Marketplace
Everything your AI needs, in one place.
Ready-made agents, skills, personas, prompts, templates and tools. Each one is checked before it goes live, works with any model, and installs in a click. Rate what you use so the best rises to the top.
- 146.7K
- listings
- 1
- installs
- 0
- reviews
- 40.4K
- publishers
A service that does a whole job for you - research, coding, support - and reports back.
Step-by-step instructions an AI follows for one kind of task. Install once, reuse everywhere.
A voice and set of rules layered onto any model: tone, audience, do's and don'ts.
A ready-to-use prompt with fill-in-the-blank variables and notes on when it works best.
A complete routing setup - models, rules and settings - in one file you can apply in a minute.
A single function an AI can call: a calculator, a search, a database lookup.
A language model endpoint with its price, speed and quality declared so the router can compare it.
abusing-dpapi-for-credential-access
Extract and decrypt Windows DPAPI-protected secrets (Credential Manager, browser logins/cookies, Wi-Fi credentials, KeePass keys) online or offline using SharpDPAPI, SharpChrome, Mimikatz, or Impacket
detecting-kerberoasting-attacks
Detect Kerberoasting attacks by monitoring for anomalous Kerberos TGS requests (Event ID 4769) targeting service accounts with SPNs, which attackers request offline to crack service account passwords.
detecting-pass-the-hash-attacks
Detect Pass-the-Hash (T1550.002) attacks by analyzing NTLM authentication patterns, flagging Type 3 logons using NTLM where Kerberos would be expected, and correlating with credential-dumping indicato
exploiting-kerberoasting-with-impacket
Performs Kerberoasting (MITRE ATT&CK T1558.003) using Impacket's GetUserSPNs.py to request Kerberos TGS tickets for SPN-registered service accounts, then cracks the extracted RC4/AES-encrypted hashes
hunting-for-dcsync-attacks
Detect DCSync attacks (MITRE ATT&CK T1003.006) by analyzing Windows Event ID 4662 (AccessMask 0x100) for DS-Replication-Get-Changes and DS-Replication-Get-Changes-All requests issued by non-domain-con
hunting-for-ntlm-relay-attacks
Detects NTLM relay attacks (MITRE T1557.001) by analyzing Windows Event ID 4624 logon type 3 with NTLMSSP authentication, flagging IP-to-hostname mismatches, Responder/LLMNR poisoning signatures, SMB
moving-laterally-with-netexec
Use NetExec (nxc) to validate credentials, enumerate SMB shares/users/policy, password-spray safely across lockout thresholds, execute commands, and dump SAM/LSA/NTDS credentials across SMB, WinRM, LD
performing-credential-access-with-lazagne
Extract stored credentials from compromised endpoints using the LaZagne post-exploitation tool to recover passwords from browsers, databases, system vaults, and applications during authorized red team
performing-kerberoasting-attack
Perform Kerberoasting, a post-exploitation technique that enumerates Active Directory service accounts with Service Principal Names (SPNs), requests their Kerberos TGS tickets, and cracks the NTLM-enc
hunting-credential-dumping-activity
Hunts for credential dumping by detecting LSASS process access with suspicious access masks, known dumping tool signatures, and comsvcs.exe MiniDump abuse in Sysmon Event ID 10 and process-creation te
T1003.005_cached-domain-credentials
Adversaries may attempt to access cached domain credentials used to allow authentication to occur in the event a domain controller is unavailable.
Find
Search or browse by kind. Every card shows who made it, how many people installed it and what they think.
Install
One click. You get a manifest the router understands, plus copy-paste snippets for the CLI, Python and YAML.
Rate and publish
Leave a star rating after you have used it. Made something useful? Publish it - free listings go live immediately.
Prefer the terminal? osr stack apply registry://starter installs the starter template.