logo
Red tradecraft
Operational procedures for endpoint attacks
  • Privacy greenhouse
  • Defence blues
  • Purple crossroads
  • Indigo observatory
  • Contact
Initializing search
    • An adversary mind map, one of many
    • The grounds
      • A canopy of apple-blossom
      • Where wild boars plough through endpoints
      • Wolverines do not ask for permissions
      • Riches in the ground
      • The device is just the keyring
        • Field notes from the identity layer
        • Operational procedures for endpoint attacks
          • Runbook: Endpoint initial access
          • Runbook: EDR bypass
          • Runbook: Credential and token harvesting
          • Runbook: Pivot from endpoint to cloud
        • Operational procedures for endpoint attacks
          • Runbook: Endpoint initial access
          • Runbook: EDR bypass
          • Runbook: Credential and token harvesting
          • Runbook: Pivot from endpoint to cloud
        • Attack chain playbooks for endpoint operations
      • Poking physics with network packets
      • The gate was already open
    • Ankh-Morpork: the city leaves a footprint
    • Fungolia earthworks
    • Unseen University Power & Light Co.
    • The Scarlet Semaphore
    • TryHackMe rooms
    • Root-Me challenges
    • RIPE NCC Academy labs

    Operational procedures for endpoint attacksΒΆ

    Runbooks:

    • Runbook: Endpoint initial access
    • Runbook: EDR bypass
    • Runbook: Credential and token harvesting
    • Runbook: Pivot from endpoint to cloud
    2026-07-30 17:57
    © Copyright 2025, TyMyrddin.
    Created using Sphinx 7.2.6. and Sphinx-Immaterial

    Made with love by Ty Myrddin, 2026, with a forest garden fostered by /ut7