PRISMEX is a SpecterInsight threat emulation Workflow that recreates the attack chain associated with Pawn Storm (APT28). Across 11 phases and 33 cells, it progresses from spear-phishing and initial access through persistence, privilege escalation, credential harvesting, lateral movement, and destructive actions.
This post walks through the complete Workflow, showing how documented APT28 behaviors and indicators are translated into a repeatable adversary emulation for validating detection and response coverage.
§2: Phase Walkthrough
Phase-by-Phase Execution
The Workflow opens with a single configuration cell. The operator sets a build name (PrismexNotebook), callback URL, SMTP credentials for phishing delivery, and a lateral movement target. Three lure themes are pre-defined: Hydro-meteorological Warning, Military Training Invitation, and Weapon Smuggling Alert, matching the social engineering themes from the actual campaign.
This is the only time the operator touches campaign parameters. Every downstream script cell reads from these variables. The same Workflow runs against a different environment by changing six values.
Specter-BuildsCreate provisions an implant build and Specter-ListenersCreate stands up an HTTPS listener. Both are idempotent: if infrastructure already exists under the same build name, the cells return the existing resource. TLS certificate provisioning runs via Specter-CertificatesCreate before the listener starts.
The generic_zip_encrypted pipeline wraps a ps_word_document payload inside a password-protected ZIP archive. The Word document contains an AutoOpen VBA macro that cradles a two-stage PowerShell payload: a download-execute stub fetches the obfuscated stage-2 loader, which suppresses AMSI and loads the implant binary into memory via Assembly.Load. Nothing touches disk beyond the lure document itself.
The document is generated by New-TrojanizedDocument, which injects the VBA payload into a legitimate source document without altering visible content.
MITRE: T1204.002 · T1059.001 Pipelines: ps_word_document · generic_zip_encrypted
Send-PhishingEmail delivers the ZIP archive as an attachment using the SMTP credentials from Phase 0. Find-SmtpSettings pre-validates the sender configuration before the campaign begins. The ZIP password is included in the email body: defeating email scanners that cannot process encrypted archives while giving the impression of a security-protected file.
MITRE: T1566.001
The Workflow waits for an implant callback with Specter-SessionsWait (up to ten minutes). Once the session appears, it immediately runs the Display Decoy Document script: opening a legitimate-looking document as a decoy while the implant runs in the background.
MITRE: T1204.002 · T1059.001
Establish COM DLL Hijack Persistence drops a DLL to C:\Users\Public\adwapi64.dll and registers it under HKCU\...\{EAB22AC3-30C1-11CF-A7EB-0000C05BAE0B}\InProcServer32. That CLSID is Shell.Explorer.1: the exact CLSID observed in real PrismexDrop samples. HKCU registrations take precedence over HKLM, loading the attacker DLL without elevation.
IOC Fidelity
The exact CLSID, DLL path naming convention, and registry location from PRISMEX campaign documentation: not a generic COM hijack placeholder.
MITRE: T1546.015 IOCs: {EAB22AC3-30C1-11CF-A7EB-0000C05BAE0B} · adwapi64.dll
Create OneDriveHealth Scheduled Task stores the PowerShell cradle in user environment variable OneDriveHealthCache. A task named OneDriveHealth fires one minute after every user logon, expanding and executing the cradle. The task name blends with legitimate OneDrive monitoring traffic.
MITRE: T1053.005 IOCs: OneDriveHealth · OneDriveHealthCache
Office applications run as 32-bit processes under WoW64. Run 64-bit PowerShell Payload invokes the cradle via %SystemRoot%\Sysnative\WindowsPowerShell\v1.0\powershell.exe: accessible to 32-bit processes through the Sysnative redirect. All subsequent phases operate in the 64-bit context.
MITRE: T1059.001
PrismexLoader’s defining behavior is migration into explorer.exe. The Workflow resolves the Explorer PID, then runs Migrate Process with the Classic technique. Explorer runs for the full desktop session lifetime, as the logged-in user, and is rarely terminated by defenders or AV products.
MITRE: T1055 · T1574.002
Start Keylogger installs a session-level keylogger. Get Screenshot captures the current desktop, and Background Screenshots continues at fifteen-second intervals for five minutes: producing a timeline of victim activity in the window following access.
MITRE: T1056.001 · T1113
Four reconnaissance scripts run in sequence: Get System Info via API collects OS version and hardware details; Get Current Process Information captures integrity level; Get Antivirus Information queries WMI for security products; and Get Most Recently Modified Microsoft Office Files enumerates documents modified in the last thirty days: specific to APT28’s document-collection objective.
MITRE: T1082 · T1057 · T1518.001 · T1083
Windows Defender is the sole security product on this host. The obfuscated two-stage loader completed the full session lifecycle without triggering a detection on Windows 10 21H1 with default Defender configuration.
Survey LevelUp Techniques enumerates applicable CVE-based escalation techniques for the current host. Invoke LevelUp Privilege Escalation iterates through them until a SYSTEM-level session is obtained. The Workflow does not hardcode a single escalation path: it surveys what the target is vulnerable to and adapts accordingly.
MITRE: T1068
Four operations run from the elevated session: Dump User Hashes extracts NTLM hashes from the SAM database; Get Autologin Credentials reads plaintext credentials from the AutoLogon registry key; Get Stored Passwords From the Windows Credential Manager enumerates the vault; and Find Credential Files locates SSH keys, KeePass databases, and VPN configs. No Mimikatz binary on disk, no LSASS read.
MITRE: T1003.002 · T1552.002 · T1555 · T1552.001
Three Independent Credential Sources
SAM NTLM hashes (pass-the-hash ready), plaintext autologon credentials from the registry, and Windows Credential Manager blobs: all recovered without touching LSASS or dropping a Mimikatz binary.
Lateral Movement with WMI and PowerShell Cradle via API delivers an implant to the lateral target using domain credentials from Phase 9. The technique uses Win32_Process.Create over WMI: no SMB share written, no scheduled task on the target, no service registered. WMI execution from a domain-joined host blends with normal administrative traffic.
MITRE: T1021.006 · T1047
Invoke User Profile Wiper enumerates all files under Desktop, Documents, Downloads, Pictures, Videos, Music, and AppData\Local\Temp: the exact directories targeted in the October 2025 Pawn Storm incident. By default DryRun=$true lists files that would be deleted without touching them.
Default-Safe Destructive Emulation
DryRun=$true is the default. Defenders see every telemetry event the wiper generates: file enumeration, directory traversal, process tree: without data loss. Setting DryRun=$false requires explicit operator intent.
MITRE: T1485 · T1070.004
§3: Platform Capabilities
Why Workflows, Not Scripts
A script is brittle: it assumes sequential success and fails silently at step five if step four produced unexpected output. A Workflow is interactive: each cell shows its output before the next cell runs. The playbook is authoritative documentation and an execution engine at the same time.
Repeatability
Same Workflow, different target
Change six variables in Phase 0 and the entire chain re-executes against a new environment. Everything else is encoded in the workflow.
IOC Fidelity
Campaign-accurate indicators
The exact CLSID, DLL naming, task name, and wiper directories from PRISMEX documentation. Detection rules written against this emulation match real PrismexDrop behavior.
AI Orchestration
Runs autonomously under the agent
The SpecterInsight AI agent can drive the entire Workflow. It reads output, polls for sessions, and continues without manual intervention.
Adaptive Escalation
LevelUp adapts to the target
Phase 8b surveys and selects from the full LevelUp CVE library. SYSTEM access on patched and unpatched hosts without manual technique selection.
Safe Destructive
Wiper emulation without data loss
DryRun generates all wiper telemetry while files remain intact. Purple teams validate detection coverage without accepting data loss.
Memory-Only Implant
Never touches disk
Two-stage loader uses Assembly.Load. The payload exists only in memory from the moment the macro executes. Disk forensics finds nothing.
§4: Workflow Structure
What a Cell Looks Like
Each Workflow cell is one of three types: markdown (documents technique and MITRE ID), parameter (collects values available to all subsequent cells), or script (executes PowerShell against live sessions). A Phase 5 script cell looks like this:
§5: MITRE ATT&CK Coverage
Full Technique Mapping
| Technique ID | Technique Name | Phase |
|---|---|---|
| T1566.001 | Phishing: Spearphishing Attachment | 3: Email Delivery |
| T1204.002 | User Execution: Malicious File | 4: Initial Access |
| T1059.001 | Command and Scripting: PowerShell | 4, 6c |
| T1546.015 | Event Triggered Execution: COM Hijacking | 5: COM Persistence |
| T1053.005 | Scheduled Task/Job: Scheduled Task | 6: Task Persistence |
| T1055 | Process Injection | 7: Migration |
| T1574.002 | Hijack Execution Flow: DLL Side-Loading | 7: Migration |
| T1056.001 | Input Capture: Keylogging | 7b: Collection |
| T1113 | Screen Capture | 7b: Collection |
| T1082 | System Information Discovery | 8: Recon |
| T1057 | Process Discovery | 8: Recon |
| T1518.001 | Software Discovery: Security Software | 8: Recon |
| T1083 | File and Directory Discovery | 8: Recon |
| T1068 | Exploitation for Privilege Escalation | 8b: Priv Esc |
| T1003.002 | OS Credential Dumping: SAM | 9: Credentials |
| T1552.002 | Unsecured Credentials: Credentials in Registry | 9: Credentials |
| T1555 | Credentials from Password Stores | 9: Credentials |
| T1552.001 | Unsecured Credentials: Credentials in Files | 9: Credentials |
| T1021.006 | Remote Services: Windows Remote Management | 10: Lateral |
| T1047 | Windows Management Instrumentation | 10: Lateral |
| T1485 | Data Destruction | 11: Wiper |
| T1070.004 | Indicator Removal: File Deletion | 11: Wiper |
§6: Summary
Repeatable, Accurate, Complete
The value of the PRISMEX Workflow is not any individual technique. Most of what it does: COM DLL hijacks, scheduled tasks, WMI lateral movement: is implemented in dozens of red team tools. What distinguishes it is the structure: these techniques in this sequence, against these IOCs, with this campaign context baked in at every step.
A defender who runs detection engineering against the PRISMEX Workflow is validating coverage against a documented Pawn Storm attack pattern, not against a generic COM hijack test. A purple team that runs it produces telemetry with real APT28 IOCs embedded: the specific CLSID, the specific DLL path, the specific task name. When a detection rule written against that exercise is deployed to production, it has been validated against accurate campaign indicators.
That is what adversary emulation is supposed to produce. Phase 0 is the only configuration step. Everything after it is execution.
PRISMEX ships in SpecterInsight v7.0.0
Available in the Workflows panel alongside the GIFTEDCROOK, Earth Kasha, and ClickOnce COM hijack attack chain workflows. Each encodes a distinct threat actor, delivery mechanism, and post-exploitation objective. See the v7.0.0 release notes for the full feature summary.
PRISMEX Campaign Emulation · SpecterInsight v7.0.0 · Practical Security Analytics LLC · For authorized operational and training use only.
