#RTFM

Offensive tradecraft is scattered: MITRE ATT&CK in one place, Atomic Red Team tests in another, LOLBAS / GTFOBins / WADComs, Sigma rules and Nuclei templates somewhere else. Copying it into notes by hand goes stale immediately.

A layered build pipeline that generates an Obsidian vault from upstream sources:

1. ATT&CK Enterprise → one note per technique and sub-technique, with relationships and tactic indexes
2. Atomic Red Team → procedure notes linked under each technique
3. LOLBAS / WADComs (GTFOBins in progress) → structured binary-abuse notes mapped to TTPs
4. Sigma / Nuclei → detections and checks linked back to techniques
5. Audit and backfill scripts so the vault can be rebuilt reproducibly after an OS migration

Each technique becomes a hub: procedures → commands → detections → telemetry → tools → labs → references. It's navigated through local graphs and maps of content (MOCs), not the noisy global graph.

After the September rebuild: 254 technique folders, 618 sub-technique notes, 1,052 ATT&CK object notes, 761 TTP notes enriched, 15 tactic indexes. Earlier checkpoints: 257 LOLBAS and 104 WADComs entries structured; 755 procedure files backfilled.

GTFOBins ingestion is incomplete (its api.json is a Jekyll template, not data), the source-update script is unfinished, and one tactic-naming mismatch needs normalizing. See W14.

Sources: Red Team Knowledgebase Guide (26 May 26), ThinkPad Obsidian Performance (6 Jun 26), Resurrect RTFM Vault (12 Sep 26)