redcanaryco / invoke-atomicredteam

Invoke-AtomicRedTeam is a PowerShell module to execute tests as defined in the [atomics folder](https://github.com/redcanaryco/atomic-red-team/tree/master/atomics) of Red Canary's Atomic Red Team project.
MIT License
818 stars 194 forks source link

Get-AtomicTechnique : The term 'ConvertFrom-Yaml' is not recognized as the name of a cmdlet, function, script file, or operable program. #28

Closed cneskey closed 4 years ago

cneskey commented 4 years ago
Get-AtomicTechnique : The term 'ConvertFrom-Yaml' is not recognized as the name of a cmdlet, function, script file, or operable program. Check the spelling of the name, or if a path was included, verify that the path is correct and try again.
At C:\invoke-atomicredteam-master\invoke-atomicredteam-master\Public\Invoke-AtomicTest.ps1:133 char:71
+ ... aml) { $AtomicTechniqueHash = Get-AtomicTechnique -Path $pathToYaml }
+                                   ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : NotSpecified: (:) [Write-Error], WriteErrorException
    + FullyQualifiedErrorId : Microsoft.PowerShell.Commands.WriteErrorException,Get-AtomicTechnique

Remedied by installing unofficial PowerShell-yaml from Install-Module -Name powershell-yaml -RequiredVersion 0.3.1 which then installs dependency NuGet

Did I miss a step in the instructions where this yaml handling should have been taken care of?

mattifestation commented 4 years ago

Hey @cneskey. Obtaining the dependency automatically is handled in the Install-AtomicRedTeam function. Let us know if you think the dependency could be documented better.

cneskey commented 4 years ago

Thank you! You were clear. I just didnt realize my a/v blocked the dependency activity. This was my user-error fault. Windows Defender (win10) quarantined the several files and blocked several filesystem changes despite my folder (Atomic) and process (powershell) exceptions. For some reason several blocked actions didn't appear in history until hours later so I assumed they were not blocked.