「wmi」の検索結果

Hunts for malicious WMI permanent event subscription persistence by correlating __EventFilter, CommandLineEventConsumer/ActiveScriptEventConsumer, and FilterToConsumerBinding records from Sysmon Event IDs 19/20/21 or WMI repository exports. Activates for requests to hunt WMI persistence, detect event consumer backdoors, or analyze WMI subscription telemetry.

日本語の概要は準備中です。原文の説明を表示しています。

Detect WMI event subscription persistence (MITRE T1546.003) by analyzing Sysmon Event IDs 19, 20, and 21 for malicious EventFilter, EventConsumer, and FilterToConsumerBinding creation, cross-referenced against root\subscription namespace contents and Sysinternals Autoruns. Use when hunting WMI-based persistence, triaging a Sysmon alert on these event IDs, or during incident response and purple-team validation of WMI defenses.

日本語の概要は準備中です。原文の説明を表示しています。

Hunts for lateral movement via remote service creation, admin share writes, and remote WMI process creation by correlating Windows logon, service install, and process-creation events. Activates for requests to hunt lateral movement, detect PsExec/WMIexec activity, or find remote execution over SMB and WMI.

日本語の概要は準備中です。原文の説明を表示しています。

Detect WMI event subscription persistence by analyzing Sysmon Event IDs 19, 20, and 21 for malicious EventFilter, EventConsumer, and FilterToConsumerBinding creation.

日本語の概要は準備中です。原文の説明を表示しています。

Manage productivity with FlowMind — goals, tasks (with subtasks), notes, people, and tags via REST API. Use when the user wants to create, list, update, or delete goals, tasks, notes, contacts, or tags; manage focus/priorities; track progress; or organize their productivity workspace through FlowMind.

日本語の概要は準備中です。原文の説明を表示しています。

Detects and analyzes fileless malware that operates entirely in memory using PowerShell, WMI, .NET reflection, registry-resident payloads, and living-off-the-land binaries (LOLBins) without writing traditional executable files to disk. Use for requests involving fileless threat detection, in-memory malware investigation, LOLBin abuse analysis, or WMI persistence examination.

日本語の概要は準備中です。原文の説明を表示しています。

Detects and analyzes fileless malware that operates entirely in memory using PowerShell, WMI, .NET reflection, registry-resident payloads, and living-off-the-land binaries (LOLBins) without writing traditional executable files to disk. Activates for requests involving fileless threat detection, in-memory malware investigation, LOLBin abuse analysis, or WMI persistence examination.

日本語の概要は準備中です。原文の説明を表示しています。

Detects and analyzes fileless malware that operates entirely in memory using PowerShell, WMI, .NET reflection, registry-resident payloads, and living-off-the-land binaries (LOLBins) without writing traditional executable files to disk. Activates for requests involving fileless threat detection, in-memory malware investigation, LOLBin abuse analysis, or WMI persistence examination.

日本語の概要は準備中です。原文の説明を表示しています。

Detects and analyzes fileless malware that operates entirely in memory using PowerShell, WMI, .NET reflection, registry-resident payloads, and living-off-the-land binaries (LOLBins) without writing traditional executable files to disk. Activates for requests involving fileless threat detection, in-memory malware investigation, LOLBin abuse analysis, or WMI persistence examination.

日本語の概要は準備中です。原文の説明を表示しています。

Systematically map and remove malware, backdoors, and attacker persistence mechanisms (registry Run keys, scheduled tasks, WMI subscriptions, services, cron/init.d) from infected Windows and Linux systems using Autoruns, EDR/AV, and YARA, restoring a clean state while preventing re-infection. Use after containment and forensic analysis have identified all compromised systems and persistence mechanisms and you are ready to eradicate and recover.

日本語の概要は準備中です。原文の説明を表示しています。

Detect adversary lateral movement across networks using Splunk SPL queries against Windows authentication logs, SMB traffic, and remote service (WMI/PsExec/RDP) abuse. Use when hunting for MITRE ATT&CK TA0008 lateral movement activity or investigating suspected pivoting between hosts during an incident, with Splunk as the SIEM.

日本語の概要は準備中です。原文の説明を表示しています。

Detects fileless malware and in-memory attacks that execute entirely in RAM without writing persistent files to disk, evading traditional antivirus. Use when building detections for PowerShell-based attacks, reflective DLL injection, WMI persistence, and registry-resident malware. Activates for requests involving fileless malware detection, in-memory attacks, PowerShell exploitation, or living-off-the-land techniques.

日本語の概要は準備中です。原文の説明を表示しています。

External research synthesis from Trail of Bits, SlowMist, ConsenSys, Immunefi, and Cyfrin. Use this for advanced audit methodology, Echidna/Medusa fuzzing setup, Slither custom detector writing, attack pattern deep dives, or the 4-phase learning roadmap.

日本語の概要は準備中です。原文の説明を表示しています。

Comprehensive persistence tradecraft for authorized red team engagements covering Windows and Linux mechanisms. Windows techniques include registry Run/RunOnce keys, scheduled tasks, WMI event subscriptions, DLL search order hijacking, COM object hijacking, Startup folder drops, service creation, Security Support Provider (SSP) DLL injection, and Active Directory persistence (AdminSDHolder abuse, DCShadow, Golden Ticket, Silver Ticket, Skeleton Key, SID History injection). Linux techniques include cron and at jobs, systemd timers and services, SSH authorized_keys injection, shell profile backdoors (.bashrc/.bash_profile), PAM module backdoors, LD_PRELOAD hijacking, kernel module rootkits, web shells, and Git hook abuse. Provides operator-ready command sequences for SharPersist, Impacket ticketer, schtasks, sc.exe, crontab, and systemctl with OPSEC considerations for each method. Maps to MITRE ATT&CK T1547 (Boot or Logon Autostart), T1053 (Scheduled Task/Job), T1546 (Event Triggered Execution), T1556 (Modify Authentication Process), and sub-techniques. Includes detection indicators and a rapid engagement cheatsheet.

日本語の概要は準備中です。原文の説明を表示しています。

Use this skill whenever the user asks about NetExec (nxc) — a network exploitation and post-exploitation tool for Active Directory environments. Triggers include: any mention of 'nxc', 'netexec', 'crackmapexec' successor questions, AD enumeration, SMB/LDAP/WinRM/MSSQL/SSH/RDP/VNC/WMI/FTP/NFS protocol attacks, password spraying, credential dumping (SAM, NTDS, LSASS, DPAPI), Kerberoasting, ASREPRoasting, lateral movement, BloodHound collection, module usage, or any pentest workflow involving Windows domain environments. This skill covers ALL protocols, ALL modules, and ALL core features of NetExec. Always provide full command examples with correct flags and options.

日本語の概要は準備中です。原文の説明を表示しています。

Active Directory attack methodology for internal network red team engagements. Covers reconnaissance (BloodHound, PowerView, ADExplorer), credential abuse (Kerberoasting, ASREProasting, NTLM relay, LLMNR/NBT-NS poisoning), privilege escalation (ACL abuse, GPO abuse, unconstrained/constrained delegation), lateral movement (Pass-the-Hash, Pass-the-Ticket, Overpass-the-Hash, WMI/WinRM/PsExec), persistence (Golden/Silver/Diamond Tickets, DCSync, DCShadow, AdminSDHolder, Skeleton Key), forest trust attacks, ADCS abuse (ESC1-ESC15), and modern MDI/Defender for Identity evasion. Use when assessing on-prem AD, hybrid AD/Entra ID environments, or ADCS deployments.

日本語の概要は準備中です。原文の説明を表示しています。

Comprehensive lateral movement tradecraft for authorized red team engagements covering credential-based movement (pass-the-hash, pass-the-ticket, overpass-the-hash), NTLM relay attacks (ntlmrelayx with PetitPotam, DFSCoerce, PrinterBug coercion), remote execution protocols (WMI, WinRM, DCOM, PsExec and alternatives), RDP session hijacking, and network pivoting through tunneling tools (chisel, ligolo-ng, SSH tunnels, SOCKS proxies). Provides operator-ready command sequences for mimikatz, crackmapexec/netexec, impacket suite, and evil-winrm with emphasis on OPSEC considerations, SMB signing bypass, and detection evasion. Maps to MITRE ATT&CK T1021 (Remote Services), T1550 (Use Alternate Authentication Material), and sub-techniques. Includes defender-perspective detection guidance for blue team awareness and a rapid engagement cheatsheet for common lateral movement scenarios encountered during internal penetration tests and assumed-breach exercises.

日本語の概要は準備中です。原文の説明を表示しています。

Windows lateral movement playbook. Use when pivoting between Windows hosts via PsExec, WMI, WinRM, DCOM, RDP, pass-the-hash, overpass-the-hash, or pass-the-ticket techniques.

日本語の概要は準備中です。原文の説明を表示しています。

The telemetry each Active Directory technique generates and what alerts a defender: Kerberoasting produces Event 4769 with RC4 encryption (0x17) and an MDI alert, DCSync produces Event 4662 with the DS-Replication-Get-Changes GUID, AS-REP roasting produces Event 4768 with no pre-auth, LSASS dumping is blocked by EDR, plus a lateral-movement telemetry table by protocol (SMB/WMI/WinRM/RDP/DCOM). Use this whenever you run or plan an offensive AD technique and need to know what noise it makes, when writing the engagement's detection notes, or when a defender wants to know what to monitor. Teaches red teamers what is loud and blue teamers what to watch. Standard-tooling knowledge, no vendor engine.

日本語の概要は準備中です。原文の説明を表示しています。

加密链上交易 (加密 / 链上交易 (Crypto & On-chain Trading) — 以加密资产为标的、强调链上活动的主动交易认知操作系统：从「看叙事/选赛道 → 找标的 → 链上尽调与风控 → 选场所(DEX/CEX/链上合约) → 建仓与仓位管理 → 监控链上流向与情绪 → 退出与复盘」的完整决策链。覆盖 (a) 第一性张力 — **链上 on-chain (DEX 现货/AMM、钱包追踪 wallet tracking、资金流向 flow、MEV、memecoin、链上衍生品 Hyperliquid/GMX、自托管 self-custody, 'not your keys not your coins') ⇄ 链下 CEX (中心化交易所现货/合约 Binance/OKX/Bybit、订单簿、托管、出入金法币)**; **合约/杠杆/衍生品 (perps 永续、资金费率 funding、清算 liquidation、爆仓、做多做空、高频/择时) ⇄ 现货/价值/长持 (spot、HODL、定投 DCA、基本面/估值、'time in market > timing the market')**; **价值/基本面派 (协议收入、TVL、代币经济学 tokenomics、真实使用、估值模型) ⇄ meme/叙事/情绪派 (memecoin、narrative rotation 叙事轮动、attention is the asset、纯博弈/PvP、Ponzinomics)**; **链上数据/量化/客观 (on-chain analytics, Nansen/Arkham/Dune、聪明钱 smart money、链上指标、系统化/机械化) ⇄ 直觉/盘感/叙事阅读 (narrative、KOL alpha、社群情绪、tape reading)**; **自托管/去中心化/抗审查 (DeFi、自托管钱包、抗审查、'be your own bank') ⇄ 便利/合规/中心化 (CEX、合规出入金、KYC、托管、ETF)**; **主动交易/择时/高换手 (trading、波段、合约、撸毛/空投 airdrop farming、套利 arbitrage) ⇄ 被动配置/低换手 (配置 BTC/ETH、ETF、长期叙事 beta)**; (b) 核心工作流 / pipeline (最标准、最易蒸高质量 + CLI 化) — 通用链: 叙事/赛道判断 (宏观周期/减半/流动性/板块轮动) → 标的发现 (链上扫链/聪明钱跟单/新币/叙事映射) → 尽调 due diligence (代币经济学/解锁 unlock/团队/合约审计/honeypot 检测/流动性与持仓分布) → 风控前置 (仓位 sizing/最大回撤/止损/相关性) → 场所与执行 (CEX vs DEX、滑点/MEV/gas、限价 vs 市价、TWAP) → 持仓监控 (链上流向/巨鲸/资金费率/解锁日历/情绪指标) → 退出与复盘 (止盈分批/再平衡/记录交易日志); 子流派 SOP: 链上 degen 打新与 memecoin 流程、合约交易者的资金费率与清算地图、空投/撸毛 farming、套利与 MEV、被动配置与定投; (c) 工具栈 — 链上分析 (Nansen 聪明钱/Arkham 实体标注/Dune 自建仪表盘/Dexscreener & DEX Screener 新币/GMGN & Photon & BullX memecoin 终端/Etherscan & Solscan 区块浏览器/DeBank 钱包总览/Token Terminal 协议基本面/DefiLlama TVL/Glassnode & CryptoQuant 链上指标)、交易场所 (CEX: Binance/OKX/Bybit/Coinbase; 链上现货 DEX: Uniswap/Jupiter/Raydium/Aerodrome; 链上衍生品: Hyperliquid/GMX/dYdX)、钱包与安全 (MetaMask/Rabby/Phantom 热钱包、Ledger/Trezor 硬件冷钱包、Revoke.cash 授权管理、honeypot/合约扫描)、行情与图表 (TradingView、CoinGecko/CoinMarketCap)、信息与聚合 (Twitter/X、Telegram、DeFiLlama、RootData/ICO 日历、解锁日历 Token Unlocks)、自动化 (交易机器人、链上 bot/sniper、Telegram trading bot); (d) 知识正典 — 注意加密交易 canon 偏少且新: 通用交易/风控经典 (Edwin Lefèvre 'Reminiscences of a Stock Operator'、Van Tharp 'Trade Your Way to Financial Freedom' 仓位管理、Mark Douglas 'Trading in the Zone' 交易心理、Michael Mauboussin、Nassim Taleb 'Fooled by Randomness/Antifragile')、加密原生 (Bitcoin whitepaper 中本聪、'The Bitcoin Standard' Saifedean、Vitalik 博客与 Ethereum whitepaper、'DeFi and the Future of Finance'、Lyn Alden 宏观、a16z crypto 文章、Messari/Delphi/Bankless 研报)、链上分析方法 (Glassnode/CryptoQuant 教程、Nansen/Arkham/Dune 文档、Dune Analytics SQL)、交易方法论散见于 podcast/Substack/Twitter thread 而非书; (e) figures/流派 — 价值/基本面派 (Vitalik Buterin 以太坊、Hasu/Su Zhu(争议)、Arthur Hayes BitMEX 创始人/宏观+衍生品、Raoul Pal、Lyn Alden 宏观、Cobie/Jordan Fish UpOnly podcast、DeFi 研究 Bankless Ryan Adams/David Hoffman); 链上分析派 (Nansen Alex Svanevik、Arkham、Adam Cochran、Ansem(blknoiz06) 链上交易、Murad memecoin supercycle、链上侦探 ZachXBT 反诈); 合约/衍生品派 (Arthur Hayes、GCR(GiganticRebirth) 传奇合约、Pentoshi、CryptoCred 技术分析、Tyler Durden); meme/叙事派 (Ansem、Murad、Cobie、各 Solana memecoin KOL); 宏观/周期派 (Raoul Pal、Lyn Alden、PlanB stock-to-flow(争议)、Benjamin Cowen 数据/周期); 量化/系统化 (各匿名量化、Hyperliquid 生态); 中文圈 (链上分析/合约 KOL、币圈大 V、播客如 '无人之境'/'Web3 佛学院'、研究机构如 Foresight/PANews/律动 BlockBeats); 反诈/安全 (ZachXBT、SlowMist 慢雾、go+ 安全); (f) 行业话术/黑话 — 现货 spot / 合约 perps 永续 / 杠杆 leverage / 多空 long-short / 爆仓 liquidation 清算 / 资金费率 funding rate / 开多开空 / 止损 SL 止盈 TP / 仓位 position sizing / 满仓梭哈 ape in / 梭 / FOMO / FUD / 钻石手 diamond hands / 纸手 paper hands / 韭菜 / 镰刀 / 庄 / 出货 / 拉盘砸盘 / 插针 wick / 针 / 上车下车 / 埋伏 / 潜伏 / 链上 on-chain / 钱包 wallet / 地址 / 聪明钱 smart money / 巨鲸 whale / 跟单 copy-trade / 老鼠仓 / 貔貅盘 honeypot / 貔貅 / rug 跑路 rug-pull / 归零 / 土狗 (memecoin/小币) / 金狗 (暴涨百倍) / meme 币 / 叙事 narrative / 赛道 / 板块轮动 / 撸毛 撸空投 airdrop / 女巫 sybil / 交互 / 解锁 unlock / 砸盘解锁 / 代币经济学 tomomics / TVL / APY APR / 无常损失 IL / 滑点 slippage / MEV / 三明治 sandwich / gas / 抢跑 frontrun / 貔貅检测 / 授权 approve / 撤销授权 revoke / 私钥 助记词 seed phrase / 冷钱包 热钱包 / 自托管 / 减半 halving / 牛熊 / 山寨季 altseason / 比特币市占率 BTC.D / 山寨 alt / 主流币 / DeFi 暑期 / GM / WAGMI / NGMI / 归零归零 / PvP / Ponzi 庞氏; (g) 争议/批

日本語の概要は準備中です。原文の説明を表示しています。

OS post-exploitation after a stable host foothold: quiet host recon, host-native persistence (Windows Run/tasks/services/COM/WMI and Linux SSH/cron/systemd/SUID), long-term C2 (Sliver primary, Mythic/Havoc optional), targeted collection and exfil, and engagement cleanup. Does not own AD/cloud/K8s native persistence, Ligolo pivoting, LSASS dumping, or EDR bypass. Operator selects objectives; success is a live callback, verified persistence, delivered loot, or restored host — not generating an unused implant.

日本語の概要は準備中です。原文の説明を表示しています。

Active Directory and network lateral movement assessment. Pass-the-hash, pass-the-ticket, Kerberoasting, AS-REP roasting, NTLM relay, SMB relay, WMI/WinRM/PSRemoting abuse, constrained/unconstrained delegation, RBCD, cross-trust exploitation, and pivoting. Uses impacket, netexec, enum4linux-ng, smbmap, smbclient, bloodhound-python, Responder, ntlmrelayx, mitm6, and ldap-utils. Chains from /post-exploit or /credential-audit.

日本語の概要は準備中です。原文の説明を表示しています。

Execute a complete Active Directory penetration test from initial enumeration to domain dominance. Use this skill for AD security assessments including LDAP enumeration, Kerberos attacks (Kerberoasting, AS-REP roasting), BloodHound attack path analysis, credential dumping with Mimikatz, lateral movement via PsExec/WMI/DCOM, DCSync for NTDS extraction, and Golden/Silver ticket forging. Covers the full kill chain from domain user to domain admin.

日本語の概要は準備中です。原文の説明を表示しています。

Hunts for Windows persistence across autostart locations: Run keys, services, scheduled tasks, WMI event subscriptions, and startup folders, baselining them to surface anomalous or recently added entries. Activates for requests to hunt persistence, audit autostart extensibility points, or find malware autoruns on Windows.

日本語の概要は準備中です。原文の説明を表示しています。