Post-Exploitation Playbook
RoE-only and lab discipline: post-exploitation is by definition post-foothold, which means the attacker is already through the front door. The RoE must explicitly allow the next steps: which commands, on which systems, within which time window, with which limits on data access and persistence cleanup. Do not run techniques on production without that agreement on file. Specific EDR-bypass recipes, ready-to-run beacons, and version-targeted privilege-escalation
[Description truncada. Veja o README completo no GitHub.]