[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M71GG5KWMAKDVJH51K8SCTEB":3,"skill-same:01M71GG5KWMAKDVJH51K8SCTEB":110},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":23,"publishedAt":40,"linkOnly":41,"markdownContent":42,"markdownBody":43,"frontMatter":44,"refName":45,"commitSha":46,"skillDirectory":47,"forksCount":14,"repositoryHtmlUrl":48,"repositoryHomepageUrl":6,"ownerHtmlUrl":49,"ownerBlogUrl":6,"ownerDescription":50,"updatedAt":51,"install":52,"resources":65},"01M71GG5KWMAKDVJH51K8SCTEB","epss-SKILL.md",null,">\n  Integrate FIRST's Exploit Prediction Scoring System (EPSS) API to prioritize vulnerability remediation based on real-world exploitation probability within 30 days.","DCx7C5\u002Fai-marketplace","DCx7C5","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F42419559?v=4","01M71C01G2AZV3NTNGWAWSHJPP","DC","01M71C01GQW6G50S2BYMS7PP3E",0,"MIT","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fvuln\u002Fprioritization\u002Fepss\u002FSKILL.md",[18],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000010","后端与接口","SCENARIO","使用场景",[24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39],"epss","skill md","epss SKILL md","system","prediction","vulnerability","scoring","api","probability","world","exploitation","first","remediation","exploit","integrate","prioritize","2026-11-10 10:12:30",false,"---\nname: epss-SKILL.md\ndescription: \">\\n  Integrate FIRST's Exploit Prediction Scoring System (EPSS) API\\\n  \\ to prioritize vulnerability remediation based on real-world exploitation probability\\\n  \\ within 30 days.\"\n---\n# Implementing EPSS Score for Vulnerability Prioritization\n\n## Overview\n\nThe Exploit Prediction Scoring System (EPSS) is a data-driven model developed by FIRST (Forum of Incident Response and Security Teams) that estimates the probability of a CVE being exploited in the wild within the next 30 days. EPSS produces scores from 0.0 to 1.0 (0% to 100%) using machine learning trained on real-world exploitation data. Unlike CVSS which measures severity, EPSS measures likelihood of exploitation, making it essential for risk-based vulnerability prioritization.\n\n\n## When to Use\n\n- When deploying or configuring implementing epss score for vulnerability prioritization capabilities in your environment\n- When establishing security controls aligned to compliance requirements\n- When building or improving security architecture for this domain\n- When conducting security assessments that require this implementation\n\n## Prerequisites\n\n- Python 3.9+ with `requests`, `pandas`, `matplotlib`\n- Access to FIRST EPSS API (https:\u002F\u002Fapi.first.org\u002Fdata\u002Fv1\u002Fepss)\n- Vulnerability scan results with CVE identifiers\n- Optional: NVD API key for CVSS enrichment\n\n## EPSS API Usage\n\n### Query Single CVE\n```bash\n# Get EPSS score for a specific CVE\ncurl -s \"https:\u002F\u002Fapi.first.org\u002Fdata\u002Fv1\u002Fepss?cve=CVE-2024-3400\" | python3 -m json.tool\n\n# Response:\n# {\n#   \"status\": \"OK\",\n#   \"status-code\": 200,\n#   \"version\": \"1.0\",\n#   \"total\": 1,\n#   \"data\": [\n#     {\n#       \"cve\": \"CVE-2024-3400\",\n#       \"epss\": \"0.95732\",\n#       \"percentile\": \"0.99721\",\n#       \"date\": \"2024-04-15\"\n#     }\n#   ]\n# }\n```\n\n### Query Multiple CVEs\n```bash\n# Batch query up to 100 CVEs\ncurl -s \"https:\u002F\u002Fapi.first.org\u002Fdata\u002Fv1\u002Fepss?cve=CVE-2024-3400,CVE-2024-21887,CVE-2023-44228\" | \\\n  python3 -c \"\nimport sys, json\ndata = json.load(sys.stdin)\nfor item in data['data']:\n    pct = float(item['epss']) * 100\n    print(f\\\"{item['cve']}: {pct:.2f}% exploitation probability (percentile: {item['percentile']})\\\")\n\"\n```\n\n### Download Full EPSS Dataset\n```bash\n# Download complete daily EPSS scores (CSV format)\ncurl -s \"https:\u002F\u002Fepss.cyentia.com\u002Fepss_scores-current.csv.gz\" | gunzip > epss_scores_current.csv\n\n# Check size and preview\nwc -l epss_scores_current.csv\nhead -5 epss_scores_current.csv\n```\n\n### Query Historical EPSS Scores\n```bash\n# Get EPSS score for a specific date\ncurl -s \"https:\u002F\u002Fapi.first.org\u002Fdata\u002Fv1\u002Fepss?cve=CVE-2024-3400&date=2024-04-12\"\n\n# Get time series data\ncurl -s \"https:\u002F\u002Fapi.first.org\u002Fdata\u002Fv1\u002Fepss?cve=CVE-2024-3400&scope=time-series\"\n```\n\n## Prioritization Strategy\n\n### EPSS + CVSS Combined Approach\n\n| EPSS Score | CVSS Score | Priority | Action |\n|-----------|-----------|----------|--------|\n| > 0.7 | >= 9.0 | P0 - Immediate | Remediate within 24 hours |\n| > 0.7 | >= 7.0 | P1 - Urgent | Remediate within 48 hours |\n| > 0.4 | >= 7.0 | P2 - High | Remediate within 7 days |\n| > 0.1 | >= 4.0 | P3 - Medium | Remediate within 30 days |\n| \u003C= 0.1 | >= 7.0 | P3 - Medium | Remediate within 30 days |\n| \u003C= 0.1 | \u003C 7.0 | P4 - Low | Remediate within 90 days |\n\n### EPSS Percentile Thresholds\n- **Top 1% (percentile >= 0.99)**: Extremely likely to be exploited; treat as Critical\n- **Top 5% (percentile >= 0.95)**: High exploitation probability; prioritize remediation\n- **Top 10% (percentile >= 0.90)**: Elevated risk; schedule for near-term remediation\n- **Bottom 50%**: Low exploitation probability; handle in normal patch cycle\n\n## Implementation\n\n```python\nimport requests\nimport pandas as pd\nfrom datetime import datetime\n\ndef fetch_epss_scores(cve_list):\n    \"\"\"Fetch EPSS scores for a list of CVEs from FIRST API.\"\"\"\n    scores = {}\n    batch_size = 100\n    for i in range(0, len(cve_list), batch_size):\n        batch = cve_list[i:i + batch_size]\n        resp = requests.get(\n            \"https:\u002F\u002Fapi.first.org\u002Fdata\u002Fv1\u002Fepss\",\n            params={\"cve\": \",\".join(batch)},\n            timeout=30\n        )\n        if resp.status_code == 200:\n            for entry in resp.json().get(\"data\", []):\n                scores[entry[\"cve\"]] = {\n                    \"epss\": float(entry[\"epss\"]),\n                    \"percentile\": float(entry[\"percentile\"]),\n                    \"date\": entry.get(\"date\", \"\"),\n                }\n    return scores\n\ndef prioritize_vulnerabilities(scan_results_csv, output_csv):\n    \"\"\"Enrich scan results with EPSS scores and assign priorities.\"\"\"\n    df = pd.read_csv(scan_results_csv)\n    cve_list = df[\"cve_id\"].dropna().unique().tolist()\n\n    epss_data = fetch_epss_scores(cve_list)\n\n    df[\"epss_score\"] = df[\"cve_id\"].map(lambda c: epss_data.get(c, {}).get(\"epss\", 0))\n    df[\"epss_percentile\"] = df[\"cve_id\"].map(lambda c: epss_data.get(c, {}).get(\"percentile\", 0))\n\n    def assign_priority(row):\n        epss = row.get(\"epss_score\", 0)\n        cvss = row.get(\"cvss_score\", 0)\n        if epss > 0.7 and cvss >= 9.0:\n            return \"P0\"\n        if epss > 0.7 and cvss >= 7.0:\n            return \"P1\"\n        if epss > 0.4 and cvss >= 7.0:\n            return \"P2\"\n        if epss > 0.1 or cvss >= 7.0:\n            return \"P3\"\n        return \"P4\"\n\n    df[\"priority\"] = df.apply(assign_priority, axis=1)\n    df = df.sort_values([\"priority\", \"epss_score\"], ascending=[True, False])\n    df.to_csv(output_csv, index=False)\n    print(f\"[+] Prioritized {len(df)} vulnerabilities -> {output_csv}\")\n    print(f\"    P0: {len(df[df['priority']=='P0'])}\")\n    print(f\"    P1: {len(df[df['priority']=='P1'])}\")\n    print(f\"    P2: {len(df[df['priority']=='P2'])}\")\n    print(f\"    P3: {len(df[df['priority']=='P3'])}\")\n    print(f\"    P4: {len(df[df['priority']=='P4'])}\")\n    return df\n```\n\n## EPSS Trend Analysis\n\n```python\ndef fetch_epss_timeseries(cve_id):\n    \"\"\"Get historical EPSS scores for trend analysis.\"\"\"\n    resp = requests.get(\n        \"https:\u002F\u002Fapi.first.org\u002Fdata\u002Fv1\u002Fepss\",\n        params={\"cve\": cve_id, \"scope\": \"time-series\"},\n        timeout=30\n    )\n    if resp.status_code == 200:\n        return resp.json().get(\"data\", [])\n    return []\n\ndef detect_epss_spikes(cve_id, threshold=0.3):\n    \"\"\"Detect significant EPSS score increases indicating emerging threats.\"\"\"\n    timeseries = fetch_epss_timeseries(cve_id)\n    if len(timeseries) \u003C 2:\n        return False\n    sorted_data = sorted(timeseries, key=lambda x: x.get(\"date\", \"\"))\n    latest = float(sorted_data[-1].get(\"epss\", 0))\n    previous = float(sorted_data[-2].get(\"epss\", 0))\n    increase = latest - previous\n    if increase >= threshold:\n        print(f\"[!] EPSS spike detected for {cve_id}: {previous:.3f} -> {latest:.3f} (+{increase:.3f})\")\n        return True\n    return False\n```\n\n## References\n\n- [FIRST EPSS Official](https:\u002F\u002Fwww.first.org\u002Fepss\u002F)\n- [EPSS API Documentation](https:\u002F\u002Fwww.first.org\u002Fepss\u002Fapi)\n- [EPSS Model Documentation](https:\u002F\u002Fwww.first.org\u002Fepss\u002Fmodel)\n- [EPSS Data Downloads](https:\u002F\u002Fepss.cyentia.com\u002F)\n- [Cyentia Institute Research](https:\u002F\u002Fwww.cyentia.com\u002Fepss\u002F)\n\n\n---\n\n## CyberSecSuite Integration\n\n```bash\n# Open a case before starting investigation\nmcp__cybersec__case_open --title \"epss\" --type investigation\n\n# Persist findings to PostgreSQL\nmcp__cybersec__add_finding --title \"...\" --severity high --description \"...\"\n\n# Log IOCs\nmcp__cybersec__add_ioc --type domain --value \"...\" --confidence 0.9\n\n# Map to MITRE\nmcp__cybersec__suggest_mitre --description \"...\"\n```\n\n**Agent:** `@cybersec-agent` → delegates to appropriate specialist\n","# Implementing EPSS Score for Vulnerability Prioritization\n\n## Overview\n\nThe Exploit Prediction Scoring System (EPSS) is a data-driven model developed by FIRST (Forum of Incident Response and Security Teams) that estimates the probability of a CVE being exploited in the wild within the next 30 days. EPSS produces scores from 0.0 to 1.0 (0% to 100%) using machine learning trained on real-world exploitation data. Unlike CVSS which measures severity, EPSS measures likelihood of exploitation, making it essential for risk-based vulnerability prioritization.\n\n\n## When to Use\n\n- When deploying or configuring implementing epss score for vulnerability prioritization capabilities in your environment\n- When establishing security controls aligned to compliance requirements\n- When building or improving security architecture for this domain\n- When conducting security assessments that require this implementation\n\n## Prerequisites\n\n- Python 3.9+ with `requests`, `pandas`, `matplotlib`\n- Access to FIRST EPSS API (https:\u002F\u002Fapi.first.org\u002Fdata\u002Fv1\u002Fepss)\n- Vulnerability scan results with CVE identifiers\n- Optional: NVD API key for CVSS enrichment\n\n## EPSS API Usage\n\n### Query Single CVE\n```bash\n# Get EPSS score for a specific CVE\ncurl -s \"https:\u002F\u002Fapi.first.org\u002Fdata\u002Fv1\u002Fepss?cve=CVE-2024-3400\" | python3 -m json.tool\n\n# Response:\n# {\n#   \"status\": \"OK\",\n#   \"status-code\": 200,\n#   \"version\": \"1.0\",\n#   \"total\": 1,\n#   \"data\": [\n#     {\n#       \"cve\": \"CVE-2024-3400\",\n#       \"epss\": \"0.95732\",\n#       \"percentile\": \"0.99721\",\n#       \"date\": \"2024-04-15\"\n#     }\n#   ]\n# }\n```\n\n### Query Multiple CVEs\n```bash\n# Batch query up to 100 CVEs\ncurl -s \"https:\u002F\u002Fapi.first.org\u002Fdata\u002Fv1\u002Fepss?cve=CVE-2024-3400,CVE-2024-21887,CVE-2023-44228\" | \\\n  python3 -c \"\nimport sys, json\ndata = json.load(sys.stdin)\nfor item in data['data']:\n    pct = float(item['epss']) * 100\n    print(f\\\"{item['cve']}: {pct:.2f}% exploitation probability (percentile: {item['percentile']})\\\")\n\"\n```\n\n### Download Full EPSS Dataset\n```bash\n# Download complete daily EPSS scores (CSV format)\ncurl -s \"https:\u002F\u002Fepss.cyentia.com\u002Fepss_scores-current.csv.gz\" | gunzip > epss_scores_current.csv\n\n# Check size and preview\nwc -l epss_scores_current.csv\nhead -5 epss_scores_current.csv\n```\n\n### Query Historical EPSS Scores\n```bash\n# Get EPSS score for a specific date\ncurl -s \"https:\u002F\u002Fapi.first.org\u002Fdata\u002Fv1\u002Fepss?cve=CVE-2024-3400&date=2024-04-12\"\n\n# Get time series data\ncurl -s \"https:\u002F\u002Fapi.first.org\u002Fdata\u002Fv1\u002Fepss?cve=CVE-2024-3400&scope=time-series\"\n```\n\n## Prioritization Strategy\n\n### EPSS + CVSS Combined Approach\n\n| EPSS Score | CVSS Score | Priority | Action |\n|-----------|-----------|----------|--------|\n| > 0.7 | >= 9.0 | P0 - Immediate | Remediate within 24 hours |\n| > 0.7 | >= 7.0 | P1 - Urgent | Remediate within 48 hours |\n| > 0.4 | >= 7.0 | P2 - High | Remediate within 7 days |\n| > 0.1 | >= 4.0 | P3 - Medium | Remediate within 30 days |\n| \u003C= 0.1 | >= 7.0 | P3 - Medium | Remediate within 30 days |\n| \u003C= 0.1 | \u003C 7.0 | P4 - Low | Remediate within 90 days |\n\n### EPSS Percentile Thresholds\n- **Top 1% (percentile >= 0.99)**: Extremely likely to be exploited; treat as Critical\n- **Top 5% (percentile >= 0.95)**: High exploitation probability; prioritize remediation\n- **Top 10% (percentile >= 0.90)**: Elevated risk; schedule for near-term remediation\n- **Bottom 50%**: Low exploitation probability; handle in normal patch cycle\n\n## Implementation\n\n```python\nimport requests\nimport pandas as pd\nfrom datetime import datetime\n\ndef fetch_epss_scores(cve_list):\n    \"\"\"Fetch EPSS scores for a list of CVEs from FIRST API.\"\"\"\n    scores = {}\n    batch_size = 100\n    for i in range(0, len(cve_list), batch_size):\n        batch = cve_list[i:i + batch_size]\n        resp = requests.get(\n            \"https:\u002F\u002Fapi.first.org\u002Fdata\u002Fv1\u002Fepss\",\n            params={\"cve\": \",\".join(batch)},\n            timeout=30\n        )\n        if resp.status_code == 200:\n            for entry in resp.json().get(\"data\", []):\n                scores[entry[\"cve\"]] = {\n                    \"epss\": float(entry[\"epss\"]),\n                    \"percentile\": float(entry[\"percentile\"]),\n                    \"date\": entry.get(\"date\", \"\"),\n                }\n    return scores\n\ndef prioritize_vulnerabilities(scan_results_csv, output_csv):\n    \"\"\"Enrich scan results with EPSS scores and assign priorities.\"\"\"\n    df = pd.read_csv(scan_results_csv)\n    cve_list = df[\"cve_id\"].dropna().unique().tolist()\n\n    epss_data = fetch_epss_scores(cve_list)\n\n    df[\"epss_score\"] = df[\"cve_id\"].map(lambda c: epss_data.get(c, {}).get(\"epss\", 0))\n    df[\"epss_percentile\"] = df[\"cve_id\"].map(lambda c: epss_data.get(c, {}).get(\"percentile\", 0))\n\n    def assign_priority(row):\n        epss = row.get(\"epss_score\", 0)\n        cvss = row.get(\"cvss_score\", 0)\n        if epss > 0.7 and cvss >= 9.0:\n            return \"P0\"\n        if epss > 0.7 and cvss >= 7.0:\n            return \"P1\"\n        if epss > 0.4 and cvss >= 7.0:\n            return \"P2\"\n        if epss > 0.1 or cvss >= 7.0:\n            return \"P3\"\n        return \"P4\"\n\n    df[\"priority\"] = df.apply(assign_priority, axis=1)\n    df = df.sort_values([\"priority\", \"epss_score\"], ascending=[True, False])\n    df.to_csv(output_csv, index=False)\n    print(f\"[+] Prioritized {len(df)} vulnerabilities -> {output_csv}\")\n    print(f\"    P0: {len(df[df['priority']=='P0'])}\")\n    print(f\"    P1: {len(df[df['priority']=='P1'])}\")\n    print(f\"    P2: {len(df[df['priority']=='P2'])}\")\n    print(f\"    P3: {len(df[df['priority']=='P3'])}\")\n    print(f\"    P4: {len(df[df['priority']=='P4'])}\")\n    return df\n```\n\n## EPSS Trend Analysis\n\n```python\ndef fetch_epss_timeseries(cve_id):\n    \"\"\"Get historical EPSS scores for trend analysis.\"\"\"\n    resp = requests.get(\n        \"https:\u002F\u002Fapi.first.org\u002Fdata\u002Fv1\u002Fepss\",\n        params={\"cve\": cve_id, \"scope\": \"time-series\"},\n        timeout=30\n    )\n    if resp.status_code == 200:\n        return resp.json().get(\"data\", [])\n    return []\n\ndef detect_epss_spikes(cve_id, threshold=0.3):\n    \"\"\"Detect significant EPSS score increases indicating emerging threats.\"\"\"\n    timeseries = fetch_epss_timeseries(cve_id)\n    if len(timeseries) \u003C 2:\n        return False\n    sorted_data = sorted(timeseries, key=lambda x: x.get(\"date\", \"\"))\n    latest = float(sorted_data[-1].get(\"epss\", 0))\n    previous = float(sorted_data[-2].get(\"epss\", 0))\n    increase = latest - previous\n    if increase >= threshold:\n        print(f\"[!] EPSS spike detected for {cve_id}: {previous:.3f} -> {latest:.3f} (+{increase:.3f})\")\n        return True\n    return False\n```\n\n## References\n\n- [FIRST EPSS Official](https:\u002F\u002Fwww.first.org\u002Fepss\u002F)\n- [EPSS API Documentation](https:\u002F\u002Fwww.first.org\u002Fepss\u002Fapi)\n- [EPSS Model Documentation](https:\u002F\u002Fwww.first.org\u002Fepss\u002Fmodel)\n- [EPSS Data Downloads](https:\u002F\u002Fepss.cyentia.com\u002F)\n- [Cyentia Institute Research](https:\u002F\u002Fwww.cyentia.com\u002Fepss\u002F)\n\n\n---\n\n## CyberSecSuite Integration\n\n```bash\n# Open a case before starting investigation\nmcp__cybersec__case_open --title \"epss\" --type investigation\n\n# Persist findings to PostgreSQL\nmcp__cybersec__add_finding --title \"...\" --severity high --description \"...\"\n\n# Log IOCs\nmcp__cybersec__add_ioc --type domain --value \"...\" --confidence 0.9\n\n# Map to MITRE\nmcp__cybersec__suggest_mitre --description \"...\"\n```\n\n**Agent:** `@cybersec-agent` → delegates to appropriate specialist\n",{"name":5,"description":7},"main","a91f1293287ffa9f4f1b8f486cd6e835a1568c84","skills\u002Fvuln\u002Fprioritization\u002Fepss","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace","https:\u002F\u002Fgithub.com\u002FDCx7C5","#Python","2026-09-01 11:21:00",{"source":8,"skillName":5,"commands":53,"prompt":63,"zipAvailable":64},[54,57,60],{"tool":55,"command":56},"npx","npx skills add DCx7C5\u002Fai-marketplace --skill epss-SKILL.md",{"tool":58,"command":59},"bunx","bunx skills add DCx7C5\u002Fai-marketplace --skill epss-SKILL.md",{"tool":61,"command":62},"pnpm","pnpm dlx skills add DCx7C5\u002Fai-marketplace --skill epss-SKILL.md","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fvuln\u002Fprioritization\u002Fepss\u002FSKILL.md",true,[66,72,76,82,86,89,93,97,103,106],{"path":67,"resourceType":68,"resourceTypeDesc":69,"sizeBytes":70,"sourceHtmlUrl":71},"assets\u002Findex.json","ASSET","资产文件",84,"https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fvuln\u002Fprioritization\u002Fepss\u002Fassets\u002Findex.json",{"path":73,"resourceType":68,"resourceTypeDesc":69,"sizeBytes":74,"sourceHtmlUrl":75},"assets\u002Ftemplate.md",1774,"https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fvuln\u002Fprioritization\u002Fepss\u002Fassets\u002Ftemplate.md",{"path":77,"resourceType":78,"resourceTypeDesc":79,"sizeBytes":80,"sourceHtmlUrl":81},"index.json","REFERENCE","参考文档",1431,"https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fvuln\u002Fprioritization\u002Fepss\u002Findex.json",{"path":83,"resourceType":78,"resourceTypeDesc":79,"sizeBytes":84,"sourceHtmlUrl":85},"references\u002Fapi-reference.md",1655,"https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fvuln\u002Fprioritization\u002Fepss\u002Freferences\u002Fapi-reference.md",{"path":87,"resourceType":78,"resourceTypeDesc":79,"sizeBytes":70,"sourceHtmlUrl":88},"references\u002Findex.json","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fvuln\u002Fprioritization\u002Fepss\u002Freferences\u002Findex.json",{"path":90,"resourceType":78,"resourceTypeDesc":79,"sizeBytes":91,"sourceHtmlUrl":92},"references\u002Fstandards.md",2729,"https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fvuln\u002Fprioritization\u002Fepss\u002Freferences\u002Fstandards.md",{"path":94,"resourceType":78,"resourceTypeDesc":79,"sizeBytes":95,"sourceHtmlUrl":96},"references\u002Fworkflows.md",1358,"https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fvuln\u002Fprioritization\u002Fepss\u002Freferences\u002Fworkflows.md",{"path":98,"resourceType":99,"resourceTypeDesc":100,"sizeBytes":101,"sourceHtmlUrl":102},"scripts\u002Fagent.py","SCRIPT","脚本",5161,"https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fvuln\u002Fprioritization\u002Fepss\u002Fscripts\u002Fagent.py",{"path":104,"resourceType":99,"resourceTypeDesc":100,"sizeBytes":70,"sourceHtmlUrl":105},"scripts\u002Findex.json","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fvuln\u002Fprioritization\u002Fepss\u002Fscripts\u002Findex.json",{"path":107,"resourceType":99,"resourceTypeDesc":100,"sizeBytes":108,"sourceHtmlUrl":109},"scripts\u002Fprocess.py",7649,"https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fvuln\u002Fprioritization\u002Fepss\u002Fscripts\u002Fprocess.py",[111,137,159,181,202,217],{"skillNo":112,"name":113,"nameZh":6,"description":114,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":115,"categories":116,"keywords":117,"publishedAt":40},"01M71HAPZ01KQ30RKTB0FFSQ05","services-wmi-persistence-detect","Detect WMI event subscription persistence by enumerating ActiveScriptEventConsumer, CommandLineEventConsumer, and permanent subscriptions in the WMI repository.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fservices\u002Fwmi\u002Fpersistence\u002Fdetect\u002FSKILL.md",[],[118,119,120,121,122,123,124,125,126,127,128,129,130,131,132,133,134,135,136],"services","detect","services wmi persistence detect","wmi","persistence","de","cm","process","activescript","event","subscriptions","commandline-consumer","repository","subscription","event-subscription","t1546.003","forensics","cybersecurity","process-forensics",{"skillNo":138,"name":139,"nameZh":6,"description":140,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":141,"categories":142,"keywords":143,"publishedAt":40},"01M71HAK6JTTTS229T17WJMMCG","services-wmi-exec-exploit","Perform lateral movement across Windows networks using WMI-based remote execution techniques including Impacket wmiexec.py, CrackMapExec, and native WMI commands for stealthy post-exploitation during red team engagements.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fservices\u002Fwmi\u002Fexec\u002Fexploit\u002FSKILL.md",[],[37,118,144,121,145,146,147,135,148,149,150,151,152,153,123,154,155,156,157,158],"services wmi exec exploit","exec","remote","traffic","Bash","analysis","team","across","crackmapexec","native","command","lateral movement","read","lateral-movement","Impacket",{"skillNo":160,"name":161,"nameZh":6,"description":162,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":163,"categories":164,"keywords":165,"publishedAt":40},"01M71HAG6MHKNQV8KDZKMT4886","registry-artifact-extract","Extract and analyze Windows Registry hives to uncover user activity, installed software, autostart entries, and evidence of system compromise.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fregistry\u002Fartifact\u002Fextract\u002FSKILL.md",[],[166,167,168,169,170,171,135,148,172,149,173,174,123,156,175,176,177,178,179,180],"artifact","registry","registry artifact extract","extract","evidence-collection","artifact-analysis","collection","analyze","uncover","software","activity","digital-forensics","windows-registry","regripper","sonnet",{"skillNo":182,"name":183,"nameZh":6,"description":184,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":185,"categories":186,"keywords":187,"publishedAt":40},"01M71HACR4A8XTWTTSXK4124AA","processes-token-impersonate-detect","Detect Windows token impersonation and privilege abuse including SeImpersonatePrivilege exploitation via Potato attacks and token stealing techniques.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fprocesses\u002Ftoken\u002Fimpersonate\u002Fdetect\u002FSKILL.md",[],[119,188,189,190,191,192,193,124,194,135,136,195,196,197,198,34,199,200,201,123],"processes token impersonate detect","token","processes","attacks","windows","escalation","techniques","privilege-escalation","seimpersonate","token-impersonation","printspoofer","potato","impersonation","via",{"skillNo":203,"name":204,"nameZh":6,"description":205,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":206,"categories":207,"keywords":208,"publishedAt":40},"01M71HAABSB4Z6QFSXEG00R4RK","processes-thread-injection-detect","Detect Windows thread injection techniques including CreateRemoteThread, QueueUserAPC, NtCreateThreadEx, and thread hijacking via process memory analysis.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fprocesses\u002Fthread\u002Finjection\u002Fdetect\u002FSKILL.md",[],[209,210,119,211,190,192,212,124,213,194,135,136,149,31,214,215,216,201,123,125],"thread","processes thread injection detect","injection","memory","process-injection","apc-injection","thread-injection","nt-api",{"skillNo":218,"name":219,"nameZh":6,"description":220,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":221,"categories":222,"keywords":223,"publishedAt":40},"01M71HA7H311V5G14WMX58HQSS","processes-hollow-technique-detect","Detect process hollowing (RunPE) by identifying processes with mismatched image paths between PEB and VAD tree, or unmapped PE headers in memory.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fprocesses\u002Fhollow\u002Ftechnique\u002Fdetect\u002FSKILL.md",[],[224,119,190,225,212,124,226,227,135,136,228,229,230,231,232,233,123,125,234,235],"processes hollow technique detect","tree","memory-forensics","process-hollow","peb","runpe","image","pe-header","in memory","with","mismatched","headers"]