Security

purpleailab Skill

FIN7 (Carbon Spider / Sangria Tempest) adversary-emulation playbook — revenue-targeted spearphishing with phone follow-up, EDR-evasion tradecraft, AD compromise, and big-game-hunting ransomware. Use when emulating a high-end financially-motivated crew that graduated from POS theft to ransomware. Triggers on: 'emulate FIN7', 'Carbanak', 'Carbon Spider', 'Sangria Tempest', 'big game hunting', 'EDR evasion', 'AvNeutralizer'.

purpleailab Skill

Lazarus Group (Hidden Cobra, DPRK RGB) adversary-emulation playbook — financially-motivated crypto/DeFi theft and supply-chain intrusion: fake-job social engineering, trojanized apps, wallet/key theft, and on-chain DeFi/bridge exploitation (testnet/fork only). Use when emulating DPRK financial actors against a crypto/exchange/DeFi target. Triggers on: 'emulate Lazarus', 'Hidden Cobra', 'DPRK crypto', 'AppleJeus', '3CX supply chain', 'DeFi bridge attack', 'crypto theft'.

purpleailab Skill

LockBit / generic RaaS-affiliate adversary-emulation playbook — broker/edge/RDP initial access, beacon, AD compromise to Domain Admin, defense evasion (Defender-disable via GPO, shadow-copy deletion), bulk exfil, then canary double-extortion encryption (Windows + ESXi). Reusable template for any ransomware affiliate (ALPHV, Akira, Black Basta). Triggers on: 'emulate LockBit', 'ransomware affiliate', 'RaaS', 'double extortion', 'StealBit', 'domain-wide ransomware', 'ESXi locker'.

purpleailab Skill

Sandworm (APT44 / Seashell Blizzard, GRU Unit 74455) adversary-emulation playbook — IT→OT intrusion ending in ICS manipulation or destructive impact, executed with living-off-the-land Windows tooling. SAFETY-CRITICAL: destructive and ICS-write steps are canary/lab-only and gated on explicit OT authorization. Use when emulating Sandworm against an ICS/OT or critical-infrastructure estate. Triggers on: 'emulate Sandworm', 'APT44', 'Seashell Blizzard', 'Voodoo Bear', 'ICS attack', 'OT destructive', 'Industroyer', 'NotPetya'.

netvar1337 Skill

BYOVD (Bring Your Own Vulnerable Driver) attack workflow: identify vulnerable signed drivers, map IOCTLs, arbitrary physical/virtual memory, MSR R/W, kernel code exec. Use for BYOVD, vulnerable .sys abuse, signed-driver primitives. Do NOT use for writing a new WDM/KMDF driver from scratch (kernel-dev) or generic exploit-dev without a driver primitive.

netvar1337 Skill

Configures a harness. A meta-skill that defines specialized agents and creates the skills those agents will use. Use when (1) asked to 'configure a harness' or 'build a harness,' (2) asked for 'harness design' or 'harness engineering,' (3) building a harness-based automation system for a new domain/project, (4) reconfiguring or extending a harness, or (5) handling operations/maintenance requests for an existing harness, such as 'inspect the harness,' 'audit the harness,' 'harness status,' or 'synchronize agents/skills.'

netvar1337 Bundle

Frida dynamic binary instrumentation for RE and security research: spawn/attach, Interceptor hooks, NativeFunction, Memory scanning, Stalker tracing, gadget modes, anti-anti-debug bypass patterns, il2cpp/mono bridges for games, OPSEC of frida-server, and reliability discipline for long sessions. Local stack: frida 17.17.0 + frida-tools 14.10.4 via pip.

netvar1337 Bundle

Use for authorized RF/SDR security research including signal identification, replay feasibility study in shielded labs, and wireless protocol analysis outside classic Wi-Fi.

netvar1337 Bundle

Use for authorized source-code security review and SAST workflows including Semgrep, CodeQL patterns, dangerous API hunting, and fix verification.

netvar1337 Skill

Use when designing, writing, reviewing, debugging, or hardening Windows WDM/KMDF drivers, IRP and IOCTL paths, PnP/power lifecycles, queues, cancellation, kernel memory, callbacks, or version-pinned ring-0 research. Covers WDK, HVCI, Driver Verifier, KD triage, manual mapping, APC/VAD/DKOM research, and safe teardown; route BYOVD to byovd and user-mode exploitation to exploit-dev.

netvar1337 Bundle

Vulnerability intelligence & 0day-adjacent research workflow: CVE tracking, N-day analysis, patch-tuesday triage, exploit-publication monitoring (GitHub / NVD / vendor advisories / ZDI bulletins), and variant-hunting from public disclosures. Use when the operator asks to track or research a CVE, evaluate a fresh disclosure, scan a new patch for exploitability, or monitor for emerging 0day/N-day leads.

netvar1337 Skill

Use when converting a known crash, UAF, overflow, type confusion, race, or logic flaw into a measured exploit primitive, leak, heap strategy, mitigation-aware PoC, ROP/JOP or shellcode chain, local privilege escalation, and deterministic reliability harness. Routes allocator- and platform-specific work without conflating Windows user mode, Windows kernel, glibc, or Linux kernel; do not use for driver authoring, BYOVD, or multi-host orchestration.

netvar1337 Bundle

Guide for understanding and contributing to the awesome-game-security curated resource list. Use this skill when adding new resources, organizing categories, mapping topics across anti-cheat, Windows kernel, DMA, reverse engineering, and game-engine research, or maintaining README.md format consistency.

netvar1337 Bundle

Search for ROP/JOP/COP gadgets in a binary via r2xsql's rop_gadgets and rop_gadget_instructions tables, and look up syscall names/numbers via the syscalls reference table. Use when building an exploit chain, hunting for stack-pivot/syscall/write-what-where primitives, resolving a target's syscall table, or answering 'what gadgets are available here'.

netvar1337 Skill

Use for authorized game security research involving Unreal, Unity, Source, or custom-engine reverse engineering, build-pinned offsets, external/internal instrumentation, overlays, speed/time virtualization, client-server protocol and logic exploits, reconciliation or rollback trust, cheat telemetry, and anti-cheat experiments. Routes offset dumping, protocol RE, exploit development, and detection validation to the correct specialist.

netvar1337 Bundle

Use for authorized security testing of desktop thick clients including local storage, update channels, IPC, traffic, and client-side trust boundaries.

netvar1337 Bundle

Use for authorized macOS and Mach-O reverse engineering including codesign, Objective-C/Swift recovery, endpoint security surfaces, and Apple platform malware analysis.

netvar1337 Skill

Audit smart contracts, analyze Web3 protocols, reproduce security flaws on local forks, investigate transaction behavior, and develop proof-of-concept exploit paths. Use for Solidity, EVM, DeFi, bridge, wallet, signing, MEV, and on-chain security tasks.

netvar1337 Bundle

Writing, exploit; assemble raw material into a journey of beats, grounding each term before a beat leans on it.

netvar1337 Bundle

Writing, exploit: shape raw material into an article, paragraph by paragraph.

netvar1337 Bundle

Guide for modern game anti-cheat architecture, Windows kernel monitoring, and detection tradeoffs. Use this skill when analyzing EAC, BattlEye, Vanguard, FACEIT AC, kernel callbacks, handle protection, manual-map detection, boot-start drivers, BYOVD, DMA threats, or behavioral telemetry in game security research.

netvar1337 Bundle

Guide for PCIe DMA threat modeling, FPGA-based memory access, and defensive implications in game security. Use this skill when researching pcileech, BAR and TLP behavior, page-table walking, IOMMU or VT-d, device impersonation, firmware mimicry, or DMA detection and mitigation in game security research.

netvar1337 Bundle

Use for authorized email security review including phishing analysis, header authentication (SPF/DKIM/DMARC), BEC patterns, and mailbox token abuse research.

netvar1337 Bundle

Use for authorized Android or iOS application reverse engineering and security testing, including APK or IPA analysis, runtime instrumentation, SSL pinning, and platform protection checks.

netvar1337 Bundle

Use for whole-repo over-engineering audit ('audit for over-engineering', /ponytail-audit). Report only.

netvar1337 Bundle

Use for blue-team threat hunting, detection engineering with Sigma/YARA, SIEM query design, and incident detection validation.

netvar1337 Bundle

Guide for game-engine internals, source trees, plugins, and engine-specific security research. Use this skill when researching Unreal, Unity, Source, Godot, custom engines, engine detectors, engine explorers, or engine protection patterns relevant to modding, reverse engineering, and anti-cheat.

netvar1337 Bundle

Triage and audit radare2 binaries via r2xsql — find suspicious behavior, surface crypto/network/persistence APIs, hunt high-complexity functions, and run multi-table queries that combine code, data, and xrefs.

netvar1337 Bundle

Guide for game-hacking technique taxonomy and threat modeling relevant to game security. Use this skill when researching memory access, code injection, overlays, input simulation, engine-specific attack surfaces, or how modern anti-cheat systems constrain user-mode, kernel-mode, hypervisor, and DMA-based cheat implementations.

netvar1337 Bundle

Use for authorized database security assessment covering PostgreSQL/MySQL/MSSQL/Mongo/Redis exposure, authz, UDF/command paths, and misconfiguration review.

netvar1337 Bundle

Virtualization-Based Security research surface: VTL0/VTL1 split, Secure Kernel and Ium syscalls, HVCI kernel code-integrity enforcement, Credential Guard/LSAIso, what each stealth technique survives (DKOM vs code patches), VTL0→VTL1 attack surfaces (hypercalls, VMBus/VMWP, secure-kernel parsers), lab toggling and detection. Use when a target runs VBS/HVCI/Credential Guard or a technique must survive it.

netvar1337 Bundle

Guide for evidence-grounded game-security research, citation verification, uncertainty, reproducible analysis, and detector evaluation. Use when validating technical claims, synthesizing README or wiki resources, comparing security techniques, assessing telemetry or models, or deciding whether evidence supports an anti-cheat conclusion.

netvar1337 Bundle

Guide for Windows kernel internals and security mechanisms used in game protection and low-level research. Use this skill when working with drivers, IRQL-sensitive callbacks, EPROCESS, ETHREAD, MMVAD internals, IOCTL paths, DSE, PatchGuard, HVCI, PiDDBCache, MmUnloadedDrivers, or kernel memory inspection.

netvar1337 Bundle

Use when researching, validating, or reporting a security finding to the Google Bug Hunters Program. Requires current official scope/rules verification before testing or report preparation.

netvar1337 Bundle

Guide for Android and iOS game security, reversing, and anti-cheat-adjacent platform research. Use this skill when working with APK or IPA analysis, IL2CPP mobile titles, Frida, Zygisk or Magisk, jailbreak or root detection bypass, Android kernel modules, emulator detection, or mobile anti-cheat systems.

netvar1337 Bundle

Game exploit classes: memory R/W cheats, packets, authority breaks, race bugs, movement exploits, server RPC abuse.