Simple and safe real-world attack chains that make threat intelligence actionable.

Every week, the Prelude team designs, builds and chains together TTPs. These chains, which mimic real-world cyberattacks, can be safely used to test your internal defenses. These chains are all usable in Prelude Operator. Download for free.
Download Operator (1.7.1)

Recent Chains


Is my host protected against RestrictedAdmin?

2023-01-31

/static/assets/windows-logo.svg
Deploy RestrictedAdmin and disable Restricted Admin mode
Is my host protected against Seatbelt?

2023-01-24

/static/assets/windows-logo.svg
Deploy Seatbelt to enumerate the local system.
Is my host protected against SharpWMI?

2023-01-17

/static/assets/windows-logo.svg
Deploy SharpWMI to enumerate the local system.
Is my host protected against Microsoft Office add-ins?

2023-01-11

/static/assets/windows-logo.svg
Stage and execute malicious Microsoft Office add-in.
Is my host protected against Cuba Ransomware?

2022-12-27

/static/assets/windows-logo.svg
Stage and execute Cuba Ransomware.
Is my host protected against APT37?

2022-12-19

/static/assets/windows-logo.svg
Stage and execute APT37.
Is my host protected against ngrok?

2022-12-13

/static/assets/linux-logo.svg/static/assets/apple-logo.svg/static/assets/windows-logo.svg
Stage and execute ngrok.
Is my host protected against XMRig crypto miner?

2022-12-13

/static/assets/linux-logo.svg/static/assets/apple-logo.svg/static/assets/windows-logo.svg
Stage and execute XMRig crypto miner.
Is this host protected from LockBit?

2022-12-06

/static/assets/windows-logo.svg
Is this host protected from LockBit?