Techniques the range actually performs

Every technique below is executed by a Forge scenario against a machine you can open — not a reading list.

By the end you can

Recognize the techniques the range runs, by identifier.
Say what each leaves behind on the machine.
Find the artifact of a technique without being told where to look.

What each step leaves behind

A technique is only useful to a defender through its residue: a registry value, a unit file, a process ancestry, a burst of DNS queries. Learn the residue and the identifier follows.

Technique	What the range does
T0814	Inhibit response function · Denial of service (ICS) — The controller stops answering the HMI poll and the alarm queue fills.
T0822	Initial access · External remote services (ICS) — The vendor account signs into the jump host in the plant DMZ.
T0831	Impair process control · Manipulation of control (ICS) — A setpoint is written to the line 3 controller from an unexpected client.
T0842	Discovery · Network sniffing (ICS) — The engineering workstation's interface goes promiscuous on the cell network.
T0865	Initial access · Spearphishing attachment (ICS) — The vendor pretext gets the remote-support account enabled.
T1003.001	Credential access · LSASS memory — Credentials are lifted from memory on the first host.
T1005	Collection · Data from local system — Build secrets and deployment keys are gathered from the runner.
T1018	Discovery · Remote system discovery — The session sweeps for anything answering on 3389 and 445.
T1021.001	Lateral movement · Remote desktop protocol — The session hops to a second host over RDP while you build the playbook.
T1021.002	Lateral movement · SMB/Windows admin shares — The cracked service account opens admin shares on a second host.
T1027	Defense evasion · Obfuscated files or information — The payload is base64 in a registry value rather than a file on disk.
T1039	Collection · Data from network shared drive — A finance folder that should have been restricted is copied wholesale.
T1041	Exfiltration · Exfiltration over C2 channel — Finance documents leave in chunks over the same channel.
T1046	Discovery · Network service discovery — The authorized tester sweeps the in-scope subnet during the window.
T1048	Exfiltration · Exfiltration over alternative protocol — Files start leaving over an outbound channel the firewall still allows.
T1053.005	Persistence · Scheduled task — A task named after a real update job re-runs the loader hourly.

Reading residue

Ask three questions of any suspicious artifact: what created it, what does it run, and what runs it next time the machine starts. On Windows those answers live in the event log, the registry and the task library; on Linux in the journal, the unit files and the user crontabs.

Check yourself

The fastest way to tell whether something survives a reboot is to check…

Hunt the persistence