Simple and safe real-world attack chains that make threat intelligence actionable.

This is a collection of Prelude-designed TTPs that have been chained together. These chains, which mimic real-world cyberattacks, can be safely used to test your internal defenses. These chains are all usable in Prelude Operator. Download for free.
Download Operator (1.7.1)

Recent Chains


Is my host protected against SSP abuse?

2023-02-28

/static/assets/windows-logo.svg
Abusing Windows Security Support Provider (SSP) and Authentication Packages (AP) in the form of DLLs that are injected into the LSASS.exe process on system boot.
Is my host protected against CVE-2019-14287?

2023-02-21

/static/assets/terminal-logo.svg
A TTP that exploits CVE-2019-14287 on Linux and MacOS machines
Is my host protected against Pass-The-ticket?

2023-02-14

/static/assets/windows-logo.svg
Perform the Pass-The-Ticket attack on your domain
Is my host protected against Crackmapexec?

2023-02-07

/static/assets/windows-logo.svg/static/assets/linux-logo.svg/static/assets/apple-logo.svg
Deploy Crackmapexec to dump SAM and LSA and execute system commands
Is my host protected against RestrictedAdmin?

2023-01-31

/static/assets/windows-logo.svg
Deploy RestrictedAdmin and disable Restricted Admin mode
Is my host protected against Seatbelt?

2023-01-24

/static/assets/windows-logo.svg
Deploy Seatbelt to enumerate the local system.
Is my host protected against SharpWMI?

2023-01-17

/static/assets/windows-logo.svg
Deploy SharpWMI to enumerate the local system.
Is my host protected against Microsoft Office add-ins?

2023-01-11

/static/assets/windows-logo.svg
Stage and execute malicious Microsoft Office add-in.
Is my host protected against Cuba Ransomware?

2022-12-27

/static/assets/windows-logo.svg
Stage and execute Cuba Ransomware.