### Install Invoke-AtomicRedTeam using raw script

Source: https://github.com/redcanaryco/invoke-atomicredteam/wiki/Installing-Invoke-AtomicRedTeam

Downloads and executes the install script from GitHub to install the Invoke-AtomicRedTeam execution framework. This method bypasses the PowerShell Gallery and installs the framework to a local directory.

```powershell
IEX (IWR 'https://raw.githubusercontent.com/redcanaryco/invoke-atomicredteam/master/install-atomicredteam.ps1' -UseBasicParsing);
Install-AtomicRedTeam
```

--------------------------------

### Install Invoke-AtomicRedTeam with Atomics Folder

Source: https://github.com/redcanaryco/invoke-atomicredteam/wiki/Installing-Invoke-AtomicRedTeam

Installs the Invoke-AtomicRedTeam execution framework along with the complete Atomics Folder, which contains all test definitions. This is achieved by using the -getAtomics switch with the installation script.

```powershell
IEX (IWR 'https://raw.githubusercontent.com/redcanaryco/invoke-atomicredteam/master/install-atomicredteam.ps1' -UseBasicParsing);
Install-AtomicRedTeam -getAtomics
```

--------------------------------

### Install with Force Option

Source: https://github.com/redcanaryco/invoke-atomicredteam/wiki/Installing-Invoke-AtomicRedTeam

Installs the Atomics folder and removes any previous installation before proceeding. The -Force parameter ensures a clean installation.

```powershell
Install-AtomicRedTeam -Force
Install-AtomicsFolder -Force
```

--------------------------------

### Install Invoke-AtomicRedTeam and powershell-yaml

Source: https://github.com/redcanaryco/invoke-atomicredteam/wiki/Installing-Invoke-AtomicRedTeam

Installs the Invoke-AtomicRedTeam execution framework and the powershell-yaml module from the PowerShell Gallery for the current user. This is the recommended method for installing the framework only.

```powershell
Install-Module -Name invoke-atomicredteam,powershell-yaml -Scope CurrentUser
```

--------------------------------

### Install from Alternate Repository

Source: https://github.com/redcanaryco/invoke-atomicredteam/wiki/Installing-Invoke-AtomicRedTeam

Installs the Atomics folder from a specified GitHub repository owner using the -RepoOwner parameter. This is useful for using forks or alternative sources.

```powershell
Install-AtomicRedTeam -RepoOwner "clr2of8"
Install-AtomicsFolder -RepoOwner "clr2of8"
```

--------------------------------

### Install Atomics Folder

Source: https://github.com/redcanaryco/invoke-atomicredteam/wiki/Installing-Invoke-AtomicRedTeam

Installs the Atomics folder from the default GitHub repository. This function downloads the necessary files to run Atomic Red Team tests.

```powershell
IEX (IWR 'https://raw.githubusercontent.com/redcanaryco/invoke-atomicredteam/master/install-atomicsfolder.ps1' -UseBasicParsing);
Install-AtomicsFolder
```

--------------------------------

### Invoke-SetupAtomicRunner Usage

Source: https://github.com/redcanaryco/invoke-atomicredteam/wiki/Continuous-Atomic-Testing

Demonstrates various ways to run the Invoke-SetupAtomicRunner script, including skipping service setup, specifying an installation directory, and configuring it to use a scheduled task instead of a service.

```powershell
# Run Invoke-SetupAtomicRunner as the runner user (from admin prompt)
# This will prompt you for the user password, which it will use to install the atomicrunnerservice
Invoke-SetupAtomicRunner

# If you want to skip the setup of the atomicrunnerservice during the setup (because you've already set it up and don't want to enter the user password again)
Invoke-SetupAtomicRunner -SkipServiceSetup

# If you want to specify an alternative directory for the service install (default is the System32 directory)
Invoke-SetupAtomicRunner -ServiceInstallDir "C:\Temp"

# If you prefer to use a Scheduled Task instead of a service for the continuous execution of atomics
Invoke-SetupAtomicRunner -asScheduledTask
```

--------------------------------

### Install from Alternate Branch

Source: https://github.com/redcanaryco/invoke-atomicredteam/wiki/Installing-Invoke-AtomicRedTeam

Installs the Atomics folder from a specified branch of a GitHub repository using the -RepoOwner and -Branch parameters. This allows testing development branches.

```powershell
Install-AtomicRedTeam -RepoOwner "clr2of8" -Branch "start-process-branch"
Install-AtomicsFolder -RepoOwner "clr2of8" -Branch "start-process-branch"
```

--------------------------------

### Get Prerequisites for All Atomic Tests

Source: https://github.com/redcanaryco/invoke-atomicredteam/wiki/Offline-Installation

This command retrieves all necessary prerequisites for executing Atomic Red Team tests. It's recommended to run this with antivirus disabled to avoid interference. The output can be used to identify and copy required files to an offline system.

```powershell
Invoke-AtomicTest All -GetPrereqs
```

--------------------------------

### Install Prerequisites on Offline System

Source: https://github.com/redcanaryco/invoke-atomicredteam/wiki/Offline-Installation

After transferring files to the offline system, this command ensures that all configurations are set and prerequisite software is installed. This step is crucial for the proper functioning of the Atomic Red Team tests on the offline environment.

```powershell
Invoke-AtomicTest All -GetPrereqs
```

--------------------------------

### Install Invoke-AtomicRedTeam with Atomics Folder (No Payloads)

Source: https://github.com/redcanaryco/invoke-atomicredteam/wiki/Installing-Invoke-AtomicRedTeam

Installs the Invoke-AtomicRedTeam execution framework and the Atomics Folder, but excludes payloads from the /src or /bin directories. Payloads can be downloaded separately using `-getPrereq` with `Invoke-AtomicTest`.

```powershell
IEX (IWR 'https://raw.githubusercontent.com/redcanaryco/invoke-atomicredteam/master/install-atomicredteam.ps1' -UseBasicParsing);
Install-AtomicRedTeam -getAtomics -Force -noPayloads
```

--------------------------------

### Install Atomic Red Team and Invoke-AtomicRedTeam

Source: https://github.com/redcanaryco/invoke-atomicredteam/wiki/Continuous-Atomic-Testing

This script installs the Atomic Red Team framework and the Invoke-AtomicRedTeam module. It fetches the installation script from a GitHub URL and forces the installation, skipping payloads.

```powershell
IEX (IWR 'https://raw.githubusercontent.com/redcanaryco/invoke-atomicredteam/master/install-atomicredteam.ps1' -UseBasicParsing);
Install-AtomicRedTeam -getAtomics -Force -noPayloads
```

--------------------------------

### Install Atomics Folder Without Payloads

Source: https://github.com/redcanaryco/invoke-atomicredteam/wiki/Installing-Invoke-AtomicRedTeam

Installs the Atomics folder, excluding payloads from the /src or /bin directories. Payloads can be downloaded separately using the -getPrereq flag with Invoke-AtomicTest.

```powershell
IEX (IWR 'https://raw.githubusercontent.com/redcanaryco/invoke-atomicredteam/master/install-atomicsfolder.ps1' -UseBasicParsing);
Install-AtomicsFolder -noPayloads -Force
```

--------------------------------

### Install with Custom InstallPath

Source: https://github.com/redcanaryco/invoke-atomicredteam/wiki/Installing-Invoke-AtomicRedTeam

Installs the Atomics folder to a specified directory using the -InstallPath parameter. This allows users to choose a custom location for the Atomic Red Team files.

```powershell
Install-AtomicRedTeam -InstallPath "c:\tools"
Install-AtomicsFolder -InstallPath "c:\tools"
```

--------------------------------

### Print macOS Atomic Test Details

Source: https://github.com/redcanaryco/invoke-atomicredteam/wiki/Iterate-through-Atomic-Tests-Programmatically

This script extracts and prints the GUID, input arguments, and commands for all Atomic Red Team tests that support the macOS platform. It iterates through the techniques and their atomic tests, filtering for macOS compatibility and then displaying the relevant information.

```PowerShell
$path = "C:\AtomicRedTeam\atomics\*"  # Set this to point to your atomics folder
$techniques = Get-ChildItem $path -Recurse -Include T*.yaml | Get-AtomicTechnique

foreach ($technique in $techniques) {
    foreach ($atomic in $technique.atomic_tests) {
        if ($atomic.supported_platforms.contains("macos")) {
            Write-Host -Fore Green $atomic.auto_generated_guid + "`n"
            foreach ($inputArg in $atomic.input_arguments.keys) {
                Write-Host -Fore Yellow "** $inputArg **"
                Write-Host -Fore Yellow $($atomic.input_arguments[$inputArg] | Out-String)
            }
            Write-Host -Fore Cyan $atomic.executor.command
        }
    }
}
```

--------------------------------

### Force Reinstall Invoke-AtomicRedTeam with Atomics Folder

Source: https://github.com/redcanaryco/invoke-atomicredteam/wiki/Installing-Invoke-AtomicRedTeam

Forces a reinstallation of the Invoke-AtomicRedTeam execution framework and the Atomics Folder, overwriting any existing installations. This is useful when updating or ensuring a clean state.

```powershell
IEX (IWR 'https://raw.githubusercontent.com/redcanaryco/invoke-atomicredteam/master/install-atomicredteam.ps1' -UseBasicParsing);
Install-AtomicRedTeam -getAtomics -Force
```

--------------------------------

### Example privateConfig.ps1 for Custom Configuration

Source: https://github.com/redcanaryco/invoke-atomicredteam/wiki/Continuous-Atomic-Testing

An example of a privateConfig.ps1 file used to override default configuration settings for Invoke-AtomicRedTeam. This allows for customization of paths, logging, and execution behavior.

```powershell
$artConfig | Add-Member -Force -NotePropertyMembers @{
  PathToPrivateAtomics = "C:\MyPrivateAtomics\atomics"
  scheduleTimeSpan = New-TimeSpan -Days 1 
  verbose = $true
  LoggingModule = 'Attire-ExecutionLogger'
  logFileName = "timestamp.json"
}
```

--------------------------------

### Set TLS 1.2 for secure channel

Source: https://github.com/redcanaryco/invoke-atomicredteam/wiki/Installing-Invoke-AtomicRedTeam

Configures the .NET ServicePointManager to use TLS 1.2 for secure communication. This is a prerequisite for downloading modules or scripts if the system defaults to older, less secure protocols.

```powershell
[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12
```

--------------------------------

### Install Atomic Red Team and Invoke-AtomicRedTeam

Source: https://github.com/redcanaryco/invoke-atomicredteam/wiki/Adversary-Emulation

Provides the PowerShell command to install the Atomic Red Team framework and the Invoke-AtomicRedTeam module. It fetches the installation script and runs it with options to download atomics, force the installation, and skip payloads.

```powershell
IEX (IWR 'https://raw.githubusercontent.com/redcanaryco/invoke-atomicredteam/master/install-atomicredteam.ps1' -UseBasicParsing);
Install-AtomicRedTeam -getAtomics -Force -noPayloads
```

--------------------------------

### Execute Atomic Tests Remotely

Source: https://github.com/redcanaryco/invoke-atomicredteam/wiki/Execute-Atomic-Tests-(Remote)

Demonstrates how to install prerequisites and execute Atomic Red Team tests on a remote machine using the Invoke-AtomicTest function with a PowerShell session.

```powershell
# Install any required prerequisites on the remote machine before test execution
Invoke-AtomicTest T1218.010 -Session $sess -GetPrereqs

# execute all atomic tests in technique T1218.010 on a remote machine
Invoke-AtomicTest T1218.010 -Session $sess
```

--------------------------------

### Count Atomic Tests per Platform

Source: https://github.com/redcanaryco/invoke-atomicredteam/wiki/Iterate-through-Atomic-Tests-Programmatically

This script counts the number of Atomic Red Team tests available for Windows, Linux, macOS, and Cloud/Container platforms. It iterates through all `.yaml` files in the specified atomics directory, retrieves the technique details, and checks the `supported_platforms` property for each atomic test.

```PowerShell
$path = "C:\AtomicRedTeam\atomics\*"  # set this to point to your atomics folder
$techniques = gci $path -Recurse -Include T*.yaml | Get-AtomicTechnique

$windows = $linux = $macos = $cloud = 0
foreach ($technique in $techniques) {
    foreach ($atomic in $technique.atomic_tests) {
        if ($atomic.supported_platforms.contains("windows")) {
            $windows = $windows + 1
        }
        if ($atomic.supported_platforms.contains("linux")) {
            $linux = $linux + 1
        }
        if ($atomic.supported_platforms.contains("macos")) {
            $macos = $macos + 1
        }
        if (-not ($atomic.supported_platforms.contains("windows") -or $atomic.supported_platforms.contains("linux") -or $atomic.supported_platforms.contains("macos"))) {
            $cloud = $cloud + 1
        }
    }
}
Write-Host -ForegroundColor Cyan "Windows Tests: $windows"
Write-Host -ForegroundColor Green "  Linux Tests: $linux"
Write-Host -ForegroundColor Yellow "  macOS Tests: $macos"
Write-Host -ForegroundColor Magenta "  Cloud/Container Tests: $cloud"
```

--------------------------------

### Import Invoke-AtomicRedTeam Module

Source: https://github.com/redcanaryco/invoke-atomicredteam/wiki/Import-the-Module

Manually imports the Invoke-AtomicRedTeam PowerShell module into the current session. This command is necessary if the module was not automatically loaded or if starting a new PowerShell session. Adjust the path if AtomicRedTeam was installed elsewhere.

```powershell
Import-Module "C:\AtomicRedTeam\invoke-atomicredteam\Invoke-AtomicRedTeam.psd1" -Force
```

--------------------------------

### Install and Configure Pre-commit Hooks

Source: https://github.com/redcanaryco/invoke-atomicredteam/blob/master/README.md

Installs and configures pre-commit hooks for ensuring proper byte order marks (BOM) in PowerShell files. These hooks are automatically triggered before committing code to ensure consistent formatting and adherence to best practices.

```shell
pip3 install pre-commit
pre-commit install
pre-commit install-hooks
```

--------------------------------

### WinEvent Logger Configuration

Source: https://github.com/redcanaryco/invoke-atomicredteam/wiki/Execution-Logging

Illustrates how to log execution details directly to the Windows Event Log under the 'Atomic Red Team' channel. It requires administrator privileges for initial setup to create the log.

```powershell
Invoke-AtomicTest T1016 -LoggingModule "WinEvent-ExecutionLogger"
```

--------------------------------

### Run Invoke-AtomicRedTeam Docker Image

Source: https://github.com/redcanaryco/invoke-atomicredteam/wiki/Docker-Containers

This command pulls the latest Invoke-AtomicRedTeam Docker image and runs it interactively. It's the simplest way to start using the tool within a containerized environment.

```sh
docker run -it redcanary/invoke-atomicredteam:latest
```

--------------------------------

### Export Elevation-Required Atomic Tests to CSV

Source: https://github.com/redcanaryco/invoke-atomicredteam/wiki/Iterate-through-Atomic-Tests-Programmatically

This script identifies all Atomic Red Team tests that require administrative elevation and exports their Technique, Test Name, and GUID to a CSV file named 'AtomicsRequiringAdmin.csv'. It iterates through all tests, checks the `elevation_required` property of the executor, and appends matching tests to the CSV.

```PowerShell
$path = "C:\AtomicRedTeam\atomics\*"  # Set this to point to your atomics folder
$techniques = Get-ChildItem $path -Recurse -Include T*.yaml | Get-AtomicTechnique
$csvFile =  "AtomicsRequiringAdmin.csv"
remove-item $csvFile -Force -ErrorAction Ignore
foreach ($technique in $techniques) {
    foreach ($atomic in $technique.atomic_tests) {
        if ($atomic.executor.elevation_required ) {
            $details = [PSCustomObject][ordered]@{ 
                "Technique"              = $technique.attack_technique[0]
                "Test Name"              = $atomic.name
                "GUID"                   = $atomic.auto_generated_guid
            } 
            $details | Export-Csv -Path $csvFile -NoTypeInformation -Append
            Write-Host -Fore Green $details
        }
    }
}
```

--------------------------------

### Establish PowerShell Session (Windows to Windows)

Source: https://github.com/redcanaryco/invoke-atomicredteam/wiki/Execute-Atomic-Tests-(Remote)

Example of establishing a PowerShell Remoting session from a Windows machine to another Windows machine, a prerequisite for remote test execution.

```powershell
# Example of establishing a PowerShell session (replace with actual session establishment command)
# $sess = New-PSSession -ComputerName <RemoteComputerName> -Credential (Get-Credential)
```

--------------------------------

### Execute Specific Attacks by Atomic Test GUID

Source: https://github.com/redcanaryco/invoke-atomicredteam/wiki/Execute-Atomic-Tests-(Local)

Explains how to execute atomic tests using their globally unique identifiers (GUIDs). This is recommended for scripting as GUIDs are guaranteed not to change.

```powershell
Invoke-AtomicTest T1003 -TestGuids 5c2571d0-1572-416d-9676-812e64ca9f44,66fb0bc1-3c3f-47e9-a298-550ecfefacbc
```

--------------------------------

### Launch Invoke-AtomicRedTeam in Windows Sandbox

Source: https://github.com/redcanaryco/invoke-atomicredteam/wiki/Windows-Sandbox

This snippet describes the process of launching Invoke-AtomicRedTeam within a Windows Sandbox environment. It involves downloading a WSB file and opening it to initiate the sandbox, providing a clean environment for testing security atomics without impacting the host system.

```Windows Sandbox
Download the WSB file from: https://github.com/redcanaryco/invoke-atomicredteam/blob/master/sandbox/art.wsb

Open the downloaded art.wsb file from your File Explorer to launch the Windows Sandbox environment.
```

--------------------------------

### List Atomic Tests with Full Details

Source: https://github.com/redcanaryco/invoke-atomicredteam/wiki/List-Atomic-Tests

Shows full details for atomic tests, including attack commands, input parameters, and prerequisites for a given technique number. Supports filtering by current platform or all platforms.

```powershell
# List atomic tests that can be run from the current platform (Windows,Linux,macOS)
Invoke-AtomicTest T1003 -ShowDetails

# List all atomic tests regardless of which platform it can be executed from
Invoke-AtomicTest T1003 -ShowDetails -anyOS
```

--------------------------------

### Invoke-ARTPreAtomicHook Function

Source: https://github.com/redcanaryco/invoke-atomicredteam/wiki/Execution-Hooks

This function is executed before an atomic test begins its execution. It allows for pre-execution setup or checks.

```powershell
function Invoke-ARTPreAtomicHook {
    [CmdletBinding()]
    param(
        [Parameter(Mandatory=$true)]
        [string]$AtomicTestName,
        [Parameter(Mandatory=$true)]
        [string]$AtomicTestPath
    )

    Write-Host "Executing pre-atomic hook for test: $AtomicTestName"
    # Add your pre-execution logic here
}

```

--------------------------------

### List Atomic Tests Briefly

Source: https://github.com/redcanaryco/invoke-atomicredteam/wiki/List-Atomic-Tests

Lists available atomic tests for a given technique number with brief details. Supports filtering by current platform or all platforms.

```powershell
# List atomic tests that can be run from the current platform (Windows,Linux,macOS)
Invoke-AtomicTest T1003 -ShowDetailsBrief

# List all atomic tests regardless of which platform it can be executed from
Invoke-AtomicTest T1003 -ShowDetailsBrief -anyOS
```

```powershell
# List atomic tests that can be run from the current platform (Windows,Linux,macOS)
Invoke-AtomicTest All -ShowDetailsBrief

# List all atomic tests regardless of which platform it can be executed from
Invoke-AtomicTest -ShowDetailsBrief -anyOS
```

--------------------------------

### Build and Run Custom Invoke-AtomicRedTeam Docker Image

Source: https://github.com/redcanaryco/invoke-atomicredteam/wiki/Docker-Containers

These commands demonstrate how to clone the Invoke-AtomicRedTeam repository, build a custom Docker image locally from a modified Dockerfile, and then run the custom image interactively. This is useful for adding specific dependencies or configurations.

```sh
git clone https://github.com/redcanaryco/invoke-atomicredteam.git
cd invoke-atomicredteam/docker
# edit Dockerfile
docker build -t invoke-atomicredteam:latest .
docker run -it invoke-atomicredteam:latest
```

--------------------------------

### Uninstall powershell-yaml Module

Source: https://github.com/redcanaryco/invoke-atomicredteam/wiki/Uninstallation

Commands to uninstall the 'powershell-yaml' module, which is installed with Invoke-AtomicRedTeam. Separate commands are provided for Windows and macOS/Linux.

```powershell
powershell -NoProfile -Command "Uninstall-Module powershell-yaml" # this is for Windows
```

```powershell
pwsh -NoProfile -Command "Uninstall-Module powershell-yaml" # this is for macOS/Linux
```

--------------------------------

### Execute All Attacks for a Given Technique

Source: https://github.com/redcanaryco/invoke-atomicredteam/wiki/Execute-Atomic-Tests-(Local)

Demonstrates how to run all available atomic tests associated with a specific technique by simply providing the technique ID.

```powershell
Invoke-AtomicTest T1218.010
```

--------------------------------

### Configure PowerShell Profile for Automatic Import and Default Path

Source: https://github.com/redcanaryco/invoke-atomicredteam/wiki/Import-the-Module

Adds the Invoke-AtomicRedTeam module import to the PowerShell profile script, ensuring it's loaded automatically on startup. It also sets a default value for the `PathToAtomicsFolder` parameter, simplifying the use of `Invoke-AtomicTest` by specifying the location of the Atomic Red Team tests.

```powershell
Import-Module "C:\AtomicRedTeam\invoke-atomicredteam\Invoke-AtomicRedTeam.psd1" -Force
$PSDefaultParameterValues = @{"Invoke-AtomicTest:PathToAtomicsFolder"="C:\AtomicRedTeam\atomics"}
```

--------------------------------

### Execute All Automated Windows Atomics with Prereqs and Cleanup

Source: https://github.com/redcanaryco/invoke-atomicredteam/wiki/Execute-Atomic-Tests-(Local)

Provides a PowerShell script to iterate through all automated Windows atomic tests, executing them sequentially with prerequisite checks and cleanup steps.

```powershell
$techniques = gci C:\AtomicRedTeam\atomics\* -Recurse -Include T*.yaml | Get-AtomicTechnique

foreach ($technique in $techniques) {
    foreach ($atomic in $technique.atomic_tests) {
        if ($atomic.supported_platforms.contains("windows") -and ($atomic.executor -ne "manual")) {
            # Get Prereqs for test
            Invoke-AtomicTest $technique.attack_technique -TestGuids $atomic.auto_generated_guid -GetPrereqs
            # Invoke
            Invoke-AtomicTest $technique.attack_technique -TestGuids $atomic.auto_generated_guid
            # Sleep then cleanup
            Start-Sleep 3
            Invoke-AtomicTest  $technique.attack_technique -TestGuids $atomic.auto_generated_guid -Cleanup
        }
    }
}
```

--------------------------------

### Attire Logger Configuration

Source: https://github.com/redcanaryco/invoke-atomicredteam/wiki/Execution-Logging

Demonstrates how to use the Attire logger to output execution details in JSON format, suitable for tools like Vectr. It covers specifying the logging module, setting the execution log path, and using a timestamp for unique log file names.

```powershell
Invoke-AtomicTest T1016 -LoggingModule "Attire-ExecutionLogger" -ExecutionLogPath T1016-Windows.json
```

```powershell
Invoke-AtomicTest T1016 -LoggingModule "Attire-ExecutionLogger" -ExecutionLogPath "timestamp.json"
```

```powershell
$PSDefaultParameterValues = @{"Invoke-AtomicTest:LoggingModule"="Attire-ExecutionLogger"}
```

--------------------------------

### Execute All Tests from a Specific Directory

Source: https://github.com/redcanaryco/invoke-atomicredteam/wiki/Execute-Atomic-Tests-(Local)

Demonstrates how to execute all atomic tests by specifying a custom path to the atomics folder using the `-PathToAtomicsFolder` parameter.

```powershell
Invoke-AtomicTest All -PathToAtomicsFolder C:\AtomicRedTeam\atomics
```

--------------------------------

### Execute Atomic Tests from CSV Schedule

Source: https://github.com/redcanaryco/invoke-atomicredteam/wiki/Adversary-Emulation

Demonstrates how to execute Atomic Red Team tests sequentially using a CSV file. The script supports listing test details, running prerequisites, executing tests, and performing cleanup operations.

```powershell
# List the name of each enabled test on the schedule (IcedID.csv in the current directory)
Invoke-AtomicRunner -listOfAtomics .\IcedID.csv -ShowDetailsBrief
```

```powershell
# Run the get-prereq commands for each enabled test on the schedule
Invoke-AtomicRunner -listOfAtomics .\IcedID.csv -GetPrereqs
```

```powershell
# Run each of the atomic tests on the schedule
Invoke-AtomicRunner -listOfAtomics .\IcedID.csv
```

```powershell
# Run each of the cleanup commands for each of the atomic tests on the schedule
Invoke-AtomicRunner -listOfAtomics .\IcedID.csv -Cleanup
```

--------------------------------

### New-AtomicTechnique Function

Source: https://github.com/redcanaryco/invoke-atomicredteam/wiki/New-Atomic*-Technique-Test-Creation-Functions

Defines a new Atomic Red Team technique. The output is formatted for piping to ConvertTo-Yaml, enabling direct YAML generation without manual editing.

```PowerShell
New-AtomicTechnique
```

--------------------------------

### New-AtomicTest Function

Source: https://github.com/redcanaryco/invoke-atomicredteam/wiki/New-Atomic*-Technique-Test-Creation-Functions

Specifies the name of a test that demonstrates how to execute a technique. This function is part of the Invoke-AtomicRedTeam module for building atomic tests.

```PowerShell
New-AtomicTest
```

--------------------------------

### Execute Specific Attacks by Atomic Test Number

Source: https://github.com/redcanaryco/invoke-atomicredteam/wiki/Execute-Atomic-Tests-(Local)

Demonstrates how to run specific atomic tests for a given technique using their test numbers. Supports both numeric and hyphenated formats.

```powershell
Invoke-AtomicTest T1218.010 -TestNumbers 1,2
# or using the short form ..
Invoke-AtomicTest T1218.010-1,2
```

--------------------------------

### Specify Alternate Execution Log Path

Source: https://github.com/redcanaryco/invoke-atomicredteam/wiki/Execution-Logging

Demonstrates how to use the -ExecutionLogPath parameter to write the execution log to a custom file location. The execution log records test details but not screen output.

```powershell
Invoke-AtomicTest T1218.010 -ExecutionLogPath 'C:\Temp\mylog.csv'
```

--------------------------------

### Execute Specific Attacks by Atomic Test Name

Source: https://github.com/redcanaryco/invoke-atomicredteam/wiki/Execute-Atomic-Tests-(Local)

Illustrates running specific atomic tests for a technique by providing their descriptive names. This method is useful for clarity when the test numbers might change.

```powershell
Invoke-AtomicTest T1218.010 -TestNames "Regsvr32 remote COM scriptlet execution","Regsvr32 local DLL execution"
```

--------------------------------

### Execute Tests Interactively

Source: https://github.com/redcanaryco/invoke-atomicredteam/wiki/Execute-Atomic-Tests-(Local)

Explains how to run tests interactively using the `-Interactive` flag, allowing user input during execution. Note that output redirection is not possible with this flag.

```powershell
Invoke-AtomicTest T1003 -Interactive
```

--------------------------------

### Check Prerequisites for Atomic Tests

Source: https://github.com/redcanaryco/invoke-atomicredteam/wiki/Check-or-Get-Prerequisites-for-Atomic-Tests

Checks if the system meets the prerequisites for a specific atomic test or all tests within a technique. Use '-CheckPrereqs' before execution. Output may indicate elevation requirements.

```powershell
Invoke-AtomicTest T1003 -TestName "Windows Credential Editor" -CheckPrereqs
```

```powershell
Invoke-AtomicTest T1003 -CheckPrereqs
```

--------------------------------

### View Execution Log with PowerShell

Source: https://github.com/redcanaryco/invoke-atomicredteam/wiki/Execution-Logging

Provides PowerShell commands to view the contents of the execution log file. It shows how to import the CSV data and display it in a grid view on Windows or format it on Linux.

```powershell
Import-Csv $env:TEMP\Invoke-AtomicTest-ExecutionLog.csv | Out-GridView # Windows
```

```powershell
Import-Csv /tmp/Invoke-AtomicTest-ExecutionLog.csv | FT # Linux
```

--------------------------------

### Invoke-WebRequestVerifyHash Function

Source: https://github.com/redcanaryco/invoke-atomicredteam/wiki/Check-or-Get-Prerequisites-for-Atomic-Tests

Downloads a file from a URL and saves it to a specified path only if its SHA256 hash matches the provided value. Returns true on success, false otherwise. Requires the module to be imported.

```powershell
Invoke-WebRequestVerifyHash $url $outfile $hash
```

--------------------------------

### Invoke-AtomicTest Function Signature

Source: https://github.com/redcanaryco/invoke-atomicredteam/wiki/Execute-Atomic-Tests-(Local)

Provides the core API documentation for the Invoke-AtomicTest function, detailing its parameters and their usage for executing Atomic Red Team tests.

```APIDOC
Invoke-AtomicTest:
  Runs an atomic test on the system.

  Parameters:
    - TestNumbers (string[]): The numbers of the atomic tests to run for a given technique.
    - TestNames (string[]): The names of the atomic tests to run for a given technique.
    - TestGuids (string[]): The GUIDs of the atomic tests to run for a given technique.
    - PathToAtomicsFolder (string): Overrides the default path to the atomics folder.
    - TimeoutSeconds (int): Specifies the timeout in seconds for test execution. Defaults to 120.
    - Interactive (switch): Executes tests in an interactive mode, allowing user input.
    - GetPrereqs (switch): Retrieves the prerequisites for the specified atomic test(s).
    - Cleanup (switch): Executes the cleanup steps for the specified atomic test(s).
    - All (switch): Executes all atomic tests found in the atomics folder.

  Examples:
    Invoke-AtomicTest T1218.010 -TestNumbers 1,2
    Invoke-AtomicTest T1003 -TestGuids 5c2571d0-1572-416d-9676-812e64ca9f44
    Invoke-AtomicTest T1218.010 -TimeoutSeconds 15
    Invoke-AtomicTest T1003 -Interactive
    Invoke-AtomicTest All -PathToAtomicsFolder C:\AtomicRedTeam\atomics
```

--------------------------------

### Redirect Test Execution Output to File

Source: https://github.com/redcanaryco/invoke-atomicredteam/wiki/Execution-Logging

Illustrates how to capture the full command input and output from test executions using PowerShell's redirection and Tee-Object cmdlets. This is particularly useful when not using the Attire Logger.

```powershell
Invoke-AtomicTest T1027 -TestNumbers 2 *>&1 | Tee-Object atomic-out.txt -Append
```

```powershell
Invoke-AtomicTest T1027  -TestNumbers 2 2>>atomic-error.txt | Tee-Object atomic-out.txt -Append
```

--------------------------------

### Generate and Configure CSV Schedule

Source: https://github.com/redcanaryco/invoke-atomicredteam/wiki/Adversary-Emulation

Details how to create a new CSV schedule file using Invoke-GenerateNewSchedule. It explains the structure of the CSV file, including columns for Order, TimeoutSeconds, InputArgs, and Notes, and where the default schedule file is located.

```powershell
Invoke-GenerateNewSchedule
```

--------------------------------

### Invoke-WebRequestVerifyHash Usage

Source: https://github.com/redcanaryco/invoke-atomicredteam/wiki/Invoke-WebRequestVerifyHash

Demonstrates how to use the Invoke-WebRequestVerifyHash function to download a file and verify its SHA256 hash. The function returns a boolean indicating success or failure.

```powershell
Invoke-WebRequestVerifyHash $url $outfile $hash
```

--------------------------------

### Establish PowerShell Session (Windows to Remote)

Source: https://github.com/redcanaryco/invoke-atomicredteam/wiki/Execute-Atomic-Tests-(Remote)

Establishes a PowerShell remoting session from a local Windows machine to a remote computer. Requires administrative credentials on the remote machine. Authentication is typically done via password prompt, or can use key-based authentication with `-KeyFilePath`.

```PowerShell
$sess = New-PSSession -ComputerName testcomputer -Credential domain\username
```

--------------------------------

### Set Confirmation Preference

Source: https://github.com/redcanaryco/invoke-atomicredteam/wiki/Execute-Atomic-Tests-(Local)

This snippet shows how to set the PowerShell confirmation preference to 'Medium'. This affects how Invoke-AtomicTeam and other cmdlets handle confirmation prompts, allowing tests to run with less interaction.

```powershell
$ConfirmPreference = 'Medium'
Invoke-AtomicTest All
```

--------------------------------

### Syslog Logger Configuration

Source: https://github.com/redcanaryco/invoke-atomicredteam/wiki/Execution-Logging

Shows how to configure Invoke-AtomicTeam to send execution logs directly to a Syslog server. This involves setting the LoggingModule to 'Syslog-ExecutionLogger' and configuring server details via privateConfig.ps1.

```powershell
Invoke-AtomicTest T1016 -LoggingModule "Syslog-ExecutionLogger"
```