From Simulation to Detection: Fileless PowerShell & Mimikatz Attacks using Atomic Red Team (MITRE ATT&CK T1059.001, T1003, T1566.001).

Atomic Red Team is an open-source adversary simulation framework developed by Red Canary, built on the MITRE ATT&CK framework. It enables security teams to safely emulate attack techniques and improve detection through hands-on testing.

Environment Setup on Windows:

• A Windows-based lab environment was configured with administrative privileges to simulate real-world attack scenarios safely.
• Sysmon was installed to provide enhanced visibility into system activity, including process creation, file events, and network connections.
• Atomic Red Team was deployed to simulate adversary techniques mapped to the MITRE ATT&CK framework.
• PowerShell was used to execute atomic tests and emulate fileless attack techniques.
• The environment generated detailed telemetry suitable for threat detection and analysis.
• Sysmon logs can be forwarded to a SIEM solution (e.g., Elastic, Splunk) for centralized monitoring and correlation.

you can install Atomic red team like that https://www.google.com.eg/url?sa=t&rct=j&q=&esrc=s&source=web&cd=&ved=2ahUKEwit9vXG2uyTAxXwVqQEHR-AK_8QFnoECBwQAQ&url=https%3A%2F%2Fredcanary.com%2Fgetting-started-with-atomic-red-team%2F&usg=AOvVaw1HirZ9gLBmc6r3C5c2-YfV&opi=89978449)

— — — — — — — — — — — — — — — — — — — — — — — — — — — — — — — — — — — — — —

To better understand real-world adversary behavior, I conducted an attack simulation using Atomic Red Team in a controlled lab environment.

The simulation focused on replicating multiple MITRE ATT&CK techniques, starting with T1566.001 (Spearphishing Attachment) to emulate initial access.

After the initial stage, I executed T1059.001 (PowerShell Execution) to simulate fileless command execution using PowerShell, leveraging techniques such as IEX and DownloadString to run scripts directly in memory.

Finally, the simulation included T1003 (Credential Dumping) by executing Mimikatz to extract credentials from the system.

This end-to-end simulation provided a realistic view of how attackers move from initial access to credential theft, allowing for deeper analysis and detection development.

The Get-Help Invoke-AtomicTest command was used to understand how to run Atomic Red Team tests and explore available options before starting the simulation.

— — — — — — — — — — — — — — — — — — — -

The First Mitre technique we will simulate .

— — — — — — — — — — — — — — — —

The Invoke-AtomicTest T1566.001 -ShowDetails command was used to view detailed information about the phishing simulation tests, including the attack commands, execution method, and cleanup steps, before running the actual simulation.

The command Invoke-AtomicTest T1566.001 -TestNumbers 1 -cleanup was used to remove any artifacts from the previous test, followed by executing Invoke-AtomicTest T1566.001 -TestNumbers 1 to run the phishing simulation successfull.

— — — — — — — — — — — — —

Then , navigate to sysmon logs :

Sysmon Log Analysis (Event ID 1)

The log shows a process creation event (Sysmon Event ID 1) where PowerShell was executed to download files from a local source.

The command line reveals the use of Invoke-WebRequest to download a phishing attachment (.xlsm) and a text file into the temporary directory, simulating a phishing attack scenario.

IOCs List:

• Process Name: powershell.exe
  Indicates the use of PowerShell which is commonly abused by attackers
• Command: Invoke-WebRequest
  Used to download files which may indicate malicious activity
• URLs: http://localhost/PhishingAttachment.xlsm , http://localhost/PhishingAttachment.txt
  Represents the source of downloaded files and simulates attack behavior
• File Names: PhishingAttachment.xlsm , PhishingAttachment.txt
  The .xlsm file is macro enabled and may contain malicious code
• File Path: C:\Users\Administrator\AppData\Local\Temp\
  Temporary directories are commonly used to store malicious payloads
• User: ATOMIC\Administrator
  Shows execution with administrative privileges
• Integrity Level: High
  Indicates elevated privileges and higher risk
• Parent Process: powershell.exe

— — — — — — — — — — — — — — — — — — — -

based on the extracted IOCs from the Sysmon logs, a Sigma rule was created to detect suspicious PowerShell activity.

The rule focuses on identifying the use of Invoke-WebRequest along with the specific URL used to download the phishing file, as well as monitoring file creation events for the downloaded .xlsm file.

— — — — — — — — — — — — — — — — — — — — -

The Second MITRE Technique :

— — — — — — — — — — — — -

The Invoke-AtomicTest T1059.001 -ShowDetails command was used to display details of PowerShell-based attack simulations, including Mimikatz execution and credential dumping.

Get Mohamed Elfayoumy’s stories in your inbox

Join Medium for free to get updates from this writer.

Remember me for faster sign in

The output shows how PowerShell can be used to download and execute malicious scripts, simulating real-world techniques such as fileless execution and credential acceses.

— — — — — — — — — — — — — — — — — — — —

This log shows a Sysmon Event ID 1 where a command prompt (cmd.exe) executed PowerShell to download and run a script from GitHub using IEX and DownloadString.

The command attempts to execute Mimikatz for credential dumping, which indicates a fileless attack technique and suspicious use of PowerShell for malicious activity.

IOCs List:

• process Chain: cmd.exe → powershell.exe
  Indicates suspicious execution flow where Command Prompt launches PowerShell
• Command Execution: powershell.exe
  PowerShell is commonly abused for fileless attacks
• Suspicious Command: IEX (Invoke-Expression)
  Executes downloaded code directly in memory (fileless execution)
• Download Method: DownloadString
  Used to retrieve remote scripts without saving them to disk
• External URL: https://raw.githubusercontent.com/.../Invoke-Mimikatz.ps1
  Indicates downloading a potentially malicious script from an external source
• Tool Usage: Invoke-Mimikatz
  Strong indicator of credential dumping activity
• Suspicious Argument: DumpCreds
  مرتبط مباشرة بمحاولة استخراج credentials
• Execution Directory: C:\Users\Administrator\AppData\Local\Temp\
  Temporary directories are commonly used during attacks
• User Context: ATOMIC\Administrator
  Execution with administrative privileges increases attack impact
• Integrity Level: High
  Indicates elevated privileges
• Parent Process: cmd.exe

— — — — — — — — — — — — — — — — —

Then Creating My Sigma rule :

The second payload :

Sigma rule based on this :

another sigma rule

and this a correlation rule for this Technique.

— — — — — — — — — — — — — — — — — — — — — — — — — — — — — — — — —

Conclusion

In this project, I simulated real-world attack techniques using Atomic Red Team and analyzed Sysmon logs to understand how fileless PowerShell attacks and credential dumping activities appear in a system.

By extracting key indicators of compromise and building Sigma rules, I was able to develop a practical detection approach for identifying suspicious behavior such as IEX execution, remote script downloads, and Mimikatz usage.

This detection logic can be integrated into a SIEM solution such as Elastic or Splunk, enabling centralized monitoring, correlation, and real-time alerting across multiple systems.

Throughout this project, I gained hands-on experience in attack simulation, log analysis, and detection engineering, as well as a deeper understanding of how adversaries abuse legitimate tools like PowerShell to evade detection.

Overall, this work highlights the importance of combining adversary simulation with SIEM-based monitoring to enhance visibility and improve threat detection capabilities in a real-world SOC environment

References:

• Atomic Red Team
  https://github.com/redcanaryco/atomic-red-team
• MITRE ATT&CK
  https://attack.mitre.org/
• Sysmon
  https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon
• Sigma
  https://sigmahq.io/
• PowerSploit (Mimikatz)
  https://github.com/PowerShellMafia/PowerSploit

(إن أحسنتُ فمن الله، وإن أسأتُ فمن نفسي والشيطان)