Plugins
9 plugins@atc-net
Common
Common base skills including documentation generators, implementation planning, and utility tools
7 skills · plugin
curated
Experimentation Pipeline
From hypothesis to impact reporting, this pack enables rigorous experimentation and evidence-based decisions.
4 skills · plugin
@dataroaring
Dataroaring Skills
A writing coach for technical articles based on 'Writing for Developers' by Piotr Sarna & Cynthia Dunlop
3 skills · plugin
curated
User Segmentation Analysis
Install this pack to analyze diverse user feedback and identify at least 3 distinct behavioral and needs-based user segments.
4 skills · plugin
curated
Build Gemini Live API App
Build real-time, bidirectional streaming applications with the Gemini Live API, covering WebSocket-based audio/video/text streaming and function calling.
4 skills · plugin
@trailofbits
Building Secure Contracts
Comprehensive smart contract security toolkit based on Trail of Bits' Building Secure Contracts framework. Includes vulnerability scanners for 6 blockchains and 5 development guideline assistants.
11 skills · plugin
@minimax-ai
Pptx Plugin
PowerPoint generation and editing plugin with text-only QA (no vision required). Uses subagents for cover, TOC, content, section dividers, summary slides, and template-based PPT editing workflows.
5 skills · plugin
@samyakjhaveri
Sam Superpowers
Fork of obra/superpowers 5.0.7: the 14 core skills (TDD, debugging, collaboration patterns) with the mandatory-gate SessionStart injection replaced by a short judgment-based router. Skills are tools, not gates.
14 skills · plugin
@alirezarezvani
Agenthub
Multi-agent collaboration — spawn N parallel subagents that compete on code optimization, content drafts, research approaches, or any task that benefits from diverse solutions. 7 slash commands (/hub:init, /hub:spawn, /hub:status, /hub:eval, /hub:merge, /hub:board, /hub:run), agent templates, DAG-based orchestration, LLM judge mode, message board coordination.
8 skills · plugin
Results for “base”
38 skills
mukul975 Performing User Behavior Analytics
Detect anomalous user activities including impossible travel, unusual access patterns, privilege abuse, and insider threats using SIEM-based behavioral baselines and statistical analysis.
24.6k · bundle
mukul975 Implementing Ransomware Kill Switch Detection
Detects and exploits ransomware kill switch mechanisms including mutex-based execution guards, domain-based kill switches, and registry-based termination checks. Implements proactive mutex vaccination and kill switch domain monitoring to prevent ransomware from executing.
24.6k · bundle
mukul975 Implementing Alert Fatigue Reduction
Reduces SOC alert fatigue by tuning detection rules, consolidating duplicate alerts, implementing risk-based alerting, and measuring alert quality metrics to maintain analyst effectiveness.
24.6k · bundle
mukul975 Implementing Deception Based Detection With Canarytoken
Deploy and monitor Canary Tokens via the Thinkst Canary API for deception-based breach detection using web bug tokens, DNS tokens, document tokens, and AWS key tokens.
24.6k · bundle
mukul975 Hunting For Dns Based Persistence
Hunt for DNS-based persistence mechanisms including DNS hijacking, dangling CNAME records, wildcard DNS abuse, and unauthorized zone modifications using passive DNS databases, SecurityTrails API, and DNS audit log analysis.
24.6k · bundle
mukul975 Analyzing Powershell Empire Artifacts
Detect PowerShell Empire framework artifacts in Windows event logs by identifying Base64 encoded launcher patterns, default user agents, staging URL structures, stager IOCs, and known Empire module signatures in Script Block Logging events.
24.6k · bundle
More results
mukul975 Analyzing Browser Forensics With Hindsight
Extract and analyze Chromium-based browser artifacts using Hindsight to reconstruct user web activity for forensic investigations.
24.6k · bundle
mukul975 Generating Forensic Timelines With Hayabusa
Generate Sigma-based forensic timelines from Windows EVTX files using Hayabusa for incident response triage.
24.6k · bundle
mukul975 Implementing Vulnerability Sla Breach Alerting
Build automated alerting for vulnerability remediation SLA breaches with severity-based timelines, escalation workflows, and compliance reporting dashboards.
24.6k · bundle
mukul975 Hunting For Registry Persistence Mechanisms
Hunt for registry-based persistence mechanisms including Run keys, Winlogon modifications, IFEO injection, and COM hijacking in Windows environments.
24.6k · bundle
mukul975 Performing Soc Tabletop Exercise
Facilitates discussion-based tabletop exercises for SOC teams to test incident response procedures, communication workflows, and decision-making under pressure without impacting production systems.
24.6k · bundle
mukul975 Recovering Deleted Files With Photorec
Recover deleted files from disk images and storage media using PhotoRec's file signature-based carving engine, regardless of file system damage.
24.6k · bundle
mukul975 Analyzing Linux Audit Logs For Intrusion
Detect intrusion attempts, unauthorized access, and privilege escalation on Linux hosts using the auditd framework with ausearch and aureport utilities.
24.6k · bundle
mukul975 Implementing Runtime Security With Tetragon
Implement eBPF-based runtime security observability and enforcement in Kubernetes clusters using Cilium Tetragon for kernel-level threat detection and policy enforcement.
24.6k · bundle
mukul975 Building Malware Incident Communication Template
Build structured communication templates for malware incidents including stakeholder notifications, executive briefings, technical advisories, and regulatory disclosures with severity-based escalation procedures.
24.6k · bundle
mukul975 Detecting Insider Threat With Ueba
Detect insider threats by modeling normal user and entity behavior with Elasticsearch, computing anomaly scores, and correlating low-confidence indicators into high-confidence alerts.
24.6k · bundle
mukul975 Validating Tpm Measured Boot Attestation
Verify TPM measured boot integrity and remote attestation using tpm2-tools, including PCR reading, event log replay, quote generation and verification, and golden baseline comparison.
24.6k · bundle
mukul975 Detecting Exfiltration Over Dns With Zeek
Analyze Zeek dns.log files to detect DNS-based data exfiltration by computing Shannon entropy, flagging long subdomain labels, and identifying anomalous query patterns.
24.6k · bundle
mukul975 Analyzing Dns Logs For Exfiltration
Detects DNS-based data exfiltration, tunneling, and DGA communication by analyzing query logs with entropy analysis, volume anomalies, and subdomain length detection in SIEM platforms.
24.6k · bundle
mukul975 Hunting Evtx With Chainsaw
Hunt for threats in Windows Event Logs using Chainsaw, a fast Rust-based forensic tool that runs Sigma rules, keyword searches, and artifact analysis offline.
24.6k · bundle
mukul975 Conducting Cloud Incident Response
Responds to security incidents in cloud environments (AWS, Azure, GCP) by performing identity-based containment, cloud-native log analysis, resource isolation, and forensic evidence acquisition adapted for ephemeral cloud infrastructure.
24.6k · bundle
mukul975 Performing Entitlement Review With Sailpoint Iiq
Runs entitlement review and access certification campaigns using SailPoint IdentityIQ, including manager certifications, targeted entitlement reviews, role-based access validation, SOD violation remediation, and automated revocation workflows.
24.6k · bundle
mukul975 Analyzing Powershell Script Block Logging
Parse Windows PowerShell Script Block Logs (Event ID 4104) from EVTX files to detect obfuscated commands, encoded payloads, and living-off-the-land techniques.
24.6k · bundle
mukul975 Deploying Active Directory Honeytokens
Deploys deception-based honeytokens in Active Directory, including fake privileged accounts, SPNs for Kerberoasting detection, decoy GPOs with cpassword traps, and deceptive BloodHound paths, with monitoring for Windows Security Event IDs.
24.6k · bundle
mukul975 Detecting Business Email Compromise With AI
Deploy AI and NLP-powered detection systems to identify business email compromise attacks by analyzing writing style, behavioral patterns, and contextual anomalies that evade traditional rule-based filters.
24.6k · bundle
mukul975 Triaging Security Incident
Triages security incidents by classifying type, assigning severity based on business impact, enriching with threat intelligence, and routing to appropriate response teams using NIST SP 800-61r3 and SANS PICERL frameworks.
24.6k · bundle
mukul975 Detecting AWS Cloudtrail Anomalies
Query AWS CloudTrail events with boto3, build statistical baselines of normal API activity, and detect anomalies such as unusual event sources, geographic anomalies, high-frequency API calls, and first-time API usage patterns.
24.6k · bundle
mukul975 Detecting Anomalous Authentication Patterns
Detects anomalous authentication patterns using UEBA analytics, statistical baselines, and machine learning to identify impossible travel, credential stuffing, brute force, password spraying, and compromised account behaviors across authentication logs.
24.6k · bundle
mukul975 Performing Cloud Storage Forensic Acquisition
Perform forensic acquisition and analysis of cloud storage services including Google Drive, OneDrive, Dropbox, and Box by collecting both API-based remote data and local sync client artifacts from endpoint devices.
24.6k · bundle
mukul975 Hunting For Dcom Lateral Movement
Detect DCOM-based lateral movement by correlating Sysmon process creation and network connection events, WMI event analysis, and RPC endpoint mapper traffic to identify abuse of MMC20.Application, ShellBrowserWindow, and ShellWindows COM objects.
24.6k · bundle
mukul975 Building Vulnerability Scanning Workflow
Establishes recurring vulnerability scanning workflows using Nessus, Qualys, or OpenVAS, prioritizes findings with risk scoring and CISA KEV data, integrates with SIEM for exploitation detection, and tracks remediation via SLA-based dashboards and automated ticketing.
24.6k · bundle
mukul975 Hunting Bootkits In Efi System Partition
Baseline the EFI System Partition and hunt malicious EFI binaries (ESPecter, BlackLotus, Bootkitty, Glupteba) by mounting the ESP, hashing and verifying boot loaders, scanning with YARA, and detecting anomalous non-EFI files.
24.6k · bundle
mukul975 Hunting For Lateral Movement Via Wmi
Detect WMI-based lateral movement by analyzing Windows Event ID 4688 process creation and Sysmon Event ID 1 for WmiPrvSE.exe child process patterns, remote process execution, and WMI event subscription persistence.
24.6k · bundle
mukul975 Detecting Insider Data Exfiltration Via Dlp
Detects insider data exfiltration by analyzing DLP policy violations, file access patterns, upload volume anomalies, and off-hours activity in endpoint and cloud logs using pandas for behavioral analytics and statistical baselines.
24.6k · bundle
mukul975 Detecting Fileless Attacks On Endpoints
Detects fileless malware and in-memory attacks that execute entirely in RAM without writing persistent files to disk, evading traditional antivirus. Provides detection rules for PowerShell-based attacks, reflective DLL injection, WMI persistence, and registry-resident malware.
24.6k · bundle
mukul975 Performing Lateral Movement Detection
Detects lateral movement techniques including Pass-the-Hash, PsExec, WMI execution, RDP pivoting, and SMB-based spreading using SIEM correlation of Windows event logs, network flow data, and endpoint telemetry mapped to MITRE ATT&CK Lateral Movement (TA0008) techniques.
24.6k · bundle