Atomic Red T1105

Invoke-AtomicTest T1105

Executes the T1105 tool transfer atomic test with Atomic Red Team, validating detection of the payload download.

Run it in the purple team lab when you want to validate detection of tool downloads: the T1105 atomic replicates the transfer (payload download from the server) and the team checks what was detected — the proxy, the SIEM rule (binary download), the EDR. It's the validation of Ingress Tool Transfer detection: the phase where the attacker brings their tools to the host. In purple teaming, the atomic validates download rules and the result feeds the matrix.

Do not run it in production: the download generates real traffic — the lab is the place. And note: the atomic validates the HTTP (or SMB) download variant — alternative channels have other atomics; coverage is validated per channel. Proxy detection (the destination) and EDR detection (the downloaded binary) are the validated layers. The atomic's local server (the payload to download) is part of the test. Detection of the downloaded binary by the EDR (hash, subsequent execution) is the layer that closes the loop.