Caldera emulation abilities
67 runnable adversary-emulation actions · command + platform · mapped to ATT&CK
All tactics
build-capabilities · 1 collection · 16 command-and-control · 6 credential-access · 10 defense-evasion · 15 detection · 8 discovery · 67 execution · 9 exfiltration · 13 hunt · 4 impact · 8 lateral-movement · 10 persistence · 3 privilege-escalation · 8 response · 14 setup · 10 technical-information-gathering · 1 training · 6 verification · 2
⚠
Abilities
17 shown of 67Print Working Directory
Print the current working directory on the system
Show command
[{"platform": "darwin", "executor": "sh", "command": "pwd\n"}, {"platform": "linux", "executor": "sh", "command": "pwd\n"}, {"platform": "windows", "executor": "psh", "command": "pwd\n"}]Query Registry
Query Registry using PowerShell Get-ItemProperty
Show command
[{"platform": "windows", "executor": "psh", "command": "Get-ItemProperty -Path HKLM:\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\n"}]Remote Host Ping
Ping a remote host to see if it is accessible
Show command
[{"platform": "windows", "executor": "psh", "command": "ping #{remote.host.fqdn}\n"}]Reverse nslookup IP
Find hostname of remote IP in domain
Show command
[{"platform": "windows", "executor": "psh", "command": "nslookup #{remote.host.ip}\n"}]Scan IP for ports
Use dropped scanner to find open popular ports
Show command
[{"platform": "darwin", "executor": "sh", "command": "python3 scanner.py -i #{remote.host.ip}\n"}, {"platform": "linux", "executor": "sh", "command": "python3 scanner.py -i #{remote.host.ip}\n"}]Scan WIFI networks
View all potential WIFI networks on host
Show command
[{"platform": "darwin", "executor": "sh", "command": "./#{payload:9f639067-370a-40ba-b7ac-6f1c15d5a158} scan\n"}, {"platform": "linux", "executor": "sh", "command": "./#{payload:9f639067-370a-40ba-b7ac-6f1c15d5a158} scan\n"}, {"platform": "windows", "executor": "psh", "command": ".\\#{payload:28f9bf43-4f14-4965-9bd9-b70fd6993d8e} -Scan\n"}]Snag broadcast IP
Capture the local network broadcast IP address
Show command
[{"platform": "darwin", "executor": "sh", "command": "ifconfig | grep broadcast"}]System processes
Identify system processes
Show command
[{"platform": "windows", "executor": "psh", "command": "Get-Process"}, {"platform": "windows", "executor": "cmd", "command": "tasklist"}, {"platform": "windows", "executor": "donut_amd64", "command": ""}, {"platform": "darwin", "executor": "sh", "command": "ps aux"}, {"platform": "linux", "executor": "sh", "command": "ps aux"}]UAC Status
Determine whether or not UAC is enabled
Show command
[{"platform": "windows", "executor": "psh,pwsh", "command": "echo $(get-uac)\n"}]USB Connected Device Discovery
find attached usb devices
Show command
[{"platform": "darwin", "executor": "sh", "command": "system_profiler SPUSBDataType\n"}]View Processes
Display information about current system processes
Show command
[{"platform": "darwin", "executor": "sh", "command": "ps\n"}, {"platform": "linux", "executor": "sh", "command": "ps\n"}, {"platform": "windows", "executor": "psh", "command": "get-process\n"}]View admin shares
Network Share Discovery
Show command
[{"platform": "windows", "executor": "pwsh,psh", "command": "Get-SmbShare | ConvertTo-Json"}]View printer queue
View details of queued documents in printer queue
Show command
[{"platform": "darwin", "executor": "sh", "command": "lpq -a"}, {"platform": "linux", "executor": "sh", "command": "lpq -a"}]View remote shares
View the shares of a remote host
Show command
[{"platform": "windows", "executor": "psh", "command": "net view \\\\#{remote.host.fqdn} /all"}, {"platform": "windows", "executor": "cmd", "command": "net view \\\\#{remote.host.fqdn} /all"}]Virtual or Real
Determine if the system is virtualized or physical
Show command
[{"platform": "windows", "executor": "psh", "command": "get-wmiobject win32_computersystem | fl model\n"}]enumerate VMs
Enumerate running virtual machines on hypervisor
Show command
[{"platform": "linux", "executor": "sh", "command": "acrnctl list\n"}]tasklist Process Enumeration
Capture running processes and their loaded DLLs
Show command
[{"platform": "windows", "executor": "psh", "command": "tasklist /m >> $env:APPDATA\\vmtool.log;\ncat $env:APPDATA\\vmtool.log\n"}]Showing 51-67 of 67