Prelude chain browser

This is a collection of Prelude-designed TTPs that have been chained together. These chains, which mimic real-world cyberattacks, can be safely used to test your internal defenses. These chains are all usable in Prelude Operator. Download for free.

Release Date (Newest)

Filter

Search for chains, TTPs, themes, and text

Browse By:

Platforms

All
Windows
Darwin
Linux
Global
Android

Tactics & Techniques

All
Resource Development
Initial Access
Defense Evasion
Command And Control
Discovery
Collection
Persistence
Credential Access
Privilege Escalation
Lateral Movement
Execution
Exfiltration
Impact

Themes

Licenses

Conti Privilege Escalation and Persistence

2022-01-25

Use PrintNightmare & ZeroLogon exploits to gain privileges and extract the krbtgt NTLM hash from a DC.

Conti Local and Remote Discovery

2022-01-18

Using the Jambi agent from the initial access chain, discover local services, active directory objects, and check the box for PrintNightmare.

Log4j Infrastructure

2022-01-13

Stand up infrastructure to exploit CVE-2021-44228.

Conti Recon And Initial Access

2022-01-10

Perform recon and initial access of target environment

CSwipe

2022-01-04

Deploy a custom payload to achieve ransomware without using traditional encryption.

S(C)wipe

2021-12-28

Deploy a custom payload to achieve ransomware without using traditional encryption.

Windows LotL Ransomware

2021-12-21

Deploy a Windows live-off-the-land ransomware attack.

Linux LotL Ransomware

2021-12-14

Deploy a linux live-off-the-land ransomware attack.

Android ADB Shell

2021-12-07

A first collection of TTPs for Android specifically targeting ADB shell commands

Staging Server (Server-side)

2021-11-30

Deploy capabilities to a staging server and establish a reverse proxy.

Jambi Modules

2021-11-16

Use Powershell functions to create a script implant that dynamically resolves and loads modules at runtime.

eBPF CVE-2021-3490

2021-11-09

Elevate an unprivileged user to root privileges via CVE-2021-3490 (eBPF) exploitation.

Sequoia

2021-10-26

Elevate an unprivileged user to root privileges via CVE-2021-33909 (Sequoia) exploitation.

Vulnerable Certificates

2021-10-19

Ingress, load, and run Certify to find vulnerable certificates.

B1-66ER (Discovery)

2021-10-12

Perform discovery techniques to determine if an agent has access to a ML/DL environment.

JXA Modules

2021-10-05

Use JXA to create a fully modular file-less implant that dynamically resolves and load modules at runtime.

B1-66ER (Initial Access)

2021-09-28

Gain initial access by installing SciPy with concealed Schism agent

Conti (Discovery)

2021-09-21

Perform the initial discovery and credential access techniques used in Conti ransomware playbook.

SharpHound

2021-09-07

Ingress, load, and run the SharpHound collector.

JXA Access

2021-08-24

Use JXA to load a file-less agent into memory and create persistence mechanisms on OS X.

Kaseya VSA Attack

2021-08-16

Side-load an agent using components of the REvil ransomware attack kill chain.

File Hunter

2021-08-10

Automatically discover and prepare files for exfiltration.

Baron Samedit (Persistence)

2021-08-10

Leverage a Heap-Based Buffer Overflow in Sudo to create a persistence user.

Ransomware

2021-08-10

Deploy a safe cross-platform ransomware attack.

Netsh Helper DLL

2021-08-10

Create a Netsh helper DLL persistence.

Baron Samedit (Spawn Agent)

2021-08-10

Leverage a Heap-Based Buffer Overflow in Sudo to spawn an elevated agent.

Printnightmare

2021-08-10

Escalate local privileges and spawn a SYSTEM-level agent by exploiting CVE-2021-34527 (PrintNightmare).

GhostLoader

2021-07-06

Use the "GhostLoader" technique to run assemblies compiled on the target system.

1 2 3

About PreludePrelude hardens an organization's defenses by continuously “asking” it questions through the form of safe cyberattacks. These attacks respond immediately to the latest vulnerabilities and cyber events, turning complex technical descriptions into deployable “questions”.Our mission is to increase the reach, frequency and usage of advanced security for all organizations.

Follow @preludeorg on Twitter for new chains and more.

Join the Prelude Discord to discuss chains and more.

Keep up to date with code changes and community activity on Github

preludesecurity.com Careers Tactics & Techniques Attack themes

Privacy Policy support@preludesecurity.com© 2023 Prelude Research, Inc.All rights reserved. Prelude, its logo and other trademarks are trademarks of Prelude Research, Inc. and may not be used without permission.

Prelude chain browser

Browse By:

Platforms

All

Windows

Darwin

Linux

Global

Android

Tactics & Techniques

All

Resource Development

Initial Access

Defense Evasion

Command And Control

Discovery

Collection

Persistence

Credential Access

Privilege Escalation

Lateral Movement

Execution

Exfiltration

Impact

Themes

Tags

Licenses