search

redcanaryco / invoke-atomicredteam

Invoke-AtomicRedTeam is a PowerShell module to execute tests as defined in the [atomics folder](https://github.com/redcanaryco/atomic-red-team/tree/master/atomics) of Red Canary's Atomic Red Team project.
MIT License
815 stars 193 forks source link

[Question] Custom yaml with Invoke-Atomic #56

Closed ghost closed 3 years ago

ghost commented 3 years ago

Looking through documentation, I may have missed something, but is it possible to run custom yaml with Invoke-Atomic, given that it fits the standard yaml format for ART? Thanks in advance!

mgraeber-rc commented 3 years ago

You're not missing anything. Outside of supplying YAML inside an Atomics directory, Invoke-AtomicTest does not support supplying YAML directly as a string.

clr2of8 commented 3 years ago

If you have your own yaml of the same format, you can put it in whatever directory you want and then point to it when you execute the test using the PathToAtomicsFolder switch.

https://github.com/redcanaryco/invoke-atomicredteam/wiki/Execute-Atomic-Tests-(Local)#execute-all-tests-from-a-specific-directory

Invoke-AtomicTest T1111 -PathToAtomicsFolder C:\mycustompath\myatomics

In this example, your yaml file would be here C:\mycustompath\myatomics\T1111\T1111.yaml

clr2of8 commented 3 years ago

You can also put the following in your powershell profile to set your own default for PathToAtomicsFolder so you don't need to include it on the command line every time. This is handy if you will be mostly executing from this custom folder.

$PSDefaultParameterValues = @{"Invoke-AtomicTest:PathToAtomicsFolder"="C:\mycustompath\myatomics"}

ghost commented 3 years ago

Thank you so much for the clarification. That is just what I was looking for!