Applications Plugins
Applications are pure installers. Each one drops a piece of software onto a machine — Office, a browser, a dev tool, a C2 server, an ICS simulator — and verifies it landed. They take few or no parameters because the installer just runs.
Available plugins
Section titled “Available plugins”| Plugin | What it does | Params | Uses |
|---|---|---|---|
| Microsoft Office 2016 | Installs Microsoft Office 2016 (32-bit) on Windows. Sets up a 25-day license-rearm scheduled task to keep the trial alive for lab use. | — | 332 |
| Install Visual Studio 2022 | Installs Visual Studio 2022 Community IDE on Windows with a scheduled license-rearm task. | — | 140 |
| Install Notepad ++ | Installs Notepad++ silently and verifies the binary exists in Program Files. | — | 124 |
| Install Google Chrome | Installs Google Chrome on Windows silently and verifies chrome.exe exists in Program Files. | — | 119 |
| Install VLC | Installs VLC Media Player (v3.0.20) on Windows silently and verifies vlc.exe exists. | — | 119 |
| Install Apache | Installs Apache HTTP Server on port 80 — great for general scenarios. If you need a Red Team redirector, use the dedicated redirector plugin instead. | — | 95 |
| Install Keepass | Installs the KeePass password manager on Windows for secure credential storage. | — | 37 |
| Install Linux Docker | Installs Docker and Docker Compose on Linux offline from .deb packages, adds the debian user to the docker group, and reboots. | — | 37 |
| Install NordVPN | Installs the NordVPN client on Windows along with its .NET Framework 4.x dependency. | — | 33 |
| Install Internet Information Services (IIS) | Installs and configures IIS on Windows — enables the IIS-WebServer feature, binds default site to port 80, enables directory browsing, and reboots. | — | 28 |
| Install Tomcat | Installs Apache Tomcat 10.1.18 with Java JDK 17 on Windows, auto-starts the service, and deploys a tomcat-users.xml with the manager-gui role. | username password | 18 |
| Sliver Server Setup (Scenario Based) | Stands up a Sliver server with scenario-friendly defaults to simulate a compromise in an Active Directory domain. Not for live Red Team operations. | UsernameRunningTheServer | 15 |
| Install Visual Studio Code | Installs Visual Studio Code (v1.98.0) on Windows silently and skips the auto-run step. | — | 9 |
| Install Sandcat Implant — Windows | Pre-installs Caldera Sandcat on Windows at build time — drops sandcat.exe at the chosen path, registers a SYSTEM scheduled task at boot, and adds Defender exclusions. | CalderaServerIP ImplantPath ServiceName | 8 |
| Install and Configure WireGuard VPN Server | Installs and configures a WireGuard VPN server with auto-generated client configs, served over HTTP on port 8888 when a 10.1.1.x IP is present. | DomainName WireguardPort ClientCount StaticIP | 7 |
| Install Exchange Server 2019 | Installs Microsoft Exchange Server 2019 CU15 (Mailbox role) on a domain-joined Windows Server, prepares AD schema, creates mailboxes for existing AD users, and seeds realistic email traffic. Takes 1 hour+. | Hostname StaticIP parentFQDN DNSAlias IPGateway IPDNS IPSubnetMask Mailboxes SeedEmails | 7 |
| Install 7-Zip | Installs the 7-Zip file archiver on Windows for compression and extraction. | — | 6 |
| OPC-UA Historian | Runs a python-opcua OPC-UA server on port 4840 that bridges Modbus register values from ICS devices into a browseable OPC-UA node hierarchy. | DeviceList ServerPort AuthMode HistorianUsers EnableWriteAccess | 6 |
| GHOSTS Windows Client | Installs the GHOSTS Windows client agent on a workstation and points it at a GHOSTS server by IP, with Chrome + chromedriver bundled for browser simulation. | GhostsServerIP | 5 |
| Install Apache Tomcat Server (Linux) | Installs Apache Tomcat 10.1 on Linux as a systemd service with the Manager web UI enabled for remote access. | Hostname StaticIP DesiredDomainName TomcatPort ManagerUsername ManagerPassword RunAsRoot | 5 |
| Install Python | Installs Python on Windows to C:\python with InstallAllUsers=1 and AppendPath=1. | — | 5 |
| Install Wireshark | Installs Wireshark and the Npcap packet capture driver on Windows. | — | 5 |
| PCAP Sensor - Windows | Runs rotating packet captures on Windows using built-in pktmon, converts each rotation to .pcapng, and scp-pushes completed files to a PCAP Collector Server. | CollectorIP CollectorPassword CaptureInterface RotateSeconds BPFFilter CollectorUser RingBufferFiles | 5 |
| Install WireGuard Client & Configuration (Linux) | Installs WireGuard on Linux and fetches a client VPN config from the WireGuard server’s HTTP config service. Does not start the tunnel. | WireguardServerIP ConfigSavePath ConfigFileName | 4 |
| Install WireGuard Client and Configuration (Windows) | Installs WireGuard on Windows silently and fetches a client VPN config from the WireGuard server’s HTTP config service. Does not start the tunnel. | WireguardServerIP ConfigFileName ConfigSavePath | 4 |
| PCAP Sensor - Linux | Installs tcpdump on Linux and runs continuous rotating captures as a systemd service, with a cron job that scp-pushes completed pcaps to the PCAP Collector Server. | CaptureInterface CollectorIP CollectorPassword RotateSeconds BPFFilter RetentionFiles CollectorUsername PushIntervalMinutes | 4 |
| Safety Instrumented System (SIS) | Deploys a Python Safety Instrumented System that monitors Modbus process values against safety thresholds and writes emergency shutdown signals on breach — for TRITON/TRISIS-style exercises. | DeviceList ShutdownRegister LogFile ShutdownValue PollIntervalMs ModbusPort ModbusUnitID BreachConfirmCount LatchShutdown | 4 |
| DNP3 Outstation Emulator | Deploys an OpenDNP3-based outstation container responding to DNP3 on TCP port 20000, with each device on its own OT VLAN IP via Docker macvlan. | DeviceList ParentInterface OtSubnetCIDR DNP3MasterIP DockerNetwork OutstationAddressBase UnsolicitedResponses DataSimulationProfile OtGateway | 3 |
| HMI Client - Windows | Installs RapidSCADA 6.4.6 on a Windows workstation and auto-configures Modbus data sources for each device in the list — live web HMI on port 8080. | DeviceList PollIntervalMs RegisterMap HMIPort | 3 |
| Install GitLab Server and Configure | Installs and configures a GitLab CE server with automated project, group, and user provisioning via CSV, with SSH keypairs and personal access tokens per user. | GitlabDomain GitlabRootPassword GitlabUsers GitlabProjectsPath StaticIP GitlabProjects | 3 |
| Install PostgreSQL 16.4 | Installs PostgreSQL 16.4 on Windows to C:\postgres, configures remote md5 connections, and provisions an operator superuser alongside the built-in postgres account. | password username | 3 |
| Install Sandcat Implant — Linux | Pre-installs Caldera Sandcat on Linux at build time — drops the binary at the chosen path and installs a systemd service that beacons every ~45s. | CalderaServerIP ImplantPath ServiceName | 3 |
| Copy Sysinternals | Downloads the Sysinternals Suite from Microsoft and extracts it to C:\Tools\Sysinternals on Windows. | — | 2 |
| HMI Client - Linux | Installs pyModbus on a Linux host and runs a polling script as a systemd service — continuously reads holding registers from each configured device. | DeviceList LogFile TimeoutSeconds | 2 |
| host-artifact-workstation-windows | Installs Eric Zimmermann’s EZ Tools forensic toolkit (EvtxECmd, MFTECmd, RECmd) and Timeline Explorer on a Windows workstation, all from the plugin vault. | EZToolsVaultFile | 2 |
| ICS Device Emulator | Deploys a rack of emulated ICS/SCADA devices on a single Ubuntu VM using Docker macvlan — each device gets its own IP/MAC on the OT VLAN, running Conpot for Modbus, S7comm, SNMP, HTTP. | DeviceList ParentInterface OtSubnetCIDR OtGateway EnabledProtocols | 2 |
| ICS Process Simulator | Runs a Python physics simulation engine that continuously writes to Conpot Modbus holding registers, producing plausible time-varying process data for anomaly detection training. | DeviceList SimTickSeconds NoisePct RegisterMap ModbusPort ModbusUnitID | 2 |
| Install Git (Windows) | Installs Git for Windows fully offline from a vault’d installer at C:\Program Files\Git\bin\git.exe and adds Git to the system PATH. | — | 2 |
| Install Nextcloud Server | Installs Nextcloud on Debian with Apache, PHP 8.2, and MariaDB, then seeds local user accounts from a CSV. | Hostname StaticIP DesiredDomainName AdminUser AdminPass LocalUsers | 2 |
| Install WinSCP | Installs WinSCP (v5.21.7) SFTP/FTP client on Windows silently. | — | 2 |
| PCAP Collector Server | Turns a Linux VM into a central pcap archive — dedicated SSH user for sensor scp pushes, files organized under /pcap/hostname/, and an nginx directory listing on port 8080. | CollectorPassword StorageDirectory RetentionDays EnableHTTPBrowse CollectorUsername HTTPPort AllowedSensorCIDR | 2 |
| SCCM Client | Enrolls an already-domain-joined Windows machine as a managed SCCM client — site code auto-discovered from the server, ccmsetup pulled from the SMS share. | SCCMServerHostname | 2 |
| Caldera Adversary Emulation Server | Installs MITRE Caldera v5 with Atomic Red Team (~1,300 ATT&CK techniques) and Stockpile (~30 default adversaries) — adversaries, abilities, payloads, and operations come from the operator via LoadConfigsAtPath. UI on port 8888. | Hostname StaticIP SubnetMask Gateway CalderaAdminPassword ApiKeyRed ApiKeyBlue LoadConfigsAtPath | 1 |
| GHOSTS Linux Client | Installs the GHOSTS Linux client agent (.NET 8 + systemd) on a Linux host and points it at a GHOSTS server by IP, with Chromium + chromedriver from the local apt mirror. | GhostsServerIP RunAsUser | 1 |
| GHOSTS Server | Installs the CMU SEI GHOSTS NPC orchestration server stack (API, PostgreSQL 16, Grafana, n8n, Angular frontend) on Linux via Docker Compose. UI on port 4200. | Hostname StaticIP PostgresPassword GrafanaAdminPassword N8nAdminPassword SubnetMask Gateway LoadConfigsAtPath SkipSeedLint N8nAdminEmail | 1 |
| Install Firefox | Installs Mozilla Firefox on Windows via Chocolatey. | — | 1 |
| Install Libre Office | Installs the LibreOffice productivity suite on Windows for open-source document editing, spreadsheets, and presentations. | — | 1 |
| SCCM Primary Site Server | Installs Configuration Manager 2303 Primary Site with SQL Server 2022 Developer Edition co-located. A CSV parameter toggles SpecterOps Misconfiguration Manager attack paths (PXE without password, NTLM fallback, automatic client push, overprivileged NAA, Run Scripts). | NAAPassword Hostname DomainNameFQDN NAAUsername LowPrivUsername LowPrivPassword MisconfigCSV | 1 |
| Install FileZilla | Installs the FileZilla FTP Client (v3.67.1) on Windows silently. | — | 0 |
| Install Foxit PDF Reader | Installs Foxit PDF Reader on Windows silently. | — | 0 |
| Install Putty | Installs the PuTTY SSH client (v0.81) on Windows silently. | — | 0 |
| Install Windows Terminal | Installs Windows Terminal on Windows via Add-AppxPackage, with vclib and ui dependency packages installed first. | username password | 0 |