-
Notifications
You must be signed in to change notification settings - Fork 191
Execute Atomic Tests (Local)
You can use the Invoke-AtomicTest
function to run an atomic test on the system where you installed Atomic Red Team (Local), or on a remote machine through a PowerShell Remoting session (Remote). These instructions show you how to execute tests on the Local machine. For instruction on executing tests on a Remote Machine see here.
Before executing an atomic test you should have done the following:
You may find it useful to List Atomic Tests before execution as well.
Invoke-AtomicTest T1218.010 -TestNumbers 1,2
# or using the short form ..
Invoke-AtomicTest T1218.010-1,2
This assumes your atomics folder is in the default location of <BASEPATH>\AtomicRedTeam\atomics
Where <BASEPATH>
is C:
in Windows or ~
in Linux/MacOS
You can override the default path to the atomics folder using the $PSDefaultParameterValues
preference variable as shown below.
$PSDefaultParameterValues = @{"Invoke-AtomicTest:PathToAtomicsFolder"="C:\Users\myuser\Documents\code\atomic-red-team\atomics"}
Tip: Add this to your PowerShell profile so it is always set to your preferred default value.
Invoke-AtomicTest T1218.010 -TestNames "Regsvr32 remote COM scriptlet execution","Regsvr32 local DLL execution"
Invoke-AtomicTest T1003 -TestGuids 5c2571d0-1572-416d-9676-812e64ca9f44,66fb0bc1-3c3f-47e9-a298-550ecfefacbc
Execution by GUID is useful when scripting because the GUID's are guaranteed to not change, whereas the test number and test name for a given test may change.
Invoke-AtomicTest T1218.010
Invoke-AtomicTest T1218.010 -TimeoutSeconds 15
If the attack commands do not exit (return) within in the specified -TimeoutSeconds
, the process and it's children will be forcefully terminated. The default value of -TimeoutSeconds
is 120. This allows the Invoke-AtomicTest
script to move on to the next test.
You can execute tests in a way that lets you give input to the test during execution. For example, the commands executed my prompt you for confirmation before overwriting a file. In order to be able to do this you must specify the -Interactive
flag. If you don't specify the -Interactive
flag and a command asks for user input, the execution will hang until it eventually times out.
Invoke-AtomicTest T1003 -Interactive
The drawback of using the -Interactive
flag is that you can't redirect output from the command execution to a file.
This is not recommended but you can execute all Atomic tests in your atomics folder with the following:
Invoke-AtomicTest All
A better way to do this would be to use a little PowerShell script to run each test one at a time, getting the prereqs first and cleaning up after each one. The following example runs all automated windows atomics.
$techniques = gci C:\AtomicRedTeam\atomics\* -Recurse -Include T*.yaml | Get-AtomicTechnique
foreach ($technique in $techniques) {
foreach ($atomic in $technique.atomic_tests) {
if ($atomic.supported_platforms.contains("windows") -and ($atomic.executor -ne "manual")) {
# Get Prereqs for test
Invoke-AtomicTest $technique.attack_technique -TestGuids $atomic.auto_generated_guid -GetPrereqs
# Invoke
Invoke-AtomicTest $technique.attack_technique -TestGuids $atomic.auto_generated_guid
# Sleep then cleanup
Start-Sleep 3
Invoke-AtomicTest $technique.attack_technique -TestGuids $atomic.auto_generated_guid -Cleanup
}
}
}
Specify a custom path to your atomics folder, example C:\AtomicRedTeam\atomics
Invoke-AtomicTest All -PathToAtomicsFolder C:\AtomicRedTeam\atomics
To run all tests without confirming them run using the Confirm switch to false
Invoke-AtomicTest All -Confirm:$false
Or you can set your $ConfirmPreference
to 'Medium'
$ConfirmPreference = 'Medium'
Invoke-AtomicTest All
Questions? Get connected to the community on the Atomic Red Team Slack channel.
- Installation
- Import the Module
- List Atomic Tests
- Check/Get Prerequisites for Atomic Tests
- Execute Atomic Tests (Local)
- Execute Atomic Tests (Remote)
- Specify Custom Input Arguments
- Cleanup after Executing Atomic Tests
- Execution Logging
- Adversary Emulation
- Continuous Atomic Testing
- Execution Hooks
- Helper Functions
- The Atomic GUI
- Uninstallation