Plugins

12 plugins

Run Competitive Analysis

Run a competitive analysis by researching competitors, analyzing their strategies, and producing actionable insights.

6 skills · plugin

Create Go-to-Market Strategy

Create a GTM strategy by analyzing market, defining positioning, and planning launch activities.

3 skills · plugin

Customer Discovery to Persona

Plan and conduct customer discovery interviews, summarize findings, and synthesize into actionable user personas.

5 skills · plugin

Customer Insight to Positioning

From persona research to positioning workshop, this pack delivers actionable customer insights and positioning.

4 skills · plugin

@fivebucksventures

Multi-brand business operations agent — marketing, sales, customer success, finance, strategy, productivity for any active brand

38 skills · plugin

Agent Interview and Planning

For developers who want to clarify project requirements through structured interviews and generate actionable plans.

9 skills · plugin

Secure Google Cloud Workload

Assesses security requirements, identifies risks, and provides actionable recommendations for IAM, network, and data protection.

4 skills · plugin

Robotik-Recht Deutschland/EU: Maschinenverordnung, KI-VO, Produkthaftung, ProdSG, Datenschutz, CRA, Data Act, CE, Marktüberwachung, Unfälle, Rückruf, Verträge und Robotik-Testakte.

2 skills · plugin

User Persona from Research

Install this pack to create detailed, actionable user personas from research data with jobs-to-be-done and behavioral insights.

5 skills · plugin

AI Disruption Assessment

Install this pack to analyze AI disruption pressure across a business, map competitive exposure, and produce a 90-day defensive action plan.

5 skills · plugin

Simulator.Company platform assistant. Exposes the Simulator REST API as an MCP server and provides skills for managing actors, forms, graph structures, and financial accounts.

19 skills · plugin

@alirezarezvani

Compliance OS — meta-orchestrator for multi-framework compliance programs spanning 9 frameworks (ISO 27001, ISO 13485, ISO 42001, ISO 14971, EU AI Act, MDR 745, GDPR, SOC 2, FDA QSR). Framework selector, cross-framework control mapper, audit simulator, and consolidated evidence-pool generator (stdlib Python), plus 3 cs-* compliance agents and 3 /cs:* readiness commands.

9 skills · plugin

Results for “act”

66 skills

Deploying Decoy Files For Ransomware Detection

Deploys canary files (honeytokens) across file systems to detect ransomware encryption activity in real time using file integrity monitoring or OS-level watchdogs.

24.6k · bundle

Orchestrates multi-stage attack-path planning and execution across reconnaissance, initial access, privilege escalation, lateral movement, and impact assessment for authorized penetration testing.

12.8k · bundle

Analyzing Network Traffic For Incidents

Analyzes network traffic captures and flow data to identify adversary activity during security incidents, including command-and-control communications, lateral movement, data exfiltration, and exploitation attempts.

24.6k · bundle

Performing Malware Ioc Extraction

Analyze malicious software to extract actionable indicators of compromise including file hashes, network indicators, registry modifications, and embedded strings, formatted as STIX 2.1 indicators.

24.6k · bundle

Analyzing Campaign Attribution Evidence

Systematically evaluates evidence to determine which threat actor is responsible for a cyber operation using the Diamond Model and Analysis of Competing Hypotheses.

24.6k · bundle

Performing Deception Technology Deployment

Deploys deception technology including honeypots, honeytokens, and decoy systems to detect attackers who have bypassed perimeter defenses, providing high-fidelity alerts with near-zero false positive rates.

24.6k · bundle

Monitoring Darkweb Sources

Monitors dark web forums, marketplaces, paste sites, and ransomware leak sites for mentions of organizational assets, leaked credentials, threatened attacks, and threat actor communications to provide early warning intelligence.

24.6k · bundle

Performing Linux Log Forensics Investigation

Analyze Linux system logs including auth.log, syslog, systemd journal, and auditd to reconstruct user activity, detect unauthorized access, and establish event timelines on compromised systems.

24.6k · bundle

Detecting Port Scanning With Fail2ban

Configures Fail2ban with custom filters and actions to detect port scanning, SSH brute force, and network reconnaissance, automatically banning offending IPs and alerting security teams.

24.6k · bundle

Analyzing Slack Space And File System Artifacts

Examine file system slack space, MFT entries, USN journal, and alternate data streams to recover hidden data and reconstruct file activity on NTFS volumes.

24.6k · bundle

Detecting Rootkit Activity

Detects rootkit presence on compromised systems by identifying hidden processes, hooked system calls, modified kernel structures, hidden files, and covert network connections using memory forensics, cross-view detection, and integrity checking techniques.

24.6k · bundle

Hunting For T1098 Account Manipulation

Detect MITRE ATT&CK T1098 account manipulation techniques including shadow admin creation, SID history injection, group membership changes, and credential modifications using Windows Security Event Logs.

24.6k · bundle

Conducting Post Incident Lessons Learned

Facilitate structured post-incident reviews to identify root causes, document what worked and failed, and produce actionable recommendations to improve future incident response.

24.6k · bundle

Building Incident Response Dashboard

Builds real-time incident response dashboards in Splunk, Elastic, or Grafana to provide SOC analysts and leadership with situational awareness during active incidents, tracking affected systems, containment status, IOC spread, and response timeline.

24.6k · bundle

Investigating Phishing Email Incident

Investigate phishing email incidents from initial user report through header analysis, URL/attachment detonation, impacted user identification, and containment actions using SOC tools like Splunk, Microsoft Defender, and sandbox analysis platforms.

24.6k · bundle

Implementing Endpoint Detection With Wazuh

Deploy and configure Wazuh SIEM/XDR for endpoint detection including agent management, custom decoder and rule XML creation, alert querying via the Wazuh REST API, and automated response actions.

24.6k · bundle

Detecting Golden Ticket Forgery

Detect Kerberos Golden Ticket forgery by analyzing Windows Event ID 4769 for RC4 encryption downgrades, abnormal ticket lifetimes, and krbtgt account anomalies in Splunk and Elastic SIEM.

24.6k · bundle

Detecting AWS Cloudtrail Anomalies

Query AWS CloudTrail events with boto3, build statistical baselines of normal API activity, and detect anomalies such as unusual event sources, geographic anomalies, high-frequency API calls, and first-time API usage patterns.

24.6k · bundle

Building Ransomware Playbook With Cisa Framework

Builds a structured ransomware incident response playbook aligned with the CISA StopRansomware Guide and NIST Cybersecurity Framework, covering preparation, detection, containment, eradication, recovery, and post-incident phases with actionable checklists.

24.6k · bundle

Analyzing Lnk File And Jump List Artifacts

Analyze Windows LNK shortcut files and Jump List artifacts to establish evidence of file access, program execution, and user activity using LECmd, JLECmd, and manual binary parsing.

24.6k · bundle

Analyzing Apt Group With Mitre Navigator

Query MITRE ATT&CK data programmatically, map APT group TTPs to Navigator layers, create multi-layer overlays for gap analysis, and generate actionable intelligence reports for detection engineering teams.

24.6k · bundle

Detecting Compromised Cloud Credentials

Detect compromised cloud credentials across AWS, Azure, and GCP by analyzing anomalous API activity, impossible travel patterns, unauthorized resource provisioning, and credential abuse indicators using GuardDuty, Defender for Identity, and SCC Event Threat Detection.

24.6k · bundle

Designing Adversary Engagement With Mitre Engage

Plan, run, and measure adversary engagement operations using the MITRE Engage framework, covering the Engage Matrix, 10-Step Operational Process, and mapping Activities to ATT&CK techniques.

24.6k · bundle

Recovering From Ransomware Attack

Executes structured recovery from a ransomware incident following NIST and CISA frameworks, including environment isolation, forensic evidence preservation, clean infrastructure rebuild, prioritized system restoration from verified backups, credential reset, and validation against re-infection.

24.6k · bundle

Analyzing Windows Shellbag Artifacts

Analyze Windows Shellbag registry artifacts to reconstruct folder browsing activity, detect access to removable media and network shares, and establish user interaction with directories even after deletion using SBECmd and ShellBags Explorer.

24.6k · bundle

Detecting Insider Data Exfiltration Via Dlp

Detects insider data exfiltration by analyzing DLP policy violations, file access patterns, upload volume anomalies, and off-hours activity in endpoint and cloud logs using pandas for behavioral analytics and statistical baselines.

24.6k · bundle

Detecting Ntlm Relay With Event Correlation

Detect NTLM relay attacks through Windows Security Event correlation by analyzing Event 4624 LogonType 3 for IP-to-hostname mismatches, identifying Responder/LLMNR poisoning artifacts, and auditing SMB and LDAP signing enforcement.

24.6k · bundle

Hunting For Data Staging Before Exfiltration

Detect data staging activity before exfiltration by monitoring for archive creation with 7-Zip/RAR, unusual temp folder access, large file consolidation, and staging directory patterns via EDR and process telemetry.

24.6k · bundle

Implementing Diamond Model Analysis

Provides a structured framework for analyzing cyber intrusions by examining four core features: Adversary, Capability, Infrastructure, and Victim. Covers implementing the Diamond Model programmatically to classify and correlate intrusion events, build activity threads, and generate pivot-ready intelligence.

24.6k · bundle

Hunting For Anomalous Powershell Execution

Hunt for malicious PowerShell activity by analyzing Script Block Logging (Event 4104), Module Logging (Event 4103), and process creation events from Windows Event Log EVTX files to detect obfuscated commands, AMSI bypass attempts, encoded payloads, credential dumping keywords, and suspicious download cradles.

24.6k · bundle