7onez/cti-expert

This toolkit provides a framework for running cyber threat intelligence and open-source intelligence cases. It helps security researchers and forensic investigators move from raw data collection to analyst-grade intelligence products through a structured lifecycle of acquisition, enrichment, assessment, and delivery.

The skill specializes in web-infrastructure pivoting using favicon hashes and TLS certificates, infostealer-log triage, and regional reconnaissance including PRC corporate registries and ICP filings. It automates the recursive pivot loop, treating discovered identifiers as new seeds to expand investigation graphs until the frontier is exhausted.