type
Post
status
Published
date
Nov 28, 2023
summary
Invoke-AtomicRedTeam is a PowerShell module that allows you to execute tests defined in the atomics folder of Red Canary's Atomic Red Team project. It is important to understand the tests before executing them and ensure you have permission to test. It is recommended to set up a test machine similar to your environment and have your collection/EDR solution in place. Complete installation and usage instructions can be found in the Wiki.
tags
Cyber
category
Collections
password
slug
icon
Invoke-AtomicRedTeam is a PowerShell module to execute tests as defined in the atomics folder of Red Canary's Atomic Red Team project. The "atomics folder" contains a folder for each Technique defined by the MITRE ATT&CK™ Framework. Inside of each of these "T#" folders you'll find a yaml file that defines the attack procedures for each atomic test as well as an easier to read markdown (md) version of the same data.
Executing atomic tests may leave your system in an undesirable state. You are responsible for understanding what a test does before executing.
Ensure you have permission to test before you begin.
It is recommended to set up a test machine for atomic test execution that is similar to the build in your environment. Be sure you have your collection/EDR solution in place, and that the endpoint is checking in and active.
See the Wiki for complete Installation and Usage instructions.
Note: This execution frameworks works on Windows, MacOS and Linux. If using on MacOS or Linux you must install PowerShell Core first.
上一篇
Incident Response Plan: Frameworks and Steps - CrowdStrike
下一篇
Quickstart · Wazuh :The Open Source Security Platform Unified XDR and SIEM
- Author:Netsec
- URL:https://blog.51sec.org/article/17331194-eeda-42e0-a3cb-0a5a463fb9d0
- Copyright:All articles in this blog, except for special statements, adopt BY-NC-SA agreement. Please indicate the source!
