'wmi' 검색 결과

Find WMI event subscriptions that let attackers retain access to Windows systems. Correlate Sysmon events with stored subscriptions and Autoruns results, inspect execution triggers and commands, and document risks and recommended remediation.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Triaging Sysmon alerts for events 19, 20, and 21
• Finding WMI persistence during incident response
• Distinguishing suspicious subscriptions from legitimate settings

Investigate Windows malware that runs in memory or abuses legitimate system tools. Use logs, registry entries, and memory dumps to trace persistence, identify suspicious activity, and produce detection rules and an analysis report.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Investigating suspicious PowerShell activity
• Checking WMI persistence mechanisms
• Finding malicious code in memory dumps

Build detections for fileless attacks on Windows using process activity, script logs, and endpoint monitoring. Investigate suspicious PowerShell, code injected into running processes, WMI persistence, and registry-based execution with logging guidance and detection query examples.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Building detections for suspicious PowerShell activity
• Hunting for code injection into running processes
• Monitoring WMI persistence and registry-based execution

Hunts for malicious WMI permanent event subscription persistence by correlating __EventFilter, CommandLineEventConsumer/ActiveScriptEventConsumer, and FilterToConsumerBinding records from Sysmon Event IDs 19/20/21 or WMI repository exports. Activates for requests to hunt WMI persistence, detect event consumer backdoors, or analyze WMI subscription telemetry.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Hunts for lateral movement via remote service creation, admin share writes, and remote WMI process creation by correlating Windows logon, service install, and process-creation events. Activates for requests to hunt lateral movement, detect PsExec/WMIexec activity, or find remote execution over SMB and WMI.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Detect WMI event subscription persistence by analyzing Sysmon Event IDs 19, 20, and 21 for malicious EventFilter, EventConsumer, and FilterToConsumerBinding creation.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Manage productivity with FlowMind — goals, tasks (with subtasks), notes, people, and tags via REST API. Use when the user wants to create, list, update, or delete goals, tasks, notes, contacts, or tags; manage focus/priorities; track progress; or organize their productivity workspace through FlowMind.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Hunt for lateral movement, where attackers move between networked systems, using Splunk searches. Connect Windows logins with process and network activity to identify unusual host relationships, trace movement paths, and document affected accounts and systems.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Tracing activity after credential theft
• Investigating unusual logins between hosts
• Finding new or unexpected host connections

Review lateral movement, the ways access spreads between systems, during authorized security tests. Covers credential reuse, remote execution, network tunnels, prerequisites, and the logs or defensive controls associated with each technique.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Compare lateral movement methods for an internal penetration test
• Plan tunnels across segmented networks
• Review detection logs and controls for lateral movement

Detects and analyzes fileless malware that operates entirely in memory using PowerShell, WMI, .NET reflection, registry-resident payloads, and living-off-the-land binaries (LOLBins) without writing traditional executable files to disk. Activates for requests involving fileless threat detection, in-memory malware investigation, LOLBin abuse analysis, or WMI persistence examination.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Detects and analyzes fileless malware that operates entirely in memory using PowerShell, WMI, .NET reflection, registry-resident payloads, and living-off-the-land binaries (LOLBins) without writing traditional executable files to disk. Activates for requests involving fileless threat detection, in-memory malware investigation, LOLBin abuse analysis, or WMI persistence examination.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Detects and analyzes fileless malware that operates entirely in memory using PowerShell, WMI, .NET reflection, registry-resident payloads, and living-off-the-land binaries (LOLBins) without writing traditional executable files to disk. Activates for requests involving fileless threat detection, in-memory malware investigation, LOLBin abuse analysis, or WMI persistence examination.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Guide malware cleanup on infected Windows and Linux systems after containment and investigation. Covers removing malicious files and mechanisms that preserve attacker access, rotating credentials, patching entry points, and documenting validation results before recovery.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Cleaning infected systems after containment
• Removing mechanisms that preserve attacker access
• Rotating compromised credentials and fixing entry points

Plan smart contract audits using research from security organizations. Combine threat modeling, static code analysis, fuzzing that varies test inputs, and manual review, while using attack patterns and a four-phase roadmap to guide further learning.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Planning a smart contract security audit
• Setting up Echidna or Medusa fuzzing
• Reviewing attack patterns and past audit findings

Assess Active Directory security by mapping accounts, permissions, and paths to administrative access. The skill covers credential misuse, certificate service misconfigurations, movement between systems, and hybrid identity environments involving Entra ID.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Mapping paths to administrative access in Active Directory
• Reviewing ADCS certificate service configurations
• Assessing permissions, delegation, and group policies

Plan persistence testing for authorized Windows and Linux security exercises, examining how access can survive logons or restarts. The skill compares mechanisms by privilege level and environment, with validation steps, detection indicators, and cleanup considerations.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Planning persistence tests for authorized exercises
• Comparing methods by operating system and privilege
• Reviewing detection indicators for persistence

Helps plan NetExec commands for penetration testing in Active Directory, the system used to manage Windows domain accounts. Covers authentication checks, shared resources, permissions, and information collection with examples organized by network protocol.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Checking NetExec authentication options
• Enumerating domain users and shared resources
• Collecting data for BloodHound

Windows lateral movement playbook. Use when pivoting between Windows hosts via PsExec, WMI, WinRM, DCOM, RDP, pass-the-hash, overpass-the-hash, or pass-the-ticket techniques.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

The telemetry each Active Directory technique generates and what alerts a defender: Kerberoasting produces Event 4769 with RC4 encryption (0x17) and an MDI alert, DCSync produces Event 4662 with the DS-Replication-Get-Changes GUID, AS-REP roasting produces Event 4768 with no pre-auth, LSASS dumping is blocked by EDR, plus a lateral-movement telemetry table by protocol (SMB/WMI/WinRM/RDP/DCOM). Use this whenever you run or plan an offensive AD technique and need to know what noise it makes, when writing the engagement's detection notes, or when a defender wants to know what to monitor. Teaches red teamers what is loud and blue teamers what to watch. Standard-tooling knowledge, no vendor engine.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

加密链上交易 (加密 / 链上交易 (Crypto & On-chain Trading) — 以加密资产为标的、强调链上活动的主动交易认知操作系统：从「看叙事/选赛道 → 找标的 → 链上尽调与风控 → 选场所(DEX/CEX/链上合约) → 建仓与仓位管理 → 监控链上流向与情绪 → 退出与复盘」的完整决策链。覆盖 (a) 第一性张力 — **链上 on-chain (DEX 现货/AMM、钱包追踪 wallet tracking、资金流向 flow、MEV、memecoin、链上衍生品 Hyperliquid/GMX、自托管 self-custody, 'not your keys not your coins') ⇄ 链下 CEX (中心化交易所现货/合约 Binance/OKX/Bybit、订单簿、托管、出入金法币)**; **合约/杠杆/衍生品 (perps 永续、资金费率 funding、清算 liquidation、爆仓、做多做空、高频/择时) ⇄ 现货/价值/长持 (spot、HODL、定投 DCA、基本面/估值、'time in market > timing the market')**; **价值/基本面派 (协议收入、TVL、代币经济学 tokenomics、真实使用、估值模型) ⇄ meme/叙事/情绪派 (memecoin、narrative rotation 叙事轮动、attention is the asset、纯博弈/PvP、Ponzinomics)**; **链上数据/量化/客观 (on-chain analytics, Nansen/Arkham/Dune、聪明钱 smart money、链上指标、系统化/机械化) ⇄ 直觉/盘感/叙事阅读 (narrative、KOL alpha、社群情绪、tape reading)**; **自托管/去中心化/抗审查 (DeFi、自托管钱包、抗审查、'be your own bank') ⇄ 便利/合规/中心化 (CEX、合规出入金、KYC、托管、ETF)**; **主动交易/择时/高换手 (trading、波段、合约、撸毛/空投 airdrop farming、套利 arbitrage) ⇄ 被动配置/低换手 (配置 BTC/ETH、ETF、长期叙事 beta)**; (b) 核心工作流 / pipeline (最标准、最易蒸高质量 + CLI 化) — 通用链: 叙事/赛道判断 (宏观周期/减半/流动性/板块轮动) → 标的发现 (链上扫链/聪明钱跟单/新币/叙事映射) → 尽调 due diligence (代币经济学/解锁 unlock/团队/合约审计/honeypot 检测/流动性与持仓分布) → 风控前置 (仓位 sizing/最大回撤/止损/相关性) → 场所与执行 (CEX vs DEX、滑点/MEV/gas、限价 vs 市价、TWAP) → 持仓监控 (链上流向/巨鲸/资金费率/解锁日历/情绪指标) → 退出与复盘 (止盈分批/再平衡/记录交易日志); 子流派 SOP: 链上 degen 打新与 memecoin 流程、合约交易者的资金费率与清算地图、空投/撸毛 farming、套利与 MEV、被动配置与定投; (c) 工具栈 — 链上分析 (Nansen 聪明钱/Arkham 实体标注/Dune 自建仪表盘/Dexscreener & DEX Screener 新币/GMGN & Photon & BullX memecoin 终端/Etherscan & Solscan 区块浏览器/DeBank 钱包总览/Token Terminal 协议基本面/DefiLlama TVL/Glassnode & CryptoQuant 链上指标)、交易场所 (CEX: Binance/OKX/Bybit/Coinbase; 链上现货 DEX: Uniswap/Jupiter/Raydium/Aerodrome; 链上衍生品: Hyperliquid/GMX/dYdX)、钱包与安全 (MetaMask/Rabby/Phantom 热钱包、Ledger/Trezor 硬件冷钱包、Revoke.cash 授权管理、honeypot/合约扫描)、行情与图表 (TradingView、CoinGecko/CoinMarketCap)、信息与聚合 (Twitter/X、Telegram、DeFiLlama、RootData/ICO 日历、解锁日历 Token Unlocks)、自动化 (交易机器人、链上 bot/sniper、Telegram trading bot); (d) 知识正典 — 注意加密交易 canon 偏少且新: 通用交易/风控经典 (Edwin Lefèvre 'Reminiscences of a Stock Operator'、Van Tharp 'Trade Your Way to Financial Freedom' 仓位管理、Mark Douglas 'Trading in the Zone' 交易心理、Michael Mauboussin、Nassim Taleb 'Fooled by Randomness/Antifragile')、加密原生 (Bitcoin whitepaper 中本聪、'The Bitcoin Standard' Saifedean、Vitalik 博客与 Ethereum whitepaper、'DeFi and the Future of Finance'、Lyn Alden 宏观、a16z crypto 文章、Messari/Delphi/Bankless 研报)、链上分析方法 (Glassnode/CryptoQuant 教程、Nansen/Arkham/Dune 文档、Dune Analytics SQL)、交易方法论散见于 podcast/Substack/Twitter thread 而非书; (e) figures/流派 — 价值/基本面派 (Vitalik Buterin 以太坊、Hasu/Su Zhu(争议)、Arthur Hayes BitMEX 创始人/宏观+衍生品、Raoul Pal、Lyn Alden 宏观、Cobie/Jordan Fish UpOnly podcast、DeFi 研究 Bankless Ryan Adams/David Hoffman); 链上分析派 (Nansen Alex Svanevik、Arkham、Adam Cochran、Ansem(blknoiz06) 链上交易、Murad memecoin supercycle、链上侦探 ZachXBT 反诈); 合约/衍生品派 (Arthur Hayes、GCR(GiganticRebirth) 传奇合约、Pentoshi、CryptoCred 技术分析、Tyler Durden); meme/叙事派 (Ansem、Murad、Cobie、各 Solana memecoin KOL); 宏观/周期派 (Raoul Pal、Lyn Alden、PlanB stock-to-flow(争议)、Benjamin Cowen 数据/周期); 量化/系统化 (各匿名量化、Hyperliquid 生态); 中文圈 (链上分析/合约 KOL、币圈大 V、播客如 '无人之境'/'Web3 佛学院'、研究机构如 Foresight/PANews/律动 BlockBeats); 反诈/安全 (ZachXBT、SlowMist 慢雾、go+ 安全); (f) 行业话术/黑话 — 现货 spot / 合约 perps 永续 / 杠杆 leverage / 多空 long-short / 爆仓 liquidation 清算 / 资金费率 funding rate / 开多开空 / 止损 SL 止盈 TP / 仓位 position sizing / 满仓梭哈 ape in / 梭 / FOMO / FUD / 钻石手 diamond hands / 纸手 paper hands / 韭菜 / 镰刀 / 庄 / 出货 / 拉盘砸盘 / 插针 wick / 针 / 上车下车 / 埋伏 / 潜伏 / 链上 on-chain / 钱包 wallet / 地址 / 聪明钱 smart money / 巨鲸 whale / 跟单 copy-trade / 老鼠仓 / 貔貅盘 honeypot / 貔貅 / rug 跑路 rug-pull / 归零 / 土狗 (memecoin/小币) / 金狗 (暴涨百倍) / meme 币 / 叙事 narrative / 赛道 / 板块轮动 / 撸毛 撸空投 airdrop / 女巫 sybil / 交互 / 解锁 unlock / 砸盘解锁 / 代币经济学 tomomics / TVL / APY APR / 无常损失 IL / 滑点 slippage / MEV / 三明治 sandwich / gas / 抢跑 frontrun / 貔貅检测 / 授权 approve / 撤销授权 revoke / 私钥 助记词 seed phrase / 冷钱包 热钱包 / 自托管 / 减半 halving / 牛熊 / 山寨季 altseason / 比特币市占率 BTC.D / 山寨 alt / 主流币 / DeFi 暑期 / GM / WAGMI / NGMI / 归零归零 / PvP / Ponzi 庞氏; (g) 争议/批

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

OS post-exploitation after a stable host foothold: quiet host recon, host-native persistence (Windows Run/tasks/services/COM/WMI and Linux SSH/cron/systemd/SUID), long-term C2 (Sliver primary, Mythic/Havoc optional), targeted collection and exfil, and engagement cleanup. Does not own AD/cloud/K8s native persistence, Ligolo pivoting, LSASS dumping, or EDR bypass. Operator selects objectives; success is a live callback, verified persistence, delivered loot, or restored host — not generating an unused implant.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Active Directory and network lateral movement assessment. Pass-the-hash, pass-the-ticket, Kerberoasting, AS-REP roasting, NTLM relay, SMB relay, WMI/WinRM/PSRemoting abuse, constrained/unconstrained delegation, RBCD, cross-trust exploitation, and pivoting. Uses impacket, netexec, enum4linux-ng, smbmap, smbclient, bloodhound-python, Responder, ntlmrelayx, mitm6, and ldap-utils. Chains from /post-exploit or /credential-audit.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Execute a complete Active Directory penetration test from initial enumeration to domain dominance. Use this skill for AD security assessments including LDAP enumeration, Kerberos attacks (Kerberoasting, AS-REP roasting), BloodHound attack path analysis, credential dumping with Mimikatz, lateral movement via PsExec/WMI/DCOM, DCSync for NTDS extraction, and Golden/Silver ticket forging. Covers the full kill chain from domain user to domain admin.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Hunts for Windows persistence across autostart locations: Run keys, services, scheduled tasks, WMI event subscriptions, and startup folders, baselining them to surface anomalous or recently added entries. Activates for requests to hunt persistence, audit autostart extensibility points, or find malware autoruns on Windows.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.