Threat Intelligence Bundle

Browse all skill bundles

Included Skills (37)

1. Doca Pcc Ztr Rttcc Algo — DOCA-shipped Zero-Touch RoCE RTT congestion control (ZTR RTTCC) reference algorithm on a BlueField-3 DPA: deploy, tune and evaluate doca_pcc_dev_ztr_rttcc_algo through the shipped DOCA PCC sample. Trigger on "my RoCE-v2 flows aren't being throttled", "PCC sample isn't dispatching to my algo", "set-params returns fail", "algorithm loaded but counters are flat", "how do I pick the multipath PCC variant", or "do I need a custom CC algorithm on BF3", even without naming ZTR RTTCC. Your own algorithm through the host library belongs to doca-pcc; the doca_spcx_cc command line to doca-spcx-cc. Covers picking a variant (vanilla / PM / RX-rate / multipath / window-probeless) at DPACC build time, tuning host-set parameters, and DOCA_PCC_DEV_STATUS_FAIL from the algorithm. Refuse and route elsewhere for writing a custom PCC algorithm from scratch, read-only PCC counter inspection, or firmware-only pre-Programmable PCC.
2. Robius Event Action — CRITICAL: Use for Robius event and action patterns. Triggers on: custom action, MatchEvent, post_action, cx.widget_action, handle_actions, DefaultNone, widget action, event handling, 事件处理, 自定义动作
3. Building Threat Actor Profile From Osint — The skill constructs detailed threat actor profiles by aggregating OSINT from vendor reports, paste sites, dark web forums, social media, and code repositories. It correlates indicators, maps adversary infrastructure with tools such as Maltego and SpiderFoot, and produces structured dossiers outlining motivations, capabilities, infrastructure, and TTPs. Analysts and security teams use it for attribution and building comprehensive adversary dossiers from open‑source intelligence.
4. Malware Intelligence Analyst — Query the Malpedia API to research malware family lineages, extract YARA detection rules, and map threat actor associations for cybersecurity professionals.
5. Engagement IR Detection — Helps red teams detect active security changes during authorized penetration tests.
6. Paste Site Monitor — This tool automates the monitoring of paste sites for leaked credentials and sensitive data to help security teams detect potential breaches early.
7. Continuous Security Validation — Automates Breach and Attack Simulation to help security teams continuously validate control effectiveness and incident response capabilities against real-world MITRE ATT&CK threats.
8. Pentest Checklist — Provide a comprehensive checklist for planning, executing, and following up on penetration tests. Ensure thorough preparation, proper scoping, and effective remediation of discovered vulnerabilities.
9. Subfinder — Discover subdomains of a target domain using passive and active enumeration techniques. Use when tasks involve subdomain enumeration, attack surface mapping, DNS reconnaissance, finding hidden services, identifying forgotten subdomains, or expanding the scope of a security assessment. Subfinder uses passive sources (certificate transparency logs, DNS datasets, search engines) to find subdomains without touching the target directly.
10. Dark Web Monitor — This tool systematically scans hidden services and underground forums to help cybersecurity professionals identify and mitigate potential threats targeting their organization's digital assets.
11. Probabilistic Algorithm Optimizer — This tool assists developers in implementing high-performance, approximate, and math-heavy algorithms for large-scale data processing tasks where classical approaches are insufficient.
12. Agentic Evaluation Framework — This framework provides developers with systematic patterns for implementing self-critique and iterative refinement loops to significantly enhance the quality of AI agent outputs.
13. Red Team — Use when planning or executing authorized red team engagements, attack path analysis, or offensive security simulations. Covers MITRE ATT&CK kill-chain planning, technique scoring, choke point identification, OPSEC risk assessment, and crown jewel targeting.
14. Windows Privilege Escalation — Provide systematic methodologies for discovering and exploiting privilege escalation vulnerabilities on Windows systems during penetration testing engagements.
15. Auditing Entra Id With Aadinternals — Drive the AADInternals PowerShell toolkit to perform Microsoft Entra ID tenant reconnaissance, access-token acquisition across Microsoft APIs, and federation/AD FS backdoor testing (Golden SAML, T1606.002) for defensive validation. Use during an authorized Entra ID/Microsoft 365 red-team assessment to map external attack surface or verify AD FS signing certs resist Golden SAML.
16. Detection Floor Analyzer — Measures a dataset's detection floor to prevent false negatives in trading signal backtests.
17. ZK Proof Verifier — Registers and manages zero-knowledge proof verification keys and constraints for privacy-focused systems.
18. Amass — Amass maps an organization’s external attack surface by discovering subdomains, IP addresses, netblocks, and ASNs through passive sources and active DNS techniques, then stores the results in an asset database. The tool enables security teams to identify forgotten hosts before a penetration test and build a detailed graph of target infrastructure.
19. Exploiting Active Directory Certificate Services Esc1 — Exploit misconfigured Active Directory Certificate Services (AD CS) ESC1
20. Windows Forensic Hunter — This tool utilizes Chainsaw to rapidly analyze Windows event logs and forensic artifacts, enabling cybersecurity analysts to perform efficient threat detection and triage.
21. Implementing Vulnerability Remediation Sla — Design a vulnerability remediation SLA program covering asset tiering,
22. Maltego Transforms — Build custom Maltego transforms in Python with the maltego-transforms SDK, so any API or data source appears as connected nodes in Maltego's link-analysis graph. Use when mapping domains, IPs, emails, persons and organizations, writing OSINT or threat-intelligence transforms, or migrating from the archived maltego-trx and Canari libraries.
23. Cyber Threat Intelligence — This tool enriches threat indicators and profiles threat actors using public OSINT sources to assist security analysts in investigating scams and malicious campaigns.
24. AWS Detective Investigator — This tool helps security analysts investigate AWS incidents by leveraging behavior graphs to trace entity timelines and reconstruct attacker activity across cloud environments.
25. EternalBlue Exploitation Tool — This tool identifies and exploits critical MS17-010 vulnerabilities in legacy Windows SMBv1 systems to assist security professionals during authorized red-team penetration testing engagements.
26. Designing Adversary Engagement With Mitre Engage — Plan, run, and measure an adversary engagement operation using the MITRE Engage framework so that deployed deception is driven by strategy instead of deployed ad hoc. Covers the Engage Matrix (Prepare, Expose, Affect, Elicit, Understand), the 10-Step Operational Process, mapping engagement Activities to the ATT&CK techniques they expose, and defining measurable Goals and Operational Objectives. Use when a team has honeypots, honeytokens, or canary tokens but no coordinating strategy, when leadership asks "should we engage attackers and how", when building a deception/denial program, when writing an adversary engagement operation plan, or when deciding which deception Activities to deploy against a specific threat actor. Keywords: MITRE Engage, adversary engagement, cyber deception strategy, denial and deception, Engage Matrix, EAC, EGO, Expose Affect Elicit, deception program, honeypot strategy, engagement operation.
27. Performing Open Source Intelligence Gathering — Open Source Intelligence (OSINT) gathering is the first active phase
28. Zod Schema Expert — Assists developers in defining Zod schemas for runtime data validation and compile-time TypeScript type inference, streamlining data boundary management.
29. MISP Threat Analyst — This tool queries MISP instances to generate comprehensive threat intelligence reports, helping cybersecurity professionals identify trends, threat actors, and malware families effectively.
30. Atomic Red Team — Automates Atomic Red Team simulations to help security professionals validate detection coverage and test security controls against MITRE ATT&CK techniques.
31. Threat Actor Mapper — This tool maps threat actor TTPs to the MITRE ATT&CK framework, helping cybersecurity analysts visualize defensive coverage and identify security gaps.
32. Performing Red Team With Covenant — Conducts red team operations using the Covenant C2 framework for authorized
33. Threat Modeling Specialist — This expert assists developers and security engineers in identifying vulnerabilities and designing secure-by-design systems through structured threat modeling methodologies and risk assessment.
34. Performing Active Directory Forest Trust Attack — Enumerate and audit Active Directory forest trust relationships using
35. Threejs Animation — Three.js animation - keyframe animation, skeletal animation, morph targets, animation mixing. Use when animating objects, playing GLTF animations, creating procedural motion, or blending animations.
36. Backtesting Framework Architect — This skill assists quantitative developers in building robust, production-grade backtesting systems that minimize common biases and ensure reliable strategy performance validation.
37. Threejs Postprocessing — Three.js post-processing - EffectComposer, bloom, DOF, screen effects. Use when adding visual effects, color grading, blur, glow, or creating custom screen-space shaders.