diff --git a/atomics/T1028/T1028.md b/atomics/T1028/T1028.md
index 93be88be..566ebb96 100644
--- a/atomics/T1028/T1028.md
+++ b/atomics/T1028/T1028.md
@@ -24,6 +24,8 @@ Remote Support: Yes
- [Atomic Test #4 - Psexec](#atomic-test-4---psexec)
+- [Atomic Test #5 - Invoke-Command](#atomic-test-5---invoke-command)
+
@@ -100,3 +102,22 @@ Utilize psexec to start remote process
psexec \\host -u domain\user -p password -s cmd.exe
```
+
+
+## Atomic Test #5 - Invoke-Command
+Execute Invoke-command on remote host
+
+**Supported Platforms:** Windows
+
+
+#### Inputs
+| Name | Description | Type | Default Value |
+|------|-------------|------|---------------|
+| host_name | Remote Windows Host Name | String | Test|
+| remote_command | Command to execute on remote Host | String | ipconfig|
+
+#### Run it with `powershell`!
+```
+invoke-command -computername #{host_name} -scriptblock {#{remote_command}}
+```
+
diff --git a/atomics/index.md b/atomics/index.md
index 0b86ffed..9d1693af 100644
--- a/atomics/index.md
+++ b/atomics/index.md
@@ -460,6 +460,7 @@
- Atomic Test #2: PowerShell Lateral Movement [windows]
- Atomic Test #3: WMIC Process Call Create [windows]
- Atomic Test #4: Psexec [windows]
+ - Atomic Test #5: Invoke-Command [windows]
# lateral-movement
- [T1155 AppleScript](./T1155/T1155.md)
@@ -491,6 +492,7 @@
- Atomic Test #2: PowerShell Lateral Movement [windows]
- Atomic Test #3: WMIC Process Call Create [windows]
- Atomic Test #4: Psexec [windows]
+ - Atomic Test #5: Invoke-Command [windows]
# collection
- [T1123 Audio Capture](./T1123/T1123.md)
diff --git a/atomics/windows-index.md b/atomics/windows-index.md
index 8da80c60..28bdc779 100644
--- a/atomics/windows-index.md
+++ b/atomics/windows-index.md
@@ -294,6 +294,7 @@
- Atomic Test #2: PowerShell Lateral Movement [windows]
- Atomic Test #3: WMIC Process Call Create [windows]
- Atomic Test #4: Psexec [windows]
+ - Atomic Test #5: Invoke-Command [windows]
# collection
- [T1123 Audio Capture](./T1123/T1123.md)
@@ -385,6 +386,7 @@
- Atomic Test #2: PowerShell Lateral Movement [windows]
- Atomic Test #3: WMIC Process Call Create [windows]
- Atomic Test #4: Psexec [windows]
+ - Atomic Test #5: Invoke-Command [windows]
# command-and-control
- T1043 Commonly Used Port [CONTRIBUTE A TEST](https://atomicredteam.io/contributing)