Invoke-Atomicredteam Environment Setup

This project creates a container to use Invoke-Atomicredteam remotely against targets by establishing a PowerShell Remoting session over SSH.

Two scripts have been created to setup PowerShell Remoting over SSH on the target hosts (Windows and Linxu).

Setup

(C2 Host) Docker is required for Windows/Linux host running the Invoke-Atomicredteam container.
(Target Host) A user must be created with a password in order to use PowerShell Remoting

Ensure Docker is installed and running
To build the container

docker build -t atomicred .
Run the container

docker run -it --name atomic-red atomicred
Start a remote session

$sess = New-PSSession -HostName <ip address/hostname> -Username <username>

If WSMan support is required for remote connections the docker file based on debian is required

Ensure Docker is installed and running
Build Dockerfile based on debian

docker build -t atomicred -f .\Dockerfile.debian .
Run the container

docker run -it --name atomic-red atomicred
Start a remote session

$sess = New-PSSession -ComputerName <ip address/hostname> -Credential <username> -Authentication Negotiate

Target hosts need to be configured to accept PowerShell Remoting sessions over SSH.

For x64 Windows OS Hosts:

For x64 Linux Hosts:

Establish remote sesion from the server (docker container) to the target client host

$sess = New-PSSession -HostName <ip address/hostname> -Username <username> -Name <friendlyname>

Verify session is established

Get-PSSession
Invoke-Command -Session $sess -ScriptBlock {Get-Process}

Install any prerequisites on the remote machine before executing the test
```
Invoke-AtomicTest T1218.010 -Session $sess -GetPrereqs
```
Execute all atomic tests in technique T1218.010 on a remote machine
```
Invoke-AtomicTest T1218.010 -Session $sess
```

Cleanup from the test

Invoke-AtomicTest T1218.010 -Cleanup -Session $sess

Create a mount point when starting the docker container

docker run -it -v "$(pwd)"/logs:/logs --name atomic-red atomicred
Execute atomic test with Attire logging module

Invoke-AtomicTest T1087.001 -LoggingModule "Attire-ExecutionLogger" -ExecutionLogPath "/logs/attireLog.json" -Session $sess