Skill UI

This skill leverages Google Gemini's advanced image generation model to create high-quality, context-specific visuals. It is essential for developers needing placeholder images for UIs, generating detailed diagrams for technical documentation, or visualizing abstract concepts, logos, and assets across cross-platform projects (Windows, macOS, Linux).

Automate Logo Dev tasks through Composio’s toolkit using the Rube MCP interface, emphasizing tool discovery, connection validation, schema compliance, and orchestrating executions with multi-tool calls.

Engineers minimalist, scalable vector logos using geometric primitives, negative space, and strict flat-style constraints to translate brand briefs into iconic, professional marks for modern identities.

Magic Animator is an AI-powered skill designed for designers to breathe life into static visuals. It transforms flat logos, UI elements, and icons into engaging, premium motion assets. Use it to create micro-interactions, sophisticated loaders, and memorable brand reveals for web, apps, and social media, ensuring a high "wow" factor and dramatically improving user experience.

This skill guides the advanced configuration of Windows Event Logging using Group Policy Objects (GPO) and advanced audit policies. It enables high-fidelity logging for critical security events, including process creation (Event 4688), logon/logoff activities, and object access. The process covers optimizing log sizes and implementing Windows Event Forwarding (WEF) to centralize data into SIEM platforms for effective threat detection and forensic investigation.

This guide details how to hunt for adversary lateral movement (MITRE ATT&CK TA0008) using Splunk's advanced SPL querying capabilities. It focuses on analyzing Windows authentication logs (e.g., Type 3/10 logons), correlating event IDs (4624, 4648) with process creation data (Sysmon), and identifying unusual source-destination relationships across the network to scope the breadth of a compromise.

A comprehensive guide and workflow for proactively hunting Pass-the-Hash (T1550.002) attacks. This method involves analyzing NTLM authentication patterns, correlating suspicious logon types, and utilizing EDR/SIEM data (Splunk, CrowdStrike) to scope lateral movement during incident response or threat hunting exercises. Essential for validating security detection coverage.

This skill provides a structured method for analyzing Windows Security Event Logs (EVTX) to detect brute force attacks targeting RDP endpoints. It involves parsing failed logon events (Event ID 4625) and correlating them with successful logons (Event ID 4624), while also analyzing source IP frequency and NLA bypass attempts. Ideal for security incident investigation, blue-team threat hunting, and building SIEM detection rules.

This skill provides a framework for proactively detecting service account abuse, which often occurs through anomalous interactive logons, privilege escalation, or lateral movement. It leverages EDR/SIEM telemetry (e.g., CrowdStrike, Splunk) and advanced threat intelligence rules (Sigma) to identify compromised accounts performing unexpected activities. Ideal for incident response, threat hunting, and security posture assessment.

This guide details the exploitation of the critical Zerologon vulnerability (CVE-2020-1472) in Active Directory Domain Controllers. It demonstrates the methodology for resetting the DC machine account password to empty, achieving full domain compromise. Subsequent steps include dumping domain credentials using DCSync. Essential for authorized red-teaming and security validation.

This skill helps detect NTLM relay attacks (T1557.001) by analyzing Windows Security Event ID 4624 (logon type 3) for NTLMSSP usage. It flags critical anomalies such as IP-to-hostname mismatches, evidence of LLMNR/NBT-NS poisoning, rapid cross-domain authentication, and verifies SMB signing status. It is essential for proactive threat hunting and security incident investigation in Active Directory environments.

This skill guides proactive security auditing and threat hunting for registry-based persistence artifacts (MITRE T1547) in Windows environments. It focuses on identifying mechanisms such as Run/RunOnce keys, Winlogon modifications, IFEO debugger injection, and COM hijacking to detect malware autostart techniques and scope compromises during incident response.