Tactics & Techniques
Resource Development
Initial Access
Defense Evasion
- Query Registry
- Obfuscated Files or Information
- Process Injection
- Indicator Removal on Host
- Modify Registry
- Deobfuscate/Decode Files or Information
- Signed Binary Proxy Execution
- File and Directory Permissions Modification
- Abuse Elevation Control Mechanism
- Subvert Trust Controls
- Impair Defenses
- Hijack Execution Flow
Command And Control
Discovery
- System Service Discovery
- Query Registry
- System Network Configuration Discovery
- Remote System Discovery
- System Owner/User Discovery
- Network Service Scanning
- Windows Management Instrumentation
- System Network Connections Discovery
- Process Discovery
- Permission Groups Discovery
- Data Staged
- System Information Discovery
- File and Directory Discovery
- Account Discovery
- Modify Registry
- Network Share Discovery
- Domain Trust Discovery
- Software Discovery
- Impair Defenses
- Cloud Infrastructure Discovery
- Container and Resource Discovery
- System Location Discovery
Collection
Persistence
Credential Access
Privilege Escalation
Lateral Movement
Execution
Exfiltration
Follow @preludeorg on Twitter for new chains and more.
Join the Prelude Discord to discuss chains and more.
Keep up to date with code changes and community activity on Github