\n- Run Atomic Red Team tests to verify true positives still trigger\n- Calculate new FP rate after tuning\n- Document tuning rationale\n- Review with detection engineering team\n\n### Step 5: Report (Quarterly)\n- FP reduction metrics per rule\n- Overall alert volume trends\n- Analyst productivity improvements\n- Rules retired or replaced\n\n## Validation Testing\n\n```bash\n# Run Atomic Red Team test after tuning to confirm detection still works\n# Example: Test brute force detection after threshold adjustment\nInvoke-AtomicTest T1110.001 -TestNumbers 1\n```\n\n```spl\n# Verify detection still triggers after tuning\nindex=notable rule_name=\"Brute Force Detection\"\nearliest=-24h\n| stats count\n| where count > 0\n```\n\n## FP Reduction Metrics\n\n| Metric | Formula | Target |\n|---|---|---|\n| False Positive Rate | FP \u002F (FP + TP) * 100 | \u003C 20% |\n| Alert Volume Reduction | (Old Volume - New Volume) \u002F Old Volume * 100 | 30-50% per quarter |\n| Mean Triage Time | Total triage time \u002F Total alerts | \u003C 8 minutes |\n| Rule Precision | TP \u002F (TP + FP) | > 0.80 |\n| Analyst Satisfaction | Survey score | > 4\u002F5 |\n\n## References\n\n- [CyberSierra - Tune SIEM Alerts to Eliminate False Positives](https:\u002F\u002Fcybersierra.co\u002Fblog\u002Freduce-false-positives-siem\u002F)\n- [ConnectWise - 9 Ways to Eliminate SIEM False Positives](https:\u002F\u002Fwww.connectwise.com\u002Fblog\u002F9-ways-to-eliminate-siem-false-positives)\n- [Prophet Security - Alert Tuning Best Practices](https:\u002F\u002Fwww.prophetsecurity.ai\u002Fblog\u002Fsecurity-operations-center-soc-best-practices-alert-tuning)\n- [ManageEngine - Reducing SIEM Alert False Positives](https:\u002F\u002Fwww.manageengine.com\u002Flog-management\u002Fsiem\u002Freducing-siem-alert-false-positives.html)\n","# Performing False Positive Reduction in SIEM\n\n## Overview\n\nFalse positive alerts are non-malicious events that trigger security rules, overwhelming SOC analysts with noise. Studies show that up to 45% of SIEM alerts are false positives, and a typical SOC analyst can only investigate 20-25 alerts per shift effectively. Reducing false positives requires systematic tuning across thresholds, correlation logic, allowlists, enrichment, and continuous validation. SIEM rules should be reviewed on a quarterly cycle at minimum.\n\n\n## When to Use\n\n- When conducting security assessments that involve performing false positive reduction in siem\n- When following incident response procedures for related security events\n- When performing scheduled security testing or auditing activities\n- When validating security controls through hands-on testing\n\n## Prerequisites\n\n- Familiarity with soc operations concepts and tools\n- Access to a test or lab environment for safe execution\n- Python 3.8+ with required dependencies installed\n- Appropriate authorization for any testing activities\n\n## False Positive Reduction Techniques\n\n### 1. Identify the Noisiest Rules\n\n```spl\n# Splunk - Top 10 noisiest correlation searches\nindex=notable\n| stats count by rule_name\n| sort -count\n| head 10\n| eval pct=round(count \u002F total * 100, 1)\n```\n\n```spl\n# False positive rate per rule\nindex=notable\n| stats count as total\n    count(eval(status_label=\"Closed - False Positive\")) as false_positives\n    count(eval(status_label=\"Closed - True Positive\")) as true_positives\n    by rule_name\n| eval fp_rate=round(false_positives \u002F total * 100, 1)\n| sort -fp_rate\n| where total > 10\n```\n\n### 2. Threshold Tuning\n\n```spl\n# Before: Too sensitive - fires on 5 failed logins\nindex=wineventlog EventCode=4625\n| stats count by src_ip\n| where count > 5\n\n# After: Tuned - requires 20+ failures across 3+ accounts in 10 minutes\nindex=wineventlog EventCode=4625\n| bin _time span=10m\n| stats count dc(TargetUserName) as unique_accounts by src_ip, _time\n| where count > 20 AND unique_accounts > 3\n```\n\n### 3. Allowlist\u002FExclusion Management\n\n```spl\n# Create allowlist lookup for known benign sources\n| inputlookup fp_allowlist.csv\n| fields src_ip, reason, approved_by, expiry_date\n\n# Apply allowlist in detection rule\nindex=wineventlog EventCode=4625\n| lookup fp_allowlist src_ip OUTPUT reason as allowlisted_reason\n| where isnull(allowlisted_reason)\n| stats count dc(TargetUserName) as unique_accounts by src_ip\n| where count > 20 AND unique_accounts > 3\n```\n\n### 4. Correlation Enhancement\n\n```spl\n# Before: Single-event detection (noisy)\nindex=wineventlog EventCode=4688 New_Process_Name=\"*powershell.exe\"\n| eval severity=\"medium\"\n\n# After: Multi-signal correlation (precise)\nindex=wineventlog EventCode=4688 New_Process_Name=\"*powershell.exe\"\n| join src_ip type=left [\n    search index=wineventlog EventCode=4625\n    | stats count as failed_logins by src_ip\n]\n| join Computer type=left [\n    search index=sysmon EventCode=3\n    | stats dc(DestinationIp) as unique_external_connections by Computer\n    | where unique_external_connections > 10\n]\n| where isnotnull(failed_logins) OR unique_external_connections > 10\n| eval severity=case(\n    failed_logins > 10 AND unique_external_connections > 10, \"critical\",\n    failed_logins > 5 OR unique_external_connections > 5, \"high\",\n    true(), \"medium\"\n)\n```\n\n### 5. Time-Based Exclusions\n\n```spl\n# Exclude known maintenance windows\n| eval hour=strftime(_time, \"%H\")\n| eval day=strftime(_time, \"%A\")\n| where NOT (hour >= \"02\" AND hour \u003C= \"04\" AND day=\"Sunday\")\n\n# Exclude known batch job schedules\n| lookup scheduled_tasks_allowlist process_name, schedule_time\n    OUTPUT is_scheduled\n| where isnull(is_scheduled)\n```\n\n### 6. Behavioral Baseline Integration\n\n```spl\n# Build baseline for user login patterns\nindex=wineventlog EventCode=4624\n| bin _time span=1h\n| stats count as logins dc(Computer) as unique_hosts by TargetUserName, _time\n| eventstats avg(logins) as avg_logins stdev(logins) as stdev_logins\n    avg(unique_hosts) as avg_hosts stdev(unique_hosts) as stdev_hosts\n    by TargetUserName\n| where logins > (avg_logins + 3 * stdev_logins)\n    OR unique_hosts > (avg_hosts + 3 * stdev_hosts)\n```\n\n### 7. Threat Intelligence Filtering\n\n```spl\n# Only alert when destination matches known threat intelligence\nindex=firewall action=allowed direction=outbound\n| lookup ip_threat_intel_lookup ip as dest_ip OUTPUT threat_type, confidence\n| where isnotnull(threat_type) AND confidence > 70\n# This eliminates FPs from flagging connections to benign IPs\n```\n\n## Tuning Process Framework\n\n### Step 1: Identify (Weekly)\n- Pull top 10 rules by alert volume\n- Calculate FP rate for each\n- Identify rules with FP rate > 30%\n\n### Step 2: Analyze (Weekly)\n- Sample 20 false positives per rule\n- Categorize root cause of each FP\n- Identify common patterns\n\n### Step 3: Tune (Bi-weekly)\n- Adjust thresholds based on baseline data\n- Add allowlist entries for benign patterns\n- Enhance correlation logic\n- Add enrichment context\n\n### Step 4: Validate (Monthly)\n- Run Atomic Red Team tests to verify true positives still trigger\n- Calculate new FP rate after tuning\n- Document tuning rationale\n- Review with detection engineering team\n\n### Step 5: Report (Quarterly)\n- FP reduction metrics per rule\n- Overall alert volume trends\n- Analyst productivity improvements\n- Rules retired or replaced\n\n## Validation Testing\n\n```bash\n# Run Atomic Red Team test after tuning to confirm detection still works\n# Example: Test brute force detection after threshold adjustment\nInvoke-AtomicTest T1110.001 -TestNumbers 1\n```\n\n```spl\n# Verify detection still triggers after tuning\nindex=notable rule_name=\"Brute Force Detection\"\nearliest=-24h\n| stats count\n| where count > 0\n```\n\n## FP Reduction Metrics\n\n| Metric | Formula | Target |\n|---|---|---|\n| False Positive Rate | FP \u002F (FP + TP) * 100 | \u003C 20% |\n| Alert Volume Reduction | (Old Volume - New Volume) \u002F Old Volume * 100 | 30-50% per quarter |\n| Mean Triage Time | Total triage time \u002F Total alerts | \u003C 8 minutes |\n| Rule Precision | TP \u002F (TP + FP) | > 0.80 |\n| Analyst Satisfaction | Survey score | > 4\u002F5 |\n\n## References\n\n- [CyberSierra - Tune SIEM Alerts to Eliminate False Positives](https:\u002F\u002Fcybersierra.co\u002Fblog\u002Freduce-false-positives-siem\u002F)\n- [ConnectWise - 9 Ways to Eliminate SIEM False Positives](https:\u002F\u002Fwww.connectwise.com\u002Fblog\u002F9-ways-to-eliminate-siem-false-positives)\n- [Prophet Security - Alert Tuning Best Practices](https:\u002F\u002Fwww.prophetsecurity.ai\u002Fblog\u002Fsecurity-operations-center-soc-best-practices-alert-tuning)\n- [ManageEngine - Reducing SIEM Alert False Positives](https:\u002F\u002Fwww.manageengine.com\u002Flog-management\u002Fsiem\u002Freducing-siem-alert-false-positives.html)\n",{"name":5,"tags":44,"capec":47,"model":48,"tools":49,"domain":35,"maxTurns":53,"nist_csf":54,"subdomain":59,"description":7,"mitre_attack":60,"d3fend_techniques":63},[30,23,45,38,25,32,46],"alert-tuning","correlation",[],"sonnet",[50,33,51,52],"Read","Glob","Grep",20,[55,56,57,58],"DE.CM-01","DE.AE-02","RS.MA-01","DE.AE-06","soc-operations",[61,62],"T1059","T1070",[64,65,66,67,68],"Token Binding","Restore Access","Password Authentication","Reissue Credential","Strong Password Policy","main","a91f1293287ffa9f4f1b8f486cd6e835a1568c84","skills\u002Fsoc\u002Ftuning\u002Ffalse-positive-reduction\u002Fdetect","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace","https:\u002F\u002Fgithub.com\u002FDCx7C5","#Python","2026-09-01 11:21:00",{"source":8,"skillName":5,"commands":77,"prompt":87,"zipAvailable":88},[78,81,84],{"tool":79,"command":80},"npx","npx skills add DCx7C5\u002Fai-marketplace --skill tuning-false-positive-reduction-detect",{"tool":82,"command":83},"bunx","bunx skills add DCx7C5\u002Fai-marketplace --skill tuning-false-positive-reduction-detect",{"tool":85,"command":86},"pnpm","pnpm dlx skills add DCx7C5\u002Fai-marketplace --skill tuning-false-positive-reduction-detect","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fsoc\u002Ftuning\u002Ffalse-positive-reduction\u002Fdetect\u002FSKILL.md",true,[90],{"path":91,"resourceType":92,"resourceTypeDesc":93,"sizeBytes":94,"sourceHtmlUrl":95},"index.json","REFERENCE","参考文档",696,"https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fsoc\u002Ftuning\u002Ffalse-positive-reduction\u002Fdetect\u002Findex.json",[97,119,140,161,182,198],{"skillNo":98,"name":99,"nameZh":6,"description":100,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":101,"categories":102,"keywords":103,"publishedAt":39},"01M71HAPZ01KQ30RKTB0FFSQ05","services-wmi-persistence-detect","Detect WMI event subscription persistence by enumerating ActiveScriptEventConsumer, CommandLineEventConsumer, and permanent subscriptions in the WMI repository.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fservices\u002Fwmi\u002Fpersistence\u002Fdetect\u002FSKILL.md",[],[104,21,105,106,107,28,37,108,109,110,111,112,113,114,115,116,117,35,118],"services","services wmi persistence detect","wmi","persistence","process","activescript","event","subscriptions","commandline-consumer","repository","subscription","event-subscription","t1546.003","forensics","process-forensics",{"skillNo":120,"name":121,"nameZh":6,"description":122,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":123,"categories":124,"keywords":125,"publishedAt":39},"01M71HAK6JTTTS229T17WJMMCG","services-wmi-exec-exploit","Perform lateral movement across Windows networks using WMI-based remote execution techniques including Impacket wmiexec.py, CrackMapExec, and native WMI commands for stealthy post-exploitation during red team engagements.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fservices\u002Fwmi\u002Fexec\u002Fexploit\u002FSKILL.md",[],[126,104,127,106,128,129,130,35,33,131,132,133,134,135,28,136,137,26,138,139],"exploit","services wmi exec exploit","exec","remote","traffic","analysis","team","across","crackmapexec","native","command","lateral movement","lateral-movement","Impacket",{"skillNo":141,"name":142,"nameZh":6,"description":143,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":144,"categories":145,"keywords":146,"publishedAt":39},"01M71HAG6MHKNQV8KDZKMT4886","registry-artifact-extract","Extract and analyze Windows Registry hives to uncover user activity, installed software, autostart entries, and evidence of system compromise.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fregistry\u002Fartifact\u002Fextract\u002FSKILL.md",[],[147,148,149,150,151,152,35,33,153,131,154,155,28,26,156,157,158,159,160,48],"artifact","registry","registry artifact extract","extract","evidence-collection","artifact-analysis","collection","analyze","uncover","software","activity","digital-forensics","windows-registry","regripper",{"skillNo":162,"name":163,"nameZh":6,"description":164,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":165,"categories":166,"keywords":167,"publishedAt":39},"01M71HACR4A8XTWTTSXK4124AA","processes-token-impersonate-detect","Detect Windows token impersonation and privilege abuse including SeImpersonatePrivilege exploitation via Potato attacks and token stealing techniques.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fprocesses\u002Ftoken\u002Fimpersonate\u002Fdetect\u002FSKILL.md",[],[21,168,24,169,170,171,172,37,173,35,118,174,175,176,177,178,179,180,181,28],"processes token impersonate detect","processes","attacks","windows","escalation","techniques","privilege-escalation","seimpersonate","token-impersonation","printspoofer","exploitation","potato","impersonation","via",{"skillNo":183,"name":184,"nameZh":6,"description":185,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":186,"categories":187,"keywords":188,"publishedAt":39},"01M71HAABSB4Z6QFSXEG00R4RK","processes-thread-injection-detect","Detect Windows thread injection techniques including CreateRemoteThread, QueueUserAPC, NtCreateThreadEx, and thread hijacking via process memory analysis.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fprocesses\u002Fthread\u002Finjection\u002Fdetect\u002FSKILL.md",[],[189,190,21,191,169,171,192,37,193,173,35,118,131,194,195,196,197,181,28,108],"thread","processes thread injection detect","injection","memory","process-injection","api","apc-injection","thread-injection","nt-api",{"skillNo":199,"name":200,"nameZh":6,"description":201,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":202,"categories":203,"keywords":204,"publishedAt":39},"01M71HA7H311V5G14WMX58HQSS","processes-hollow-technique-detect","Detect process hollowing (RunPE) by identifying processes with mismatched image paths between PEB and VAD tree, or unmapped PE headers in memory.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fprocesses\u002Fhollow\u002Ftechnique\u002Fdetect\u002FSKILL.md",[],[205,21,169,206,192,37,207,208,35,118,209,210,211,212,213,214,28,108,215,216],"processes hollow technique detect","tree","memory-forensics","process-hollow","peb","runpe","image","pe-header","in memory","with","mismatched","headers"]