DOCSEARCHbyAlgolia
Submit Docs

Invoke-AtomicRedTeam Documentation

repository·master·Indexed 21 days ago

https://github.com/redcanaryco/invoke-atomicredteam

A PowerShell-based execution framework used to automate security control testing by running atomic tests mapped to the MITRE ATT&CK framework. It executes attack procedures defined in YAML files from the Atomic Red Team repository and supports Windows, MacOS, and Linux.

Tokens
240
Snippets
0
Records
1
Agent score
27%

What's inside Invoke-AtomicRedTeam

  1. Overview of Invoke-AtomicRedTeam

    master

    Invoke-AtomicRedTeam is a PowerShell module designed to execute security tests defined by the Red Canary Atomic Red Team project. It automates the execution of attack procedures mapped to the MITRE ATT&CK™ Framework.

    Key details:

    • Test Source: It pulls test definitions from the atomics folder of the Atomic Red Team repository, where each technique (T#) contains a yaml file defining the attack procedures.
    • Cross-Platform Support: The framework works on Windows, MacOS, and Linux.
    • Prerequisite for Non-Windows: If running on MacOS or Linux, you must install PowerShell Core first.

    ⚠️ Safety Warnings:

    • Executing atomic tests may leave your system in an undesirable state. Always understand the test procedure before execution.
    • Ensure you have explicit permission to test.
    • It is recommended to use a test machine that mirrors your production environment, with your EDR/collection solutions active and checking in.