/Emulation-Tools

Primary LanguagePowerShellApache License 2.0Apache-2.0

Emulation-Tools

This repo contains various scripts and tools that may be useful for assiting in emulating threats.

Invoke-AtomicEmulations

This is a wrapper script for Invoke-Atomic, it reads YAML files that contain various Atomics that attempt to emulate various threats. To get started, follow the instructions to install Invoke-Atomic and then run the test!

.\Invoke-AtomicEmulation.ps1 -PathToEmulationPlan ..\Emulations\Phosphorus.yml

Current implemented parameters:

  • PathToAtomicsFolder
    • The default Atomics paths are based on the installation of Invoke-Atomic, this can be overridden with this parameter.
  • PathToInvoke
    • The default Invoke-Atomic path is based on the installation of Invoke-Atomic, this can be overriden with this parameter.
  • PathToEmulationPlan
    • This is the path to the specific emulation YAML file. Currently, only one emulation can be executed at a time.
  • Cleanup
    • If you wish for cleanup commands to be executed after the emulation finishes, use this parameter with -Cleanup $true