Skip to content

New Atomic* Technique Test Creation Functions

Matt Graeber edited this page Mar 12, 2020 · 2 revisions

The Invoke-AtomicRedTeam module contains several New-Atomic* functions to facilitate using native PowerShell to create and validate atomic techniques and tests. These functions were written to address the following:

  • Atomic tests previously needed to be written by hand which is perfectly acceptable in many cases but can be error-prone when drafting YAML manually.
  • Previously, when writing atomic tests, there was no way to validate the YAML against a schema aside from executing validate-atomics.rb in the atomic-red-team repository.
  • Previously, there was no way to build techniques/tests in an automated fashion using code. Imagine a scenario where hundreds of tests needed to be generated on the fly. Writing that many tests by hand is just not feasible.

The following functions are available to help build atomic techniques and tests:

New-AtomicTechnique

Specifies a new atomic red team technique. The output of this function is designed to be piped directly to ConvertTo-Yaml, eliminating the need to work with YAML directly.

New-AtomicTest

Specifies the name of the test that indicates how it tests the technique.

New-AtomicTestDependency

Specifies a new dependency that must be met prior to execution of an atomic test.

New-AtomicTestInputArgument

Detailed documentation including example usages for each function is available by using Get-Help.