Skip to content

Marketplace

Everything your AI needs, in one place.

Ready-made agents, skills, personas, prompts, templates and tools. Each one is checked before it goes live, works with any model, and installs in a click. Rate what you use so the best rises to the top.

146.7K
listings
1
installs
0
reviews
40.4K
publishers
127 results
Skill

detecting-privilege-escalation-attempts

Detect privilege escalation attempts including token manipulation, UAC bypass, unquoted service paths, kernel exploits, and sudo/doas abuse across Windows and Linux.

by HenriqueMC17GitHub
Not rated yet
Free
Skill

hunting-for-domain-fronting-c2-traffic

Detect domain fronting C2 traffic by analyzing SNI vs HTTP Host header mismatches in proxy logs and TLS certificate discrepancies using pyOpenSSL for certificate inspection

by gabrielmoreiraGitHub
Not rated yet
Free
Skill

detecting-privilege-escalation-attempts

Detect privilege escalation attempts across Windows and Linux, including access token manipulation, UAC bypass, unquoted service path abuse, kernel exploits, and sudo/doas abuse. Use when threat hunti

by gabrielmoreiraGitHub
Not rated yet
Free
Skill

deploying-osquery-for-endpoint-monitoring

Use when deploys and configures osquery for real-time endpoint monitoring using SQL-based queries to inspect running processes, open ports, installed software, and system configuration. Use when build

by oyi77GitHub
Not rated yet
Free
Skill

hunting-for-living-off-the-land-binaries

Use when proactively hunt for adversary abuse of legitimate system binaries (LOLBins) to execute malicious payloads while evading detection. Use when working with hunting for living off the land binar

by oyi77GitHub
Not rated yet
Free
Skill

sspcs-schdld-tasks

Hunt for adversary persistence and execution via Windows scheduled tasks by analyzing task creation events, suspicious task properties, and unusual execution patterns that indicate T1053.005 abuse.

by UndermybeltGitHub
Not rated yet
Free
Skill

detecting-t1548-abuse-elevation-control-mechanism

Detect abuse of elevation control mechanisms including UAC bypass, sudo exploitation, and setuid/setgid manipulation by monitoring registry modifications, process elevation flags, and unusual parent-c

by WorkNFlowGitHub
Not rated yet
Free
Skill

detecting-t1548-abuse-elevation-control-mechanism

Detect abuse of elevation control mechanisms (T1548), including Windows UAC bypass via auto-elevating binaries like fodhelper.exe and Linux sudo/setuid/setgid exploitation, by monitoring registry chan

by brianmcgillionGitHub
Not rated yet
Free
Skill

hunting-for-living-off-the-land-binaries

Proactively hunts for adversary abuse of legitimate, signed system binaries (LOLBins) used to execute malicious payloads, download files, or proxy execution while evading application allowlisting and

by costrict-plugins-repoGitHub
Not rated yet
Free
Skill

hunting-for-living-off-the-land-binaries

Proactively hunts for adversary abuse of legitimate, signed system binaries (LOLBins) used to execute malicious payloads, download files, or proxy execution while evading application allowlisting and

by RanuK12GitHub
Not rated yet
Free
Skill

hunting-for-living-off-the-land-binaries

Proactively hunts for adversary abuse of legitimate, signed system binaries (LOLBins) used to execute malicious payloads, download files, or proxy execution while evading application allowlisting and

by bfoxhoundGitHub
Not rated yet
Free
Skill

hunting-for-living-off-the-land-binaries

Proactively hunts for adversary abuse of legitimate, signed system binaries (LOLBins) used to execute malicious payloads, download files, or proxy execution while evading application allowlisting and

by thewongdirectionGitHub
Not rated yet
Free
Skill

hunting-for-living-off-the-land-binaries

Proactively hunts for adversary abuse of legitimate, signed system binaries (LOLBins) used to execute malicious payloads, download files, or proxy execution while evading application allowlisting and

by AliffZulhelmiGitHub
Not rated yet
Free
Skill

detecting-t1003-credential-dumping-with-edr

Detect OS credential dumping techniques targeting LSASS memory, SAM database, NTDS.dit, and cached credentials using EDR telemetry, Sysmon process access monitoring, and Windows security event correla

by aniket2348823GitHub
Not rated yet
Free
Skill

detecting-dcsync-attack-in-active-directory

Detect DCSync attacks (MITRE T1003.006) where adversaries abuse Active Directory replication privileges to extract password hashes, by auditing Event ID 4662 for the DS-Replication-Get-Changes GUIDs a

by rivaldiekaptrrrGitHub
Not rated yet
Free
Skill

cyber-detecting-t1003-credential-dumping-with-edr

Detect OS credential dumping techniques targeting LSASS memory, SAM database, NTDS.dit, and cached credentials using EDR telemetry, Sysmon process access monitoring, and Windows security event correla

by ToqsickGitHub
Not rated yet
Free
Skill

detecting-dcsync-attack-in-active-directory

Detect DCSync attacks where adversaries abuse Active Directory replication privileges to extract password hashes by monitoring for non-domain-controller accounts requesting directory replication via D

by andycungkrinx91GitHub
Not rated yet
Free
Skill

hunting-advanced-persistent-threats

Proactively hunts for Advanced Persistent Threat (APT) activity within enterprise environments using hypothesis-driven searches across endpoint telemetry, network logs, and memory artifacts. Use when

by momo0410GitHub
Not rated yet
Free
Skill

detecting-t1003-credential-dumping-with-edr

Detect OS credential dumping techniques targeting LSASS memory, SAM database, NTDS.dit, and cached credentials using EDR telemetry, Sysmon process access monitoring, and Windows security event correla

by peteedooGitHub
Not rated yet
Free
Skill

detecting-t1055-process-injection-with-sysmon

Detect process injection techniques (T1055) including classic DLL injection, process hollowing, and APC injection by analyzing Sysmon events for cross-process memory operations, remote thread creation

by Molly-agiGitHub
Not rated yet
Free
Skill

performing-threat-hunting-with-elastic-siem

Performs proactive threat hunting in Elastic Security SIEM using KQL/EQL queries, detection rules, and Timeline investigation to identify threats that evade automated detection. Use when SOC teams nee

by aibot88GitHub
Not rated yet
Free
Skill

hunting-bootkits-in-efi-system-partition

Baseline the EFI System Partition and hunt malicious EFI binaries (ESPecter, BlackLotus, Bootkitty, Glupteba) by mounting the ESP, hashing and verifying boot loaders, scanning with YARA, and detecting

by aj-omanaiGitHub
Not rated yet
Free
Skill

hunting-bootkits-in-efi-system-partition

Baseline the EFI System Partition and hunt malicious EFI binaries (ESPecter, BlackLotus, Bootkitty, Glupteba) by mounting the ESP, hashing and verifying boot loaders, scanning with YARA, and detecting

by adriannoesGitHub
Not rated yet
Free
Skill

cb-hunting-for-lolbins-execution-in-endpoint-logs

Cold-box analyst playbook — Hunting For Lolbins Execution In Endpoint Logs. Hunt for adversary abuse of Living Off the Land Binaries (LOLBins) by analyzing endpoint process creation logs for suspiciou

by at-srcGitHub
Not rated yet
Free
1

Find

Search or browse by kind. Every card shows who made it, how many people installed it and what they think.

2

Install

One click. You get a manifest the router understands, plus copy-paste snippets for the CLI, Python and YAML.

3

Rate and publish

Leave a star rating after you have used it. Made something useful? Publish it - free listings go live immediately.

Prefer the terminal? osr stack apply registry://starter installs the starter template.