redcanaryco / invoke-atomicredteam

Invoke-AtomicRedTeam is a PowerShell module to execute tests as defined in the [atomics folder](https://github.com/redcanaryco/atomic-red-team/tree/master/atomics) of Red Canary's Atomic Red Team project.
MIT License
789 stars 188 forks source link

AtomicRunner: Incorporate the Runner Schedule Order Column # as a execution pointer instead of hostname GUID #178

Open hunty-dumpy opened 6 months ago

hunty-dumpy commented 6 months ago

The current implementation of the runner, adds the current test's GUID to the hostname, and then uses that GUID to know where in the execution schedule it is to continue running.

The Order Column is ignored, this prevents us from executing the same test twice with different input parameters because it creates a loop by "continuing" always from the first time the GUID shows up in the runner schedule csv file.

clr2of8 commented 6 months ago

Hi there, If I understand what you are asking then I think the option to not rename and reboot is included in the Adversary Emulation option where there are no hostname changes and you just pass your schedule on the command line with the -listOfAtomics option.

As a work around for you first issue, you could put another test between the two tests with same guid:

Let me know your thoughts. thx