Skip to content

Commit

Permalink
move invoke-artaction to execution-frameworks directory per plan (red…
Browse files Browse the repository at this point in the history
  • Loading branch information
brianebeyer authored May 24, 2018
1 parent 824a910 commit 044df7e
Show file tree
Hide file tree
Showing 5 changed files with 9 additions and 25 deletions.
26 changes: 2 additions & 24 deletions README.md
Original file line number Diff line number Diff line change
Expand Up @@ -12,8 +12,8 @@ trademark of The MITRE Corporation.*
2. [Contributing Guide](https://github.com/redcanaryco/atomic-red-team/blob/master/CONTRIBUTIONS.md)
3. [Doing more with Atomic Red Team](#doing-more-with-atomic-red-team)
1. [Using the Atomic Red Team Ruby API](#using-the-atomic-red-team-ruby-api)
2. [Running Atomic Red Team tests via Invoke-ArtAction Powershell](#running-atomic-red-team-tests-via-invoke-artaction-powershell)
3. [Bonus APIs: Ruby ATT&CK API](#bonus-apis-ruby-attck-api)
2. [Bonus APIs: Ruby ATT&CK API](#bonus-apis-ruby-attck-api)
3. [Execution Frameworks](https://github.com/redcanaryco/atomic-red-team/blob/master/execution-frameworks)

## Quick Start: Using Atomic Red Team to test your security

Expand Down Expand Up @@ -139,28 +139,6 @@ end

For additional examples, see the utilities in `bin/` or the API code in `atomic_red_team`.

### Running Atomic Red Team tests via Invoke-ArtAction Powershell
Atomic Red Team tests can also be invoked on a Windows system via an Atomic Red Team PowerShell module.

**Note: this section and the associated Powershell module does not currently work with the
new YAML format and is being updated.**

To invoke an Atomic Red Team test:

```
...from within the atomic-red-team directory...
# TODO: is there a way this can be installed from github?
PS > Import-Module .\AtomicRedTeam.psd1
PS > Invoke-ArtAction Windows/Execution/Trusted_Developer_Utilities/MSBuild
```

Tab-completion is also provided:
```
PS > Get-ArtAction Windows/Ex*
Windows/Execution/Trusted_Developer_Utilities/MSBuild
```

### Bonus APIs: Ruby ATT&CK API
Atomic Red Team pulls information about ATT&CK techniques using the STIX definitions of ATT&CK located
on [MITRE's CTI Github](https://raw.githubusercontent.com/mitre/cti/master/enterprise-attack/enterprise-attack.json).
Expand Down
2 changes: 2 additions & 0 deletions execution-frameworks/README.md
Original file line number Diff line number Diff line change
@@ -0,0 +1,2 @@
# Atomic Red Team Execution Frameworks
This repository will contain any lightweight execution frameworks that help you run Atomic Tests in your environment.
File renamed without changes.
File renamed without changes.
Original file line number Diff line number Diff line change
@@ -1,4 +1,8 @@
# Automation Framework for the Atomic Red Team
# Atomic Red Team Powershell Execution Framework

> **HEADS UP!** The Invoke-ArtAction execution framework was designed for the original Atomic Red Team Markdown
> format and is not yet compatible with the current Atomic YAML format. Let us know if you're interested in
> contributing that update!
The Atomic Red Team project is unique in that it not only describes the tactics and techiques of the MITRE ATT&CK framework, but it also includes automation of these techniques.

Expand Down

0 comments on commit 044df7e

Please sign in to comment.