Results for “process-hollowing”
51 skillsdetecting-process-hollowing-technique
Detect process hollowing (T1055.012) by analyzing memory-mapped sections, hollowed process indicators, and parent-child process anomalies in EDR telemetry.
24.6k · bundle
hunting-for-process-injection-techniques
Detect process injection techniques (T1055) including CreateRemoteThread, process hollowing, and DLL injection via Sysmon Event IDs 8 and 10 and EDR process telemetry.
24.6k · bundle
process-hollowing
Execute advanced evasion by injecting malicious code into the memory space of a legitimate, suspended process (Process Hollowing). This skill details techniques to bypass static and dynamic analysis by masking malicious activity behind trusted processes like svchost.exe or explorer.exe.
21 · bundle
More results
detecting-t1055-process-injection-with-sysmon
Detect process injection techniques (T1055) including classic DLL injection, process hollowing, and APC injection by analyzing Sysmon events for cross-process memory operations, remote thread creation, and anomalous DLL loading patterns.
24.6k · bundle
workflow-debugging
Debug AEM Workflow issues on AEM 6.5 LTS and AMS including stuck workflows, failed steps, missing Inbox tasks, launcher failures, stale instances, thread pool exhaustion, queue backlogs, purge failures, and permissions errors.
142 · bundle
plow-ahead
Proceed through ordinary ambiguity by making reasonable assumptions, keeping momentum, validating as you go, and ending with a clear recap of decisions, changes, verification, and residual risk.
3.4k · bundle
brain-dump-journaling
Brain Dump Journaling
11 · bundle
pipeline
End-to-end source processing -- seed, reduce, process all claims through reflect/reweave/verify, archive. The full pipeline in one command. Triggers on "/pipeline", "/pipeline [file]", "process this end to end", "full pipeline".
3 · bundle
detecting-process-injection-techniques
Detects and analyzes process injection techniques used by malware, including classic DLL injection, process hollowing, APC injection, thread hijacking, and reflective loading, using memory forensics, API monitoring, and behavioral analysis.
24.6k · bundle
plan-error-handling
Audit a codebase for silent failures, swallowed exceptions, and observability gaps across Sentry and Langfuse, then produce a phased fix plan. Use when the user says "errors aren't showing in Sentry", "things fail silently", "empty catch blocks", "add error handling", "check my Langfuse tracing", or is hardening.
8
mengto-reveal-hover-effect
Use when building cursor-following spotlight reveals that expose a second aligned image through a soft radial mask—hover-to-color, before-and-after, x-ray, material, texture, product-detail, or illustrated heroes where a desaturated or embossed base stays visible while another treatment follows an eased pointer.
0 · bundle
re-create
Completely delete and rewrite a file or module from scratch when structural rot makes patching impossible, with enforced preservation of interfaces and blast radius verification.
42.4k
pua
> 强化高能动性和高压闭环执行的行为技能。适用于连续失败、原地打转、空口完成、 把问题甩给用户、没搜就猜、修完就停等场景,也支持手动通过 /pua 进入核心模式。
2 · bundle
hoare-1978-csp
Foundational theory for process-oriented concurrency through synchronous message-passing, applicable to multi-agent coordination and parallel decomposition
10 · bundle
debugging-methodology
Debugging is the scientific method under time pressure.
2
harness-pulse
Harness Pulse
18 · bundle
pure-focus-state
当需要进入高效学习、创作或问题解决的心流状态时,调用此模型作为环境与心理准备框架
11 · bundle
flops
Evaluates computational throughput and real-time efficiency of embedded CPU and GPU platforms by measuring peak FLOPS via a matrix rotation kernel and assessing inference latency and power consumption on a robotic vision pipeline.
3
worked-example-fading-designer
Design a worked example fading sequence from fully worked examples through to independent practice. Use when teaching procedures, algorithms, or multi-step processes to novice learners.
0
goals
Optimize prompts via process goals (controllable behavioral instructions) rather than outcome goals (sparse end-result demands). Grounded in sports psychology meta-analysis showing process goals (d=1.36) vastly outperform outcome goals (d=0.09). Use when designing prompts, optimizing LLM steering, implementing CoT/decomposition patterns, or building automatic prompt optimization pipelines. Instantiates surrogate loss paradigm for discrete prompt space.
0
resuming
Resume an interrupted workflow run with verify-first strategy — loads sidecar state, verifies the last step, and continues execution.
0
n8n-error-handling
Makes n8n workflow failures loud, structured, and recoverable by wiring per-node error outputs, retry logic, error-trigger workflows, and proper HTTP response shapes.
5.7k · bundle
flow-state-balancing
当需要进入并维持高效、专注的心流状态,以提升学习、工作或技能获取效率时
11 · bundle
error-handling-audit
Audit a repo (or diff) for weak error handling — swallowed exceptions, bare catches, unhandled promise rejections, missing network timeouts/retries, and errors logged but not surfaced. Pure Claude Code, no MCP, no signup.
gtm-enterprise-onboarding
Onboard enterprise customers from contract to value realization using a four-phase framework that prevents churn and the Week 4 ghosting pattern.
36.2k
heath-no-fluff
heath-no-fluff
0
close-workspace
Use when closing a herdr workspace or worktree. Merges the workspace's completed, reviewed branch into the default branch, confirms origin is in sync, then removes the worktree and closes the workspace.
1 · bundle
handoff
Handoff
0
hook-lab-10-scroll-stopping-opening-lines-for-any-topic
Generates 10 scroll-stopping opening lines for any topic, each labeled with the psychological lever it uses, plus a ranked top-3 recommendation.
2
xiaohongshu-auto-posting
Automates Xiaohongshu content operations: topic discovery, style reference collection, content writing, publishing, and performance tracking.
3.7k
handoff-diet
Meta-skill codifying the no-wakeup-polling pattern. Describes the ScheduleWakeup anti-pattern, the fix (--auto merge + detached watcher), and when to still use wakeups. Reduces handoff spam by 80%.
1 · bundle
monitor-jobs
Monitor SLURM/PBS jobs and their logs. Use when the user asks to monitor, check, or watch a submitted job. Automatically detects running/pending jobs, tails logs, and reports errors.
1
fp-async
Practical async patterns using TaskEither - clean pipelines instead of try/catch hell, with real API examples
1
fix-proposal
Generate one high-value follow-up workflow proposal when MoonMind execution quality issues are detected in a run.
12
research-ritual-hooks
Use when automating research session rituals in Claude Code with hooks, such as session-start context injection, daily research logging, session-end persistence, or pre-commit guards that block secrets and unverified citations.
2
pua
Use for PUA/try-harder productivity coaching when the user expresses frustration, repeated failure, quality complaint, passive behavior, says retry/change approach/don't give up, asks for evidence/completion check/test before done, or wants Ding-style workplace reminders. Triggers include: try harder, stop giving up, figure it out, again??, why still failing, change approach, no evidence, run tests, done without proof, 换个方法, 再试试, 别摆烂, 别偷懒, 为什么还不行, 又错了, 证据呢, 没跑测试别说完成, 验收, 闭环, 自嗨, 置身钉外, 无招, 老板体感. Do not use for calm first-attempt requests.
0 · bundle