Skill UI

Creates a strategic SEO plan for new or existing websites, including competitor analysis, keyword and content strategy, site architecture, technical priorities, and a phased implementation roadmap.

Python toolkit that queries the arXiv Atom API to search papers by keywords, authors, categories, or IDs, filter results, download PDFs, and emit structured JSON for AI/ML literature reviews and monitoring.

This skill extracts up to 50 highly relevant, SEO-friendly keywords and tags from any given text. It is designed to identify core topics, domain terminology, and potential search phrases, formatting them into a strict, comma-separated list suitable for metadata generation, tagging, or search engine optimization (SEO). Use it whenever you need to optimize content for search engines.

Perform comprehensive digital forensic analysis on raw (dd), E01, or AFF disk images using industry-standard tools like Autopsy and The Sleuth Kit. This process allows investigators to recover deleted files, examine file system metadata, search for specific keywords, and build detailed investigation timelines. It is essential for generating structured reports from digital evidence in legal and cybersecurity investigations.

A comprehensive cybersecurity tool designed to analyze malicious VBA and XLM macros embedded within Microsoft Office documents (Word, Excel, PowerPoint). It facilitates deep forensic investigation by extracting, deobfuscating, and tracing the full attack chain, including identifying auto-execution triggers, payload download URLs, and file writing techniques. Useful for malware analysts investigating phishing campaigns and maldocs.

A comprehensive toolkit using Splunk's SPL language to analyze Windows Security, System, and Sysmon event logs. It maps advanced detection queries to specific MITRE ATT&CK techniques, enabling SOC analysts to investigate authentication attacks (e.g., brute force, password spraying), detect privilege escalation, locate persistence mechanisms, and trace lateral movement for detailed forensic timeline analysis.

This skill allows users to search, fetch detailed metadata, download, and summarize academic papers from the arXiv repository. It supports searching by keywords or specific arXiv IDs and provides robust arguments for controlling the results count, output directory, and download scope. Ideal for students, researchers, and anyone requiring scholarly literature.

This technique abuses the Microsoft Directory Replication Service Remote Protocol (MS-DRSR) to impersonate a Domain Controller (DC). By exploiting replication rights (e.g., DS-Replication-Get-Changes-All), attackers can dump password hashes for critical accounts, such as KRBTGT and Domain Admins. The extracted hashes are used to forge Golden Tickets, achieving long-term, persistent domain access. This is a critical post-exploitation method used during authorized red team engagements.

This skill simulates Pass-the-Ticket (PtT) attacks, a critical post-exploitation technique. It involves dumping active Kerberos tickets (TGT/TGS) from memory (LSASS) on a compromised host and injecting them into another session. This allows an attacker to impersonate the ticket owner and perform lateral movement or escalate privileges without needing the user's password. Use exclusively for authorized red-teaming and security auditing.

This guide details comprehensive detection methods for DCSync attacks (MITRE T1003.006) in Active Directory. Attackers abuse legitimate directory replication protocols to extract sensitive password hashes. Detection relies on auditing Windows Event ID 4662 for unauthorized access attempts to critical Directory Service GUIDs, specifically flagging non-domain-controller accounts attempting replication calls. Essential for threat hunting and incident response.

A comprehensive guide for detecting Kerberoasting attacks by monitoring for anomalous Kerberos TGS requests (Event ID 4769). This technique targets service accounts with Service Principal Names (SPNs), which are requested offline by attackers to crack service account passwords. Use this during threat hunting or incident response to scope MITRE T1558 credential access activities in Active Directory environments.

This guide details the exploitation of the critical Zerologon vulnerability (CVE-2020-1472) in Active Directory Domain Controllers. It demonstrates the methodology for resetting the DC machine account password to empty, achieving full domain compromise. Subsequent steps include dumping domain credentials using DCSync. Essential for authorized red-teaming and security validation.