redcanaryco / invoke-atomicredteam

Invoke-AtomicRedTeam is a PowerShell module to execute tests as defined in the [atomics folder](https://github.com/redcanaryco/atomic-red-team/tree/master/atomics) of Red Canary's Atomic Red Team project.
MIT License
815 stars 193 forks source link

Consider adding a way to programmatically retrieve if PreReqs are met #57

Closed ION28 closed 2 years ago

ION28 commented 3 years ago

We use the Atomic Red Team & Invoke-AtomicRedTeam Projects within our CI pipeline in BLUESPAWN . This gives us at least some automated insight into the current coverage of BLUESPAWN and visibility into any possible regressions in detection logic.

Recently, we started having some of the tests fail and exit because the prerequisites were not met, ultimately failing the builds. For example, we run the following PowerShell command within our main test script which selectively runs ART tests for techniques we support.

Invoke-AtomicTest T1053.005 -ExecutionLogPath 'd:\a\BLUESPAWN\BLUESPAWN\AtomicTestsResults.csv'

Given this failure, I began investigating more into how Invoke-AtomicRedTeam handles checking pre-reqs. Based on my review of the code/testing, there does not seem to be an automated way to check if pre-reqs are met programmatically (?). Given that this project is meant to automate the running of these tests, I was wondering if you might consider adding a way to get this status.

I see a few possible ways this could be supported. First, prereqs could automatically be checked when a test is run by default. If the prereqs were not satisfied, the test would just be skipped (and/or an error printed). This would enable folks to keep using a command line (like the one above) having confidence that any prereq issues would be ignored or alerted on properly.

Alternatively, you could also add a function to return a boolean if prereqs are supported. That way developers could write something like the following code block:

If(Test-AtomicTestPrereqsMet T1053.005 -eq $true) {
Invoke-AtomicTest T1053.005 -ExecutionLogPath 'd:\a\BLUESPAWN\BLUESPAWN\AtomicTestsResults.csv'
} Else { ... }

Finally, a hybrid of the two options could be added such as an additional parameter called something like "-SkipIfPrereqsNotMet"

clr2of8 commented 2 years ago

My suggestion is to run "Invoke-AtomicTest All -GetPrereqs" which will make sure you have everything you need to run any test. Prereqs are designed to be a one time things, meaning you get them once and you can run the test over and over again without having to get them again. Will this meet your need? (closing this out for now)