Invoke-AtomicRedTeam

Requires Installation of PowerShell-Yaml

Install-Module -Name powershell-yaml

For Additional Details: PowerShell-Yaml

Basic usage Examples

Load PowerShell Script

Import-Module .\Invoke-AtomicRedTeam.psm1`

Execute Single Test

$T1117 = Get-AtomicTechnique -Path ..\..\atomics\T1117\T1117.yaml
Invoke-AtomicTest $T1117

Additional Examples

If you would like output when running tests using the following:

Informational Stream

Invoke-AtomicTest $T1117 -InformationAction Continue

Verbose Stream

Invoke-AtomicTest $T1117 -Verbose

Debug Stream

Invoke-AtomicTest $T1117 -Debug

WhatIf

If you would like to see what would happen without running the test

Invoke-AtomicTest $T1117 -WhatIf

Confirm

To run all tests without confirming them run using the Confirm switch to false

Invoke-AtomicTest $T1117 -Confirm:$false

Or you can set your $ConfirmPreference to 'Medium'

$ConfirmPreference = 'Medium'
Invoke-AtomicTest $T1117

Generate All Tests

[System.Collections.HashTable]$AllAtomicTests = @{}
$AtomicFilePath = 'C:\AtomicRedTeam\atomics\'  
Get-ChildItem $AtomicFilePath -Recurse -Filter *.yaml -File | ForEach-Object {
    $currentTechnique = [System.IO.Path]::GetFileNameWithoutExtension($_.FullName)  
    $parsedYaml = (ConvertFrom-Yaml (Get-Content $_.FullName -Raw ))
    $AllAtomicTests.Add($currentTechnique, $parsedYaml); 
}
$AllAtomicTests.GetEnumerator() | Foreach-Object { Invoke-AtomicTest $_.Value -GenerateOnly }

1.7 KiB Raw Blame History