[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M71GAC047MY9MM6YA82S7B5Q":3,"skill-same:01M71GAC047MY9MM6YA82S7B5Q":182},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":23,"publishedAt":40,"linkOnly":41,"markdownContent":42,"markdownBody":43,"frontMatter":44,"refName":45,"commitSha":46,"skillDirectory":47,"forksCount":14,"repositoryHtmlUrl":48,"repositoryHomepageUrl":6,"ownerHtmlUrl":49,"ownerBlogUrl":6,"ownerDescription":50,"updatedAt":51,"install":52,"resources":65},"01M71GAC047MY9MM6YA82S7B5Q","SKILL.md-",null,">\n  Steganography reconnaissance and steganalysis. Detects hidden payloads in image, audio, video, and document carriers via entropy analysis, LSB detection, metadata anomalies, and statistical steganalysis. Maps to MITRE T1027.003 and T1001.003.","DCx7C5\u002Fai-marketplace","DCx7C5","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F42419559?v=4","01M71C01G2AZV3NTNGWAWSHJPP","DC","01M71C01GQW6G50S2BYMS7PP3E",0,"MIT","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fsteganography\u002FSKILL.md",[18],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000016","图像与多媒体","SCENARIO","使用场景",[24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39],"skill md","Video","steganography","steganalysis","entropy","Audio","payloads","document","image","analysis","maps","reconnaissance","via","hidden","detection","metadata","2026-11-10 10:12:30",false,"---\nname: SKILL.md-\ndescription: \">\\n  Steganography reconnaissance and steganalysis. Detects hidden payloads\\\n  \\ in image, audio, video, and document carriers via entropy analysis, LSB detection,\\\n  \\ metadata anomalies, and statistical steganalysis. Maps to MITRE T1027.003 and\\\n  \\ T1001.003.\"\n---\n# Steganography Recon\n\n**Purpose:** Carrier-file triage and hidden-data detection for image, audio, video, and document formats. Also covers network steganography and covert channel detection.\n\n---\n\n## Core Focus Areas\n\n- **Entropy analysis**: High-entropy regions indicating encrypted\u002Fcompressed hidden payloads\n- **LSB steganography**: Least Significant Bit hiding in PNG\u002FBMP\u002FWAV\u002Fraw pixel carriers\n- **Metadata abuse**: EXIF\u002FXMP\u002FIPTC field hiding, GPS coordinates on internal documents\n- **Audio steganography**: Phase coding, echo hiding, spread-spectrum, spectrogram image embedding\n- **Video steganography**: Frame-level hiding, DCT coefficient manipulation, subtitle stream abuse\n- **Document steganography**: White-on-white text, invisible layers, PDF stream hiding, DOCX XML abuse\n- **Network steganography**: DNS tunneling, ICMP data field abuse, HTTP header covert channels, timing channels\n\n---\n\n## Key Techniques & Tools\n\n### Entropy & Signature Analysis\n```bash\n# Measure file entropy (> 7.5 bits\u002Fbyte = suspicious)\npython3 - \u003C\u003C'EOF'\nimport sys, math, collections, os\nfor root, dirs, files in os.walk('.'):\n    for fname in files:\n        fpath = os.path.join(root, fname)\n        try:\n            data = open(fpath,'rb').read(65536)\n            if not data: continue\n            cnt = collections.Counter(data)\n            h = -sum((v\u002Flen(data))*math.log2(v\u002Flen(data)) for v in cnt.values() if v)\n            if h > 7.0:\n                print(f\"{h:.3f}  {fpath}\")\n        except: pass\nEOF\n\n# binwalk — embedded file signatures + entropy graph\nbinwalk -e -E \"$file\" 2>\u002Fdev\u002Fnull\nbinwalk --dd='.*' \"$file\" 2>\u002Fdev\u002Fnull\n\n# foremost — file carving from carrier\nforemost -i \"$file\" -o \u002Ftmp\u002Fcarved\u002F 2>\u002Fdev\u002Fnull\n```\n\n### Image Steganalysis\n```bash\n# steghide — detect embedded data (JPEG, BMP, WAV, AU)\nsteghide info \"$file\" 2>&1\n\n# stegseek — fast passphrase brute-force on steghide-protected files\nstegseek \"$file\" \u002Fusr\u002Fshare\u002Fwordlists\u002Frockyou.txt 2>\u002Fdev\u002Fnull\n\n# zsteg — PNG\u002FBMP LSB + multi-bit analysis\nzsteg -a \"$file\" 2>\u002Fdev\u002Fnull | head -30\n\n# stegoveritas — comprehensive multi-method steganalysis\nstegoveritas \"$file\" 2>\u002Fdev\u002Fnull\n\n# ExifTool — full metadata dump (GPS, Software, Comments, UserData)\nexiftool \"$file\" 2>\u002Fdev\u002Fnull | grep -v \"^ExifTool Version\"\n\n# identify (ImageMagick) — compression\u002Fgeometry anomalies\nidentify -verbose \"$file\" 2>\u002Fdev\u002Fnull | grep -E \"(Compression|Interlace|error|Comment)\"\n\n# Manual LSB extraction (PNG, first 100 rows)\npython3 -c \"\nfrom PIL import Image\nimg = Image.open('$file').convert('RGB')\npixels = list(img.getdata())[:800]\nbits = ''.join(str(p[0] & 1) for p in pixels)\nchars = [chr(int(bits[i:i+8],2)) for i in range(0,len(bits)-8,8)]\nresult = ''.join(c if 32\u003C=ord(c)\u003C127 else '.' for c in chars)\nprint('LSB RGB-R:', result[:80])\n\" 2>\u002Fdev\u002Fnull\n\n# OutGuess \u002F F5 \u002F JSteg detection pattern\nstrings \"$file\" | grep -iE \"(outguess|jsteg|f5|steghide|openstego)\" | head -5\n```\n\n### Audio Steganography\n```bash\n# Spectrogram — reveals images hidden in frequency domain (SoX)\nsox \"$file\" -n spectrogram -o \u002Ftmp\u002Fspectrogram_$(basename \"$file\").png 2>\u002Fdev\u002Fnull\necho \"Spectrogram saved: \u002Ftmp\u002Fspectrogram_$(basename $file).png\"\n\n# WAV LSB extraction\npython3 -c \"\nimport wave, struct\nwith wave.open('$file') as wf:\n    frames = wf.readframes(2000)\ndata = struct.unpack(f'{len(frames)}B', frames)\nbits = ''.join(str(b & 1) for b in data[:1600])\nchars = [chr(int(bits[i:i+8],2)) for i in range(0,len(bits)-8,8)]\nprint('WAV LSB:', ''.join(c if 32\u003C=ord(c)\u003C127 else '.' for c in chars[:80]))\n\" 2>\u002Fdev\u002Fnull\n\n# MP3 ID3 tag analysis for hidden payloads\npython3 -c \"\nfrom mutagen.id3 import ID3\ntags = ID3('$file')\nfor k,v in tags.items():\n    if len(str(v)) > 50: print(f'{k}: {str(v)[:200]}')\n\" 2>\u002Fdev\u002Fnull\n```\n\n### Document Steganography\n```bash\n# PDF — count and inspect streams\npython3 -c \"\nimport re, zlib\ndata = open('$file','rb').read()\nstreams = re.findall(b'stream\\r?\\n(.*?)\\r?\\nendstream', data, re.DOTALL)\nprint(f'{len(streams)} PDF streams found')\nfor i, s in enumerate(streams[:5]):\n    try:\n        dec = zlib.decompress(s)\n        print(f'  Stream {i}: {dec[:120]}')\n    except: print(f'  Stream {i}: raw len={len(s)}')\n\" 2>\u002Fdev\u002Fnull\n\n# DOCX\u002FXLSX\u002FPPTX — extract XML and check for hidden text\nunzip -l \"$file\" 2>\u002Fdev\u002Fnull | grep \"\\.xml\"\nunzip -p \"$file\" word\u002Fdocument.xml 2>\u002Fdev\u002Fnull | \\\n  python3 -c \"import sys; from xml.dom.minidom import parseString; \\\n    print(parseString(sys.stdin.read()).toprettyxml())\" 2>\u002Fdev\u002Fnull | \\\n  grep -iE '(FFFFFF|color.*fff|font-size.*0|hidden)' | head -10\n\n# exiftool on document metadata\nexiftool \"$file\" 2>\u002Fdev\u002Fnull | grep -iE \"(author|creator|last.modified|company|comment|subject)\"\n```\n\n### Network Steganography Detection\n```bash\n# DNS covert channel — long\u002Fhigh-entropy subdomains\ntshark -r capture.pcap -Y \"dns.qry.type == 1\" \\\n  -T fields -e dns.qry.name 2>\u002Fdev\u002Fnull | \\\n  awk 'length($1) > 40 || $1 ~ \u002F[0-9a-f]{32}\u002F' | sort | uniq -c | sort -rn | head -20\n\n# ICMP data field abuse\ntcpdump -r capture.pcap -X 'icmp[icmptype] == icmp-echo' 2>\u002Fdev\u002Fnull | \\\n  grep -A2 \"0x0020\" | head -40\n\n# HTTP header covert channels (unusual X- headers or ordering)\ntshark -r capture.pcap -Y \"http.request\" -T fields \\\n  -e http.host -e http.user_agent -e http.x_forwarded_for 2>\u002Fdev\u002Fnull | \\\n  awk 'NF' | head -30\n\n# Timing-based covert channel (inter-packet delta analysis)\ntshark -r capture.pcap -T fields -e frame.time_relative \\\n  -e ip.src -e ip.dst 2>\u002Fdev\u002Fnull | \\\n  python3 -c \"\nimport sys\ndeltas=[]\nprev=0.0\nfor line in sys.stdin:\n    parts=line.split()\n    if not parts: continue\n    try: t=float(parts[0]); deltas.append(t-prev); prev=t\n    except: pass\nif deltas:\n    avg=sum(deltas)\u002Flen(deltas)\n    outliers=[d for d in deltas if abs(d-avg) > 3*avg]\n    print(f'Timing outliers: {len(outliers)}\u002F{len(deltas)} ({100*len(outliers)\u002F\u002Flen(deltas)}%)')\n\" 2>\u002Fdev\u002Fnull\n```\n\n---\n\n## MITRE ATT&CK Mapping\n\n| Finding | Technique |\n|---------|-----------|\n| Hidden payload in image\u002Faudio\u002Fvideo | T1027.003 – Steganography |\n| C2 channel via steganographic images | T1001.003 – Protocol Impersonation |\n| Data exfiltration via steganography | T1048 – Exfiltration Over Alternative Protocol |\n| Binary padding \u002F null byte injection | T1027.001 – Binary Padding |\n| DNS tunneling covert channel | T1071.004 – DNS |\n| ICMP covert channel | T1095 – Non-Application Layer Protocol |\n\n---\n\n## Rules for Agents\n\n1. Always run entropy analysis first — flag files > 7.5 bits\u002Fbyte for deeper triage\n2. Check EXIF metadata for GPS coordinates on files from internal systems\n3. Run binwalk on all suspicious images, audio, and documents\n4. Log carrier file SHA-256 and confirmed\u002Fsuspected steg method to `iocs.md`\n5. For extracted payloads, treat as new evidence — hand to @reverse-engineer or @memory-analyst\n6. On network captures, check DNS query lengths and ICMP payload sizes\n7. Sync all steg-related IOCs to shared memory at session end\n","# Steganography Recon\n\n**Purpose:** Carrier-file triage and hidden-data detection for image, audio, video, and document formats. Also covers network steganography and covert channel detection.\n\n---\n\n## Core Focus Areas\n\n- **Entropy analysis**: High-entropy regions indicating encrypted\u002Fcompressed hidden payloads\n- **LSB steganography**: Least Significant Bit hiding in PNG\u002FBMP\u002FWAV\u002Fraw pixel carriers\n- **Metadata abuse**: EXIF\u002FXMP\u002FIPTC field hiding, GPS coordinates on internal documents\n- **Audio steganography**: Phase coding, echo hiding, spread-spectrum, spectrogram image embedding\n- **Video steganography**: Frame-level hiding, DCT coefficient manipulation, subtitle stream abuse\n- **Document steganography**: White-on-white text, invisible layers, PDF stream hiding, DOCX XML abuse\n- **Network steganography**: DNS tunneling, ICMP data field abuse, HTTP header covert channels, timing channels\n\n---\n\n## Key Techniques & Tools\n\n### Entropy & Signature Analysis\n```bash\n# Measure file entropy (> 7.5 bits\u002Fbyte = suspicious)\npython3 - \u003C\u003C'EOF'\nimport sys, math, collections, os\nfor root, dirs, files in os.walk('.'):\n    for fname in files:\n        fpath = os.path.join(root, fname)\n        try:\n            data = open(fpath,'rb').read(65536)\n            if not data: continue\n            cnt = collections.Counter(data)\n            h = -sum((v\u002Flen(data))*math.log2(v\u002Flen(data)) for v in cnt.values() if v)\n            if h > 7.0:\n                print(f\"{h:.3f}  {fpath}\")\n        except: pass\nEOF\n\n# binwalk — embedded file signatures + entropy graph\nbinwalk -e -E \"$file\" 2>\u002Fdev\u002Fnull\nbinwalk --dd='.*' \"$file\" 2>\u002Fdev\u002Fnull\n\n# foremost — file carving from carrier\nforemost -i \"$file\" -o \u002Ftmp\u002Fcarved\u002F 2>\u002Fdev\u002Fnull\n```\n\n### Image Steganalysis\n```bash\n# steghide — detect embedded data (JPEG, BMP, WAV, AU)\nsteghide info \"$file\" 2>&1\n\n# stegseek — fast passphrase brute-force on steghide-protected files\nstegseek \"$file\" \u002Fusr\u002Fshare\u002Fwordlists\u002Frockyou.txt 2>\u002Fdev\u002Fnull\n\n# zsteg — PNG\u002FBMP LSB + multi-bit analysis\nzsteg -a \"$file\" 2>\u002Fdev\u002Fnull | head -30\n\n# stegoveritas — comprehensive multi-method steganalysis\nstegoveritas \"$file\" 2>\u002Fdev\u002Fnull\n\n# ExifTool — full metadata dump (GPS, Software, Comments, UserData)\nexiftool \"$file\" 2>\u002Fdev\u002Fnull | grep -v \"^ExifTool Version\"\n\n# identify (ImageMagick) — compression\u002Fgeometry anomalies\nidentify -verbose \"$file\" 2>\u002Fdev\u002Fnull | grep -E \"(Compression|Interlace|error|Comment)\"\n\n# Manual LSB extraction (PNG, first 100 rows)\npython3 -c \"\nfrom PIL import Image\nimg = Image.open('$file').convert('RGB')\npixels = list(img.getdata())[:800]\nbits = ''.join(str(p[0] & 1) for p in pixels)\nchars = [chr(int(bits[i:i+8],2)) for i in range(0,len(bits)-8,8)]\nresult = ''.join(c if 32\u003C=ord(c)\u003C127 else '.' for c in chars)\nprint('LSB RGB-R:', result[:80])\n\" 2>\u002Fdev\u002Fnull\n\n# OutGuess \u002F F5 \u002F JSteg detection pattern\nstrings \"$file\" | grep -iE \"(outguess|jsteg|f5|steghide|openstego)\" | head -5\n```\n\n### Audio Steganography\n```bash\n# Spectrogram — reveals images hidden in frequency domain (SoX)\nsox \"$file\" -n spectrogram -o \u002Ftmp\u002Fspectrogram_$(basename \"$file\").png 2>\u002Fdev\u002Fnull\necho \"Spectrogram saved: \u002Ftmp\u002Fspectrogram_$(basename $file).png\"\n\n# WAV LSB extraction\npython3 -c \"\nimport wave, struct\nwith wave.open('$file') as wf:\n    frames = wf.readframes(2000)\ndata = struct.unpack(f'{len(frames)}B', frames)\nbits = ''.join(str(b & 1) for b in data[:1600])\nchars = [chr(int(bits[i:i+8],2)) for i in range(0,len(bits)-8,8)]\nprint('WAV LSB:', ''.join(c if 32\u003C=ord(c)\u003C127 else '.' for c in chars[:80]))\n\" 2>\u002Fdev\u002Fnull\n\n# MP3 ID3 tag analysis for hidden payloads\npython3 -c \"\nfrom mutagen.id3 import ID3\ntags = ID3('$file')\nfor k,v in tags.items():\n    if len(str(v)) > 50: print(f'{k}: {str(v)[:200]}')\n\" 2>\u002Fdev\u002Fnull\n```\n\n### Document Steganography\n```bash\n# PDF — count and inspect streams\npython3 -c \"\nimport re, zlib\ndata = open('$file','rb').read()\nstreams = re.findall(b'stream\\r?\\n(.*?)\\r?\\nendstream', data, re.DOTALL)\nprint(f'{len(streams)} PDF streams found')\nfor i, s in enumerate(streams[:5]):\n    try:\n        dec = zlib.decompress(s)\n        print(f'  Stream {i}: {dec[:120]}')\n    except: print(f'  Stream {i}: raw len={len(s)}')\n\" 2>\u002Fdev\u002Fnull\n\n# DOCX\u002FXLSX\u002FPPTX — extract XML and check for hidden text\nunzip -l \"$file\" 2>\u002Fdev\u002Fnull | grep \"\\.xml\"\nunzip -p \"$file\" word\u002Fdocument.xml 2>\u002Fdev\u002Fnull | \\\n  python3 -c \"import sys; from xml.dom.minidom import parseString; \\\n    print(parseString(sys.stdin.read()).toprettyxml())\" 2>\u002Fdev\u002Fnull | \\\n  grep -iE '(FFFFFF|color.*fff|font-size.*0|hidden)' | head -10\n\n# exiftool on document metadata\nexiftool \"$file\" 2>\u002Fdev\u002Fnull | grep -iE \"(author|creator|last.modified|company|comment|subject)\"\n```\n\n### Network Steganography Detection\n```bash\n# DNS covert channel — long\u002Fhigh-entropy subdomains\ntshark -r capture.pcap -Y \"dns.qry.type == 1\" \\\n  -T fields -e dns.qry.name 2>\u002Fdev\u002Fnull | \\\n  awk 'length($1) > 40 || $1 ~ \u002F[0-9a-f]{32}\u002F' | sort | uniq -c | sort -rn | head -20\n\n# ICMP data field abuse\ntcpdump -r capture.pcap -X 'icmp[icmptype] == icmp-echo' 2>\u002Fdev\u002Fnull | \\\n  grep -A2 \"0x0020\" | head -40\n\n# HTTP header covert channels (unusual X- headers or ordering)\ntshark -r capture.pcap -Y \"http.request\" -T fields \\\n  -e http.host -e http.user_agent -e http.x_forwarded_for 2>\u002Fdev\u002Fnull | \\\n  awk 'NF' | head -30\n\n# Timing-based covert channel (inter-packet delta analysis)\ntshark -r capture.pcap -T fields -e frame.time_relative \\\n  -e ip.src -e ip.dst 2>\u002Fdev\u002Fnull | \\\n  python3 -c \"\nimport sys\ndeltas=[]\nprev=0.0\nfor line in sys.stdin:\n    parts=line.split()\n    if not parts: continue\n    try: t=float(parts[0]); deltas.append(t-prev); prev=t\n    except: pass\nif deltas:\n    avg=sum(deltas)\u002Flen(deltas)\n    outliers=[d for d in deltas if abs(d-avg) > 3*avg]\n    print(f'Timing outliers: {len(outliers)}\u002F{len(deltas)} ({100*len(outliers)\u002F\u002Flen(deltas)}%)')\n\" 2>\u002Fdev\u002Fnull\n```\n\n---\n\n## MITRE ATT&CK Mapping\n\n| Finding | Technique |\n|---------|-----------|\n| Hidden payload in image\u002Faudio\u002Fvideo | T1027.003 – Steganography |\n| C2 channel via steganographic images | T1001.003 – Protocol Impersonation |\n| Data exfiltration via steganography | T1048 – Exfiltration Over Alternative Protocol |\n| Binary padding \u002F null byte injection | T1027.001 – Binary Padding |\n| DNS tunneling covert channel | T1071.004 – DNS |\n| ICMP covert channel | T1095 – Non-Application Layer Protocol |\n\n---\n\n## Rules for Agents\n\n1. Always run entropy analysis first — flag files > 7.5 bits\u002Fbyte for deeper triage\n2. Check EXIF metadata for GPS coordinates on files from internal systems\n3. Run binwalk on all suspicious images, audio, and documents\n4. Log carrier file SHA-256 and confirmed\u002Fsuspected steg method to `iocs.md`\n5. For extracted payloads, treat as new evidence — hand to @reverse-engineer or @memory-analyst\n6. On network captures, check DNS query lengths and ICMP payload sizes\n7. Sync all steg-related IOCs to shared memory at session end\n",{"name":5,"description":7},"main","a91f1293287ffa9f4f1b8f486cd6e835a1568c84","skills\u002Fsteganography","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace","https:\u002F\u002Fgithub.com\u002FDCx7C5","#Python","2026-09-01 11:21:00",{"source":8,"skillName":5,"commands":53,"prompt":63,"zipAvailable":64},[54,57,60],{"tool":55,"command":56},"npx","npx skills add DCx7C5\u002Fai-marketplace --skill SKILL.md-",{"tool":58,"command":59},"bunx","bunx skills add DCx7C5\u002Fai-marketplace --skill SKILL.md-",{"tool":61,"command":62},"pnpm","pnpm dlx skills add DCx7C5\u002Fai-marketplace --skill SKILL.md-","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fsteganography\u002FSKILL.md",true,[66,72,76,80,84,88,92,96,100,104,107,111,114,118,121,125,128,131,134,137,141,144,147,150,153,157,161,165,168,171,175,178],{"path":67,"resourceType":68,"resourceTypeDesc":69,"sizeBytes":70,"sourceHtmlUrl":71},"audio\u002Findex.json","REFERENCE","参考文档",658,"https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fsteganography\u002Faudio\u002Findex.json",{"path":73,"resourceType":68,"resourceTypeDesc":69,"sizeBytes":74,"sourceHtmlUrl":75},"audio\u002Fmp3\u002Findex.json",386,"https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fsteganography\u002Faudio\u002Fmp3\u002Findex.json",{"path":77,"resourceType":68,"resourceTypeDesc":69,"sizeBytes":78,"sourceHtmlUrl":79},"audio\u002Fmp3\u002Fmetadata\u002Findex.json",391,"https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fsteganography\u002Faudio\u002Fmp3\u002Fmetadata\u002Findex.json",{"path":81,"resourceType":68,"resourceTypeDesc":69,"sizeBytes":82,"sourceHtmlUrl":83},"audio\u002Fwav\u002Fecho-hiding\u002Findex.json",394,"https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fsteganography\u002Faudio\u002Fwav\u002Fecho-hiding\u002Findex.json",{"path":85,"resourceType":68,"resourceTypeDesc":69,"sizeBytes":86,"sourceHtmlUrl":87},"audio\u002Fwav\u002Findex.json",392,"https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fsteganography\u002Faudio\u002Fwav\u002Findex.json",{"path":89,"resourceType":68,"resourceTypeDesc":69,"sizeBytes":90,"sourceHtmlUrl":91},"document\u002Fdocx\u002Findex.json",390,"https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fsteganography\u002Fdocument\u002Fdocx\u002Findex.json",{"path":93,"resourceType":68,"resourceTypeDesc":69,"sizeBytes":94,"sourceHtmlUrl":95},"document\u002Fdocx\u002Fmetadata\u002Findex.json",395,"https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fsteganography\u002Fdocument\u002Fdocx\u002Fmetadata\u002Findex.json",{"path":97,"resourceType":68,"resourceTypeDesc":69,"sizeBytes":98,"sourceHtmlUrl":99},"document\u002Findex.json",666,"https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fsteganography\u002Fdocument\u002Findex.json",{"path":101,"resourceType":68,"resourceTypeDesc":69,"sizeBytes":102,"sourceHtmlUrl":103},"document\u002Fpdf\u002Findex.json",385,"https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fsteganography\u002Fdocument\u002Fpdf\u002Findex.json",{"path":105,"resourceType":68,"resourceTypeDesc":69,"sizeBytes":86,"sourceHtmlUrl":106},"document\u002Fpdf\u002Fstream\u002Findex.json","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fsteganography\u002Fdocument\u002Fpdf\u002Fstream\u002Findex.json",{"path":108,"resourceType":68,"resourceTypeDesc":69,"sizeBytes":109,"sourceHtmlUrl":110},"image\u002Fbmp\u002Findex.json",376,"https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fsteganography\u002Fimage\u002Fbmp\u002Findex.json",{"path":112,"resourceType":68,"resourceTypeDesc":69,"sizeBytes":74,"sourceHtmlUrl":113},"image\u002Fbmp\u002Flsb\u002Findex.json","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fsteganography\u002Fimage\u002Fbmp\u002Flsb\u002Findex.json",{"path":115,"resourceType":68,"resourceTypeDesc":69,"sizeBytes":116,"sourceHtmlUrl":117},"image\u002Fgif\u002Findex.json",384,"https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fsteganography\u002Fimage\u002Fgif\u002Findex.json",{"path":119,"resourceType":68,"resourceTypeDesc":69,"sizeBytes":90,"sourceHtmlUrl":120},"image\u002Fgif\u002Fpalette\u002Findex.json","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fsteganography\u002Fimage\u002Fgif\u002Fpalette\u002Findex.json",{"path":122,"resourceType":68,"resourceTypeDesc":69,"sizeBytes":123,"sourceHtmlUrl":124},"image\u002Findex.json",1230,"https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fsteganography\u002Fimage\u002Findex.json",{"path":126,"resourceType":68,"resourceTypeDesc":69,"sizeBytes":74,"sourceHtmlUrl":127},"image\u002Fjpg\u002Fdct\u002Findex.json","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fsteganography\u002Fimage\u002Fjpg\u002Fdct\u002Findex.json",{"path":129,"resourceType":68,"resourceTypeDesc":69,"sizeBytes":109,"sourceHtmlUrl":130},"image\u002Fjpg\u002Findex.json","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fsteganography\u002Fimage\u002Fjpg\u002Findex.json",{"path":132,"resourceType":68,"resourceTypeDesc":69,"sizeBytes":109,"sourceHtmlUrl":133},"image\u002Fpng\u002Findex.json","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fsteganography\u002Fimage\u002Fpng\u002Findex.json",{"path":135,"resourceType":68,"resourceTypeDesc":69,"sizeBytes":74,"sourceHtmlUrl":136},"image\u002Fpng\u002Flsb\u002Findex.json","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fsteganography\u002Fimage\u002Fpng\u002Flsb\u002Findex.json",{"path":138,"resourceType":68,"resourceTypeDesc":69,"sizeBytes":139,"sourceHtmlUrl":140},"index.json",2224,"https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fsteganography\u002Findex.json",{"path":142,"resourceType":68,"resourceTypeDesc":69,"sizeBytes":78,"sourceHtmlUrl":143},"network\u002Fdns\u002Fcovert\u002Findex.json","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fsteganography\u002Fnetwork\u002Fdns\u002Fcovert\u002Findex.json",{"path":145,"resourceType":68,"resourceTypeDesc":69,"sizeBytes":116,"sourceHtmlUrl":146},"network\u002Fdns\u002Findex.json","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fsteganography\u002Fnetwork\u002Fdns\u002Findex.json",{"path":148,"resourceType":68,"resourceTypeDesc":69,"sizeBytes":86,"sourceHtmlUrl":149},"network\u002Fhttp\u002Fcovert\u002Findex.json","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fsteganography\u002Fnetwork\u002Fhttp\u002Fcovert\u002Findex.json",{"path":151,"resourceType":68,"resourceTypeDesc":69,"sizeBytes":102,"sourceHtmlUrl":152},"network\u002Fhttp\u002Findex.json","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fsteganography\u002Fnetwork\u002Fhttp\u002Findex.json",{"path":154,"resourceType":68,"resourceTypeDesc":69,"sizeBytes":155,"sourceHtmlUrl":156},"network\u002Findex.json",664,"https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fsteganography\u002Fnetwork\u002Findex.json",{"path":158,"resourceType":68,"resourceTypeDesc":69,"sizeBytes":159,"sourceHtmlUrl":160},"tool\u002Findex.json",965,"https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fsteganography\u002Ftool\u002Findex.json",{"path":162,"resourceType":68,"resourceTypeDesc":69,"sizeBytes":163,"sourceHtmlUrl":164},"tool\u002Fsteghide\u002Findex.json",388,"https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fsteganography\u002Ftool\u002Fsteghide\u002Findex.json",{"path":166,"resourceType":68,"resourceTypeDesc":69,"sizeBytes":163,"sourceHtmlUrl":167},"tool\u002Fstegseek\u002Findex.json","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fsteganography\u002Ftool\u002Fstegseek\u002Findex.json",{"path":169,"resourceType":68,"resourceTypeDesc":69,"sizeBytes":102,"sourceHtmlUrl":170},"tool\u002Fzsteg\u002Findex.json","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fsteganography\u002Ftool\u002Fzsteg\u002Findex.json",{"path":172,"resourceType":68,"resourceTypeDesc":69,"sizeBytes":173,"sourceHtmlUrl":174},"video\u002Findex.json",372,"https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fsteganography\u002Fvideo\u002Findex.json",{"path":176,"resourceType":68,"resourceTypeDesc":69,"sizeBytes":163,"sourceHtmlUrl":177},"video\u002Fmp4\u002Fframe\u002Findex.json","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fsteganography\u002Fvideo\u002Fmp4\u002Fframe\u002Findex.json",{"path":179,"resourceType":68,"resourceTypeDesc":69,"sizeBytes":180,"sourceHtmlUrl":181},"video\u002Fmp4\u002Findex.json",380,"https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fsteganography\u002Fvideo\u002Fmp4\u002Findex.json",[183,209,231,253,274,290],{"skillNo":184,"name":185,"nameZh":6,"description":186,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":187,"categories":188,"keywords":189,"publishedAt":40},"01M71HAPZ01KQ30RKTB0FFSQ05","services-wmi-persistence-detect","Detect WMI event subscription persistence by enumerating ActiveScriptEventConsumer, CommandLineEventConsumer, and permanent subscriptions in the WMI repository.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fservices\u002Fwmi\u002Fpersistence\u002Fdetect\u002FSKILL.md",[],[190,191,192,193,194,195,196,197,198,199,200,201,202,203,204,205,206,207,208],"services","detect","services wmi persistence detect","wmi","persistence","de","cm","process","activescript","event","subscriptions","commandline-consumer","repository","subscription","event-subscription","t1546.003","forensics","cybersecurity","process-forensics",{"skillNo":210,"name":211,"nameZh":6,"description":212,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":213,"categories":214,"keywords":215,"publishedAt":40},"01M71HAK6JTTTS229T17WJMMCG","services-wmi-exec-exploit","Perform lateral movement across Windows networks using WMI-based remote execution techniques including Impacket wmiexec.py, CrackMapExec, and native WMI commands for stealthy post-exploitation during red team engagements.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fservices\u002Fwmi\u002Fexec\u002Fexploit\u002FSKILL.md",[],[216,190,217,193,218,219,220,207,221,33,222,223,224,225,195,226,227,228,229,230],"exploit","services wmi exec exploit","exec","remote","traffic","Bash","team","across","crackmapexec","native","command","lateral movement","read","lateral-movement","Impacket",{"skillNo":232,"name":233,"nameZh":6,"description":234,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":235,"categories":236,"keywords":237,"publishedAt":40},"01M71HAG6MHKNQV8KDZKMT4886","registry-artifact-extract","Extract and analyze Windows Registry hives to uncover user activity, installed software, autostart entries, and evidence of system compromise.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fregistry\u002Fartifact\u002Fextract\u002FSKILL.md",[],[238,239,240,241,242,243,207,221,244,33,245,246,195,228,247,248,249,250,251,252],"artifact","registry","registry artifact extract","extract","evidence-collection","artifact-analysis","collection","analyze","uncover","software","activity","digital-forensics","windows-registry","regripper","sonnet",{"skillNo":254,"name":255,"nameZh":6,"description":256,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":257,"categories":258,"keywords":259,"publishedAt":40},"01M71HACR4A8XTWTTSXK4124AA","processes-token-impersonate-detect","Detect Windows token impersonation and privilege abuse including SeImpersonatePrivilege exploitation via Potato attacks and token stealing techniques.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fprocesses\u002Ftoken\u002Fimpersonate\u002Fdetect\u002FSKILL.md",[],[191,260,261,262,263,264,265,196,266,207,208,267,268,269,270,271,272,273,36,195],"processes token impersonate detect","token","processes","attacks","windows","escalation","techniques","privilege-escalation","seimpersonate","token-impersonation","printspoofer","exploitation","potato","impersonation",{"skillNo":275,"name":276,"nameZh":6,"description":277,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":278,"categories":279,"keywords":280,"publishedAt":40},"01M71HAABSB4Z6QFSXEG00R4RK","processes-thread-injection-detect","Detect Windows thread injection techniques including CreateRemoteThread, QueueUserAPC, NtCreateThreadEx, and thread hijacking via process memory analysis.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fprocesses\u002Fthread\u002Finjection\u002Fdetect\u002FSKILL.md",[],[281,282,191,283,262,264,284,196,285,266,207,208,33,286,287,288,289,36,195,197],"thread","processes thread injection detect","injection","memory","process-injection","api","apc-injection","thread-injection","nt-api",{"skillNo":291,"name":292,"nameZh":6,"description":293,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":294,"categories":295,"keywords":296,"publishedAt":40},"01M71HA7H311V5G14WMX58HQSS","processes-hollow-technique-detect","Detect process hollowing (RunPE) by identifying processes with mismatched image paths between PEB and VAD tree, or unmapped PE headers in memory.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fprocesses\u002Fhollow\u002Ftechnique\u002Fdetect\u002FSKILL.md",[],[297,191,262,298,284,196,299,300,207,208,301,302,32,303,304,305,195,197,306,307],"processes hollow technique detect","tree","memory-forensics","process-hollow","peb","runpe","pe-header","in memory","with","mismatched","headers"]