'roas' 검색 결과

Investigate Kerberoasting, an attack that targets service account passwords, using Active Directory authentication logs. Examine unusual service ticket requests, correlate endpoint and network evidence, and organize findings with risk levels and recommended response actions.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Hunting for unusual service ticket requests
• Investigating suspected service account password attacks
• Validating alerts and organizing response evidence

Deploy decoy accounts, service entries, and policy objects in Active Directory to detect suspicious activity. Configure monitoring rules for Windows security events and validate alerts for credential misuse, reconnaissance, and movement between systems.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Detecting Kerberoasting with decoy service entries
• Monitoring attempts to use decoy credentials
• Placing credential traps in decoy Group Policy objects

Summarize WeChat group conversations into organized digests with discussion highlights, verified speaker attribution, and message statistics. Keep group history, participant profiles, and factual notes across runs, or summarize only messages received since the previous digest.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Catching up on a week's WeChat group discussions
• Summarizing messages since the previous digest
• Reviewing message counts and active participants

红队渗透 / 攻防 — 受授权的红队作业者 + 渗透测试工程师 + 攻击型安全顾问的认知操作系统 (侦察 OSINT / 外网渗透 / 内网 AD 渗透 BloodHound + Kerberoasting + ADCS 利用 + 横向移动 / Web 应用渗透 OWASP WSTG / 移动 OWASP MASTG / 云渗透 AWS Azure GCP IAM 路径 + 容器逃逸 + K8s / C2 操作 Cobalt Strike Sliver Mythic Havoc + OPSEC / 初始访问 + AV EDR 绕过 (仅授权场景) / 无线 RF / 物理社工 / 报告与整改 / 框架 MITRE ATT&CK + D3FEND + PTES + OSSTMM + NIST 800-115 + Kill Chain / 法律伦理 CFAA + 网络安全法 + 刑法 285 286 + 数据安全法 + GDPR + 授权书 + 范围 + 交战规则 — 不含 黑产 / 未授权攻击 / 大规模 exploitation / 供应链投毒 / 未授权 DoS — 这是 重罪 + 行业封杀 + 律师吊销, 本 skill 严守 authorized-only 边界 — 也不含 蓝队 SOC + 恶意软件 即服务 / 僵尸网络 / 勒索软件作者 — 这是 cybercrime 不是 红队) (Cybersecurity Red Team / Offensive Security Operations — the cognitive operating system of authorized red team operators, penetration testers, and offensive security consultants covering (a) reconnaissance & OSINT (passive + active discovery, asset surface mapping), (b) external network pentest (perimeter, exposed services, web), (c) internal network / Active Directory pentest (AD enumeration via BloodHound, Kerberos abuse — Kerberoasting / AS-REP-roasting / Unconstrained delegation / S4U2self, NTLM relay, ADCS abuse, GPO abuse, lateral movement, privilege escalation), (d) web application pentest (OWASP WSTG, authentication, authorization, SSRF, XXE, deserialization, SSTI, prototype pollution, GraphQL, JWT, API), (e) mobile pentest (OWASP MASTG, iOS / Android, instrumentation Frida / Objection, MASVS), (f) cloud pentest (AWS / Azure / GCP — IAM enumeration, privilege escalation paths, container escape, K8s RBAC, serverless), (g) C2 operations & post-exploitation (Cobalt Strike / Sliver / Mythic / Havoc, beacon ops, malleable profiles, OPSEC), (h) initial access & evasion (phishing infrastructure, payload development, AV / EDR evasion, BYOVD, AMSI / ETW bypass — strictly for authorized engagements), (i) wireless / RF (WPA2/3, evil twin, Wi-Fi pivots), (j) physical / social engineering (badge cloning, pretexting, vishing — under engagement letter), (k) reporting & remediation (executive summary, technical findings, CVSS, MITRE ATT&CK mapping, retest), (l) frameworks & methodology (MITRE ATT&CK, MITRE D3FEND, PTES, OSSTMM, NIST SP 800-115, OWASP WSTG / MASTG, Cyber Kill Chain, Unified Kill Chain, Diamond Model), (m) law & ethics (CFAA US, Computer Misuse Act UK, 中国 刑法 285/286 + 网络安全法 + 数据安全法, GDPR for tested EU systems, engagement letter, scope, rules of engagement, safe harbor for bug bounty); NOT criminal hacking / 黑产 / unauthorized targeting / mass exploitation / supply-chain compromise / DoS against unconsented systems (这是 重罪 + 业内开除 + 律师执照吊销, 本 skill 严守 authorized-only 边界), NOT pure defensive blue team / SOC analyst tradecraft (是 平行学科, 仅做 边界标注 + ATT&CK 反推方向), NOT malware-as-a-service development / botnet ops / ransomware authoring (是 cybercrime 不是 红队), NOT 'ethical hacking' 在 'just curious 看看' 自我合理化的灰色操作 (违反 authorization 原则即不是 红队).) Master OS — automated mastery of Cybersecurity Red Team / Offensive Security Operations — the cognitive operating system of authorized red team operators, penetration testers, and offensive security consultants covering (a) reconnaissance & OSINT (passive + active discovery, asset surface mapping), (b) external network pentest (perimeter, exposed services, web), (c) internal network / Active Directory pentest (AD enumeration via BloodHound, Kerberos abuse — Kerberoasting / AS-REP-roasting / Unconstrained delegation / S4U2self, NTLM relay, ADCS abuse, GPO abuse, lateral movement, privilege escalation), (d) web application pentest (OWASP WSTG, authentication, authorization, SSRF, XXE, deserialization, SSTI, prototype pollution, GraphQL, JWT, API), (e) mobile pentest (OWASP MASTG, iOS / Android, instrumentation Frida / Objection, MASVS), (f) cloud pentest (AWS / Azure / GCP — IAM enumeration, privilege escalation paths, container escape, K8s RBAC, serverless), (g) C2 operations & post-exploitation (Cobalt Strike / Sliver / Mythic / Havoc, beacon ops, malleable profiles, OPSEC), (h) initial access & evasi

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Brutally honest AGENTS.md/CLAUDE.md review backed by real A/B test evidence. Not just opinions — actual proof that your rules are dead weight. Roasts instruction files for bloat, slop, and redundancy, then proves it by running evals. Use when user says "roast my agents.md", "roast my CLAUDE.md", "prove my rules are useless", "eval roast", or wants entertaining evidence-based feedback on their AI config files. Also triggers on "audit my instructions" or "are my rules helping".

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Hunts for Kerberoasting and related ticket attacks by analyzing Kerberos service ticket request events (4769) for weak encryption types, abnormal request volume per account, and non-machine accounts requesting many SPNs. Activates for requests to hunt Kerberoasting, detect RC4 ticket requests, or find SPN-targeting credential attacks.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Analyze campaign data across advertising platforms, check whether results are comparable, and assess costs and returns. Get budget test proposals with stated evidence, uncertainty, spending limits, and rollback criteria.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Compare Google Ads and Meta Ads performance
• Investigate campaigns with high acquisition costs
• Plan limited tests of budget changes

Assess an authorized Active Directory environment by simulating attacks against credentials, permissions, and trust relationships. Use BloodHound and related testing tools to identify paths to administrator access, evaluate detection capabilities, and document findings with remediation recommendations.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Assessing Active Directory security with written authorization
• Finding paths from ordinary users to administrator access
• Reviewing Kerberos and delegation settings

Plan and improve paid advertising on Google Ads, Meta, LinkedIn, and other platforms. Develop ad copy, audience targeting, and budget plans, then use acquisition costs and advertising returns to guide campaign improvements.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Choose advertising platforms for a goal and budget
• Develop ad copy and creative test ideas
• Review campaigns with high customer acquisition costs

Plan paid advertising across Google Ads, Meta, LinkedIn, and other platforms. Build campaign structures, ad copy, audience plans, and budgets, then use performance metrics and account checks to identify practical improvements.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Plan a first paid advertising campaign
• Create headline, body copy, and call-to-action variants
• Design retargeting audiences and exclusion lists

Analyzes marketing campaign data to compare channel contributions, find drop-offs before purchase, and calculate returns and acquisition costs. Uses five attribution models, which assign credit to customer interactions, with results available as readable summaries or JSON.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Compare channel contributions across attribution models
• Find where prospects drop out before purchase
• Compare campaign returns and acquisition costs

Review daily Google Ads and Meta Ads results for budget pacing, declining performance, and unusual activity. Get prioritized findings with supporting numbers and concrete recommendations for a marketing team to assess and carry out.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Checking whether campaign budgets are being spent on schedule
• Investigating rising acquisition costs or falling ad returns
• Finding ads and keywords that spend without converting

Calculate advertising costs, revenue relative to ad spend, break-even targets, and budget forecasts. The skill makes inputs and formulas explicit, checks inconsistent data, and compares base, downside, and upside scenarios when uncertainty affects the decision.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Calculating advertising acquisition costs and returns
• Setting break-even targets for advertising
• Comparing budget and revenue forecasts across scenarios

Diagnose paid advertising performance using account evidence, financial constraints, and experiments. Draft ranked changes to budgets, bids, or ad delivery, and apply supported operations only after approval and state checks, retaining a way to reverse them.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Reviewing budget allocation and bids
• Planning ad pauses and creative rotation
• Assessing search terms before adding negative keywords

Use when the user asks to "pick a bid strategy", "set a tCPA/tROAS target", or "plan the learning-phase entry"; produces a bid-strategy choice (tCPA / tROAS / max-conversions / manual CPC), the starting target math, a portfolio grouping map, and a learning-phase entry plan. Not for splitting the budget across campaigns — use budget-optimizer; not for in-flight pacing/scale moves — use budget-pacing-monitor; not for scoring the account — use ad-account-auditor. 出价策略/tCPA目标/tROAS/学习期

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Use when the user asks to "read back" a paid campaign change, "did this ad change work", or "compare ROAS/CPA before and after"; reads ROAS/CPA against a control over a fixed readback window and returns a Promote / Keep-testing / Rollback / Unproven readback decision with the math delegated to roi-calculator. Not for RQS scoring or veto adjudication — use ad-account-auditor; not for the ROI ratio math — use roi-calculator; not for cross-channel rollups — use performance-analyzer. 付费广告复盘/ROAS回看/投放效果归因

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Use when marketing numbers look bad and the user needs to know WHY — layered root-cause diagnosis across tracking, delivery, creative, landing page, offer, and audience quality, 5-Whys, regional benchmarks for US, EU, SEA, and LATAM, and a 48-hour action plan. Covers dropshipping ROAS and BE-ROAS. Trigger on 'why is CPA so high', 'my ads are not converting', 'ROAS dropped', 'we are burning budget', 'performance is bad this month', 'diagnose the funnel'. Also use when the user pastes a screenshot of numbers with no question attached. Not for — auditing account configuration and scoring health, see `21-ads-audit-global`; writing a report someone else reads, see `07-marketing-report-global`; turning a raw export into insight, see `13-data-analysis-global`.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Executes authorized attack simulations against Active Directory environments to identify misconfigurations, weak credentials, dangerous privilege paths, and exploitable trust relationships that could lead to domain compromise. The tester uses BloodHound for attack path analysis, Mimikatz for credential extraction, and Impacket for protocol-level attacks including Kerberoasting, AS-REP Roasting, and delegation abuse. Activates for requests involving Active Directory pentest, AD attack simulation, domain compromise testing, or Kerberos attack assessment.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Roast the current repo's design system with real data. Runs a deterministic scanner (no tokens, ~1s) that counts everything that betrays a design system, from colours and their near-identical twins to greys, spacing values, typefaces, duplicated and never-imported components, inline styles, !important and arbitrary Tailwind values, and compares them against Ideal Design System norms, a benchmark of 119 public repos (a 34-repo core fleet plus groups for shadcn, Tailwind, MUI, Mantine, Chakra, Ant Design and web components) and 10 reputable design systems, generates a shareable HTML diagnosis, and can generate design-system-rules.md, the agent rules file that stops the mess regrowing.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Execute a Kerberoasting attack to extract Service Principal Name (SPN) ticket hashes from Active Directory and crack them offline. This allows an attacker with any valid domain credentials to escalate privileges by obtaining the plaintext password of highly-privileged service accounts.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Exploit Active Directory environments using Kerberoasting. This skill details how to identify Service Principal Names (SPNs) associated with user accounts, request their TGS tickets, and crack the RC4 encrypted component offline to recover service account passwords.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Execute AS-REP Roasting to extract and crack the NTLM hashes of Active Directory user accounts that have the "Do not require Kerberos preauthentication" flag explicitly enabled. This attack generates a recoverable Ticket Granting Ticket (TGT) without requiring the attacker to authenticate first.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Exploit Active Directory environments using AS-REP Roasting. This skill details how to identify user accounts with the 'Do not require Kerberos preauthentication' (DONT_REQ_PREAUTH) attribute set, request their AS-REP tickes without a password, and crack the encrypted component offline to recover plaintext credentials.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Execute a Kerberoasting attack to extract and systematically crack the NTLM hashes of Service Principal Name (SPN) accounts in an Active Directory environment. Uses tools like Rubeus, Impacket (GetUserSPNs), and Hashcat to achieve domain privilege escalation domain: cybersecurity

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.