darmado/atomic-red-team-c2ARTi-C2 is a post-exploitation framework used to execute Atomic Red Team test cases with rapid payload deployment and execution capabilities via .NET's DLR.
ARTC2 is a modern execution framework that helps security teams scale attack scenario execution from single and multi-breach point targets. It intends to produce actionable attack intel that improves the effectiveness of security products and incident response.
ARTC2 Core features and capabilities are sourced from SILENTTRINITY, and atomic tests executed through Boo are from ATOMIC-RED-TEAM. All other feature enhancements were built to ensure operational trade-craft, agility, scalability, and rapid execution are not compromised.
| CAPABILITY | DESCRIPTION |
|---|---|
| Rapid Deployment | Automate and scale testing efforts from single and multi-target breach points located in different regional environments |
| Modern Command & Control | Implant and Server Comms: Uses SILENTRINITY's ECDHE Encrypted C2 Communication capabilities to encrypt C2 traffic over HTTPS. Client and Server Comms: Uses Asyncio, WebSockets, and a prompt-toolkit CLI. Notable features include: - Implant location tagging: Helpful when managing signals and breakpoints in different regions. NGROK integration - Great for staging payloads and deploying them with ngrok URLs |
| Standard Signature Header | JSON PID: , Date(UTC), IsHighIntegrity, HostName, CurrentUser , IsUserAdmin, IPv4, IPv6 |
| JSON Logging Support | Streamline, ingest, decode, and analyze evidence with your ELK stack or any Analytics platform ready to parse JSON. |
| Stageless in Memory Code Execution | Execute Atomic Red Team tests from an unmanaged PowerShell process with low, medium, and high integrity. |
| Dynamic Attack Formations | Execute attack chains without recompiling or restart ARTC2. Currently supports three different attack functions. Attack Chains, Attack Profiles, and Attack Scenarios |
| Modular Payload Delivery | ARTC2 leverages SILENTRINITY's framework uses unmanaged powershell and stageless powershell stagers to compile and execute Red Team Atomic test payloads in memory, "AS IS" |
| Operational Management | Job IDs are included for controller execution and evidence collection. They're great for event analysis and evidence correlation. "job_id": "D3l820IWpyi67" |
Organizations need to:
By default, ARTIC-C2 logs are written to ARTIC-C2's current working directory in ./logs/.
Session logs include:
utc_timestamp: UTC timestampsession: Target session GUIDjob_id: Unique Job execution IDttp_data: Technique IDevidence: Base64 encoded evidence collected from a breach point targetevidence_status: Status to indicate if the TTP executed was blocked.
EXECUTION SIGNATURE HEADER
Execution signature headers are used to verify if any defenses block atomics. Sometimes, the atomic commands may not return data in STDOUT. However, if the execution signature header returns header information, then this indicates the source code compiled, loaded into the CLR, and executed on the target breach point. The execution signature header includes:
PID: used during technique executionDate: UTC stamp produced from the breach point targetIsHighIntegrity: Process integrity statusHostName: breach point target hostnameCurrentUser: Current user. Great for tracking when users are impersonatedIsUserAdmin: Admin statusIPv4: IPv4 address infoIPv6: IPv6 address infoSAMPLE EXECUTION EVENT LOG
T1069.001-2 was executed in memory
2021-08-21 07:42:21,146 - {"utc_timestamp": "2021-08-21T07:42:21Z", "msg": "Technique executed:", "controller": "Discovery/T1069.001-2", "last_updated_by": "ARMADO, Inc.",
"ttp_id": "T1069.001", "ttp_opts": {"OutString": {"Description": "Appends Out-String to the PowerShellCode", "Required": false, "Value": true}, "BypassLogging":
{"Description": "Bypasses ScriptBlock and Techniques logging", "Required": false, "Value": true}, "BypassAmsi": {"Description": "Bypasses AMSI", "Required": false, "Value": true}},
"decompressed_file": "n/a", "file_name": "n/a", "gzip_file": "n/a", "language": "boo", "references": ["System.Management.Automation"], "run_in_thread": "n/a", "job_id": "B5ppBWed5NF6c"}
SAMPLE EVIDENCE COLLECTION LOG
Evidence was collected from the target breach point after executing T1069.001-2.
2021-08-21 07:42:25,076 - {"utc_timestamp": "2021-08-21T07:42:25Z", "session": "17ed378a-8cb9-4690-9087-e894c2b1e0a2", "job_id": "B5ppBWed5NF6c", "ttp_data": "T1069.001", "evidence": "IntQSUQ6IDU1NTYsIERhdGUoVVRDKTogMjAyMS0wOC0yMVQwNzo0MjoyNC45MDczMjQ5WiwgSXNIaWdoSW50ZWdyaXR5OiB0cnVlLCBIb3N0TmFtZTogYWQtZGMxLCBDdXJyZW50VXNlcjogZGVlcHJvb3RcXHJ1c3NlbF9oYW5jb2NrLCBJc1VzZXJBZG1pbjogdHJ1ZSwgSVB2NDogWzEwLjEuMC4xMDAsIDE2OS4yNTQuMTM0LjExMV0sIElQdjY6IFtmZTgwOjpkZGUxOjIyYTo3YmEzOmZlMGIlNSwgZmU4MDo6YjhmODpiNDIxOjI3Yzg6ODY2ZiUxMV19XHJcbk5hbWUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBEZXNjcmlwdGlvbiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIFxyXG4tLS0tICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLS0tLS0tLS0tLS0gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBcclxuQ2VydCBQdWJsaXNoZXJzICAgICAgICAgICAgICAgICAgICAgICAgIE1lbWJlcnMgb2YgdGhpcyBncm91cCBhcmUgcGVybWl0dGVkIHRvIHB1Ymxpc2ggY2VydGlmaWNhdGVzIHRvIHRoZSBkaXJlY3RvcnkgICAgXHJcblJBUyBhbmQgSUFTIFNlcnZlcnMgICAgICAgICAgICAgICAgICAgICBTZXJ2ZXJzIGluIHRoaXMgZ3JvdXAgY2FuIGFjY2VzcyByZW1vdGUgYWNjZXNzIHByb3BlcnRpZXMgb2YgdXNlcnMgICAgICAgICAgICAgIFxyXG5BbGxvd2VkIFJPREMgUGFzc3dvcmQgUmVwbGljYXRpb24gR3JvdXAgTWVtYmVycyBpbiB0aGlzIGdyb3VwIGNhbiBoYXZlIHRoZWlyIHBhc3N3b3JkcyByZXBsaWNhdGVkIHRvIGFsbCByZWFkLW9ubHkgZG8uLi5cclxuRGVuaWVkIFJPREMgUGFzc3dvcmQgUmVwbGljYXRpb24gR3JvdXAgIE1lbWJlcnMgaW4gdGhpcyBncm91cCBjYW5ub3QgaGF2ZSB0aGVpciBwYXNzd29yZHMgcmVwbGljYXRlZCB0byBhbnkgcmVhZC1vbmx5Li4uXHJcbiI=",
"evidence_status": "1"}
SAMPLE HEADER SIGNATURE
"{PID: 5556, Date(UTC): 2020-01-02T06:55:47Z, IsHighIntegrity: true, HostName: ad-dc1, CurrentUser: artic\\c2operator, IsUserAdmin: true,
IPv4: [10.1.0.100, 169.254.134.111], IPv6: [fe80::dde1:22a:7ba3:fe0b%5, fe80::b8f8:b421:27c8:866f%11]}
SAMPLE BASE64 DECODED EVIDENCE LOG