Applications Plugins
Applications are installers. Each one puts a piece of software on a machine, such as Office, a browser, a dev tool, a C2 server, or an ICS simulator, and checks that it installed. Desktop installers usually take no parameters. Server and simulator plugins, such as GHOSTS Server, Caldera, SCCM Primary Site Server, and the ICS simulators, take several, so check the Params column before you add one.
Available plugins
Section titled “Available plugins”| Plugin | What it does | Params | Uses |
|---|---|---|---|
| Microsoft Office 2016 | Installs Microsoft Office 2016 (32-bit) on Windows. Sets up a 25-day license-rearm scheduled task to keep the trial alive for lab use. | None | 332 |
| Install Visual Studio 2022 | Installs Visual Studio 2022 Community IDE on Windows with a scheduled license-rearm task. | None | 140 |
| Install Notepad ++ | Installs Notepad++ silently and verifies the binary exists in Program Files. | None | 124 |
| Install Google Chrome | Installs Google Chrome on Windows silently and verifies chrome.exe exists in Program Files. | None | 119 |
| Install VLC | Installs VLC Media Player (v3.0.20) on Windows silently and verifies vlc.exe exists. | None | 119 |
| Install Apache | Installs Apache HTTP Server on port 80 for general scenarios. For a Red Team redirector, use the dedicated redirector plugin. | None | 95 |
| Install Keepass | Installs the KeePass password manager on Windows for secure credential storage. | None | 37 |
| Install Linux Docker | Installs Docker and Docker Compose on Linux offline from .deb packages, adds the debian user to the docker group, and reboots. | None | 37 |
| Install NordVPN | Installs the NordVPN client on Windows along with its .NET Framework 4.x dependency. | None | 33 |
| Install Internet Information Services (IIS) | Installs and configures IIS on Windows: enables the IIS-WebServer feature, binds the default site to port 80, enables directory browsing, and reboots. | None | 28 |
| Install Tomcat | Installs Apache Tomcat 10.1.18 with Java JDK 17 on Windows, auto-starts the service, and deploys a tomcat-users.xml with the manager-gui role. | username password | 18 |
| Sliver Server Setup (Scenario Based) | Stands up a Sliver server with scenario-friendly defaults to simulate a compromise in an Active Directory domain. Not for live Red Team operations. | UsernameRunningTheServer | 15 |
| Install Visual Studio Code | Installs Visual Studio Code (v1.98.0) on Windows silently and skips the auto-run step. | None | 9 |
| Install Sandcat Implant — Windows | Pre-installs Caldera Sandcat on Windows at build time. Places sandcat.exe at the chosen path, registers a SYSTEM scheduled task at boot, and adds Defender exclusions. | CalderaServerIP ImplantPath ServiceName | 8 |
| Install and Configure WireGuard VPN Server | Installs and configures a WireGuard VPN server with auto-generated client configs, served over HTTP on port 8888 when a 10.1.1.x IP is present. | DomainName WireguardPort ClientCount StaticIP | 7 |
| Install Exchange Server 2019 | Installs Microsoft Exchange Server 2019 CU15 (Mailbox role) on a domain-joined Windows Server, prepares AD schema, creates mailboxes for existing AD users, and seeds realistic email traffic. Takes 1 hour+. | Hostname StaticIP parentFQDN DNSAlias IPGateway IPDNS IPSubnetMask Mailboxes SeedEmails | 7 |
| Install 7-Zip | Installs the 7-Zip file archiver on Windows for compression and extraction. | None | 6 |
| OPC-UA Historian | Runs a python-opcua OPC-UA server on port 4840 that bridges Modbus register values from ICS devices into a browseable OPC-UA node hierarchy. | DeviceList ServerPort AuthMode HistorianUsers EnableWriteAccess | 6 |
| GHOSTS Windows Client | Installs the GHOSTS Windows client agent on a workstation and points it at a GHOSTS server by IP, with Chrome + chromedriver bundled for browser simulation. | GhostsServerIP | 5 |
| Install Apache Tomcat Server (Linux) | Installs Apache Tomcat 10.1 on Linux as a systemd service with the Manager web UI enabled for remote access. | Hostname StaticIP DesiredDomainName TomcatPort ManagerUsername ManagerPassword RunAsRoot | 5 |
| Install Python | Installs Python on Windows to C:\python with InstallAllUsers=1 and AppendPath=1. | None | 5 |
| Install Wireshark | Installs Wireshark and the Npcap packet capture driver on Windows. | None | 5 |
| PCAP Sensor - Windows | Runs rotating packet captures on Windows using built-in pktmon, converts each rotation to .pcapng, and scp-pushes completed files to a PCAP Collector Server. | CollectorIP CollectorPassword CaptureInterface RotateSeconds BPFFilter CollectorUser RingBufferFiles | 5 |
| Install WireGuard Client & Configuration (Linux) | Installs WireGuard on Linux and fetches a client VPN config from the WireGuard server’s HTTP config service. Does not start the tunnel. | WireguardServerIP ConfigSavePath ConfigFileName | 4 |
| Install WireGuard Client and Configuration (Windows) | Installs WireGuard on Windows silently and fetches a client VPN config from the WireGuard server’s HTTP config service. Does not start the tunnel. | WireguardServerIP ConfigFileName ConfigSavePath | 4 |
| PCAP Sensor - Linux | Installs tcpdump on Linux and runs continuous rotating captures as a systemd service, with a cron job that scp-pushes completed pcaps to the PCAP Collector Server. | CaptureInterface CollectorIP CollectorPassword RotateSeconds BPFFilter RetentionFiles CollectorUsername PushIntervalMinutes | 4 |
| Safety Instrumented System (SIS) | Deploys a Python Safety Instrumented System that monitors Modbus process values against safety thresholds and writes emergency shutdown signals on breach, for TRITON/TRISIS-style exercises. | DeviceList ShutdownRegister LogFile ShutdownValue PollIntervalMs ModbusPort ModbusUnitID BreachConfirmCount LatchShutdown | 4 |
| DNP3 Outstation Emulator | Deploys an OpenDNP3-based outstation container responding to DNP3 on TCP port 20000, with each device on its own OT VLAN IP via Docker macvlan. | DeviceList ParentInterface OtSubnetCIDR DNP3MasterIP DockerNetwork OutstationAddressBase UnsolicitedResponses DataSimulationProfile OtGateway | 3 |
| HMI Client - Windows | Installs RapidSCADA 6.4.6 on a Windows workstation and auto-configures Modbus data sources for each device in the list. The live web HMI runs on port 8080. | DeviceList PollIntervalMs RegisterMap HMIPort | 3 |
| Install GitLab Server and Configure | Installs and configures a GitLab CE server with automated project, group, and user provisioning via CSV, with SSH keypairs and personal access tokens per user. | GitlabDomain GitlabRootPassword GitlabUsers GitlabProjectsPath StaticIP GitlabProjects | 3 |
| Install PostgreSQL 16.4 | Installs PostgreSQL 16.4 on Windows to C:\postgres, configures remote md5 connections, and provisions an operator superuser alongside the built-in postgres account. | password username | 3 |
| Install Sandcat Implant — Linux | Pre-installs Caldera Sandcat on Linux at build time. Places the binary at the chosen path and installs a systemd service that beacons every ~45s. | CalderaServerIP ImplantPath ServiceName | 3 |
| Copy Sysinternals | Downloads the Sysinternals Suite from Microsoft and extracts it to C:\Tools\Sysinternals on Windows. | None | 2 |
| HMI Client - Linux | Installs pyModbus on a Linux host and runs a polling script as a systemd service. The script continuously reads holding registers from each configured device. | DeviceList LogFile TimeoutSeconds | 2 |
| host-artifact-workstation-windows | Installs Eric Zimmerman’s EZ Tools forensic toolkit (EvtxECmd, MFTECmd, RECmd) and Timeline Explorer on a Windows workstation, all from the plugin vault. | EZToolsVaultFile | 2 |
| ICS Device Emulator | Deploys a rack of emulated ICS/SCADA devices on a single Ubuntu VM using Docker macvlan. Each device gets its own IP/MAC on the OT VLAN and runs Conpot for Modbus, S7comm, SNMP, and HTTP. | DeviceList ParentInterface OtSubnetCIDR OtGateway EnabledProtocols | 2 |
| ICS Process Simulator | Runs a Python physics simulation engine that continuously writes to Conpot Modbus holding registers, producing plausible time-varying process data for anomaly detection training. | DeviceList SimTickSeconds NoisePct RegisterMap ModbusPort ModbusUnitID | 2 |
| Install Git (Windows) | Installs Git for Windows fully offline from a vault’d installer at C:\Program Files\Git\bin\git.exe and adds Git to the system PATH. | None | 2 |
| Install Nextcloud Server | Installs Nextcloud on Debian with Apache, PHP 8.2, and MariaDB, then seeds local user accounts from a CSV. | Hostname StaticIP DesiredDomainName AdminUser AdminPass LocalUsers | 2 |
| Install WinSCP | Installs WinSCP (v5.21.7) SFTP/FTP client on Windows silently. | None | 2 |
| PCAP Collector Server | Turns a Linux VM into a central pcap archive, with a dedicated SSH user for sensor scp pushes, files organized under /pcap/hostname/, and an nginx directory listing on port 8080. | CollectorPassword StorageDirectory RetentionDays EnableHTTPBrowse CollectorUsername HTTPPort AllowedSensorCIDR | 2 |
| SCCM Client | Enrolls an already domain-joined Windows machine as a managed SCCM client. The site code is auto-discovered from the server, and ccmsetup is pulled from the SMS share. | SCCMServerHostname | 2 |
| Caldera Adversary Emulation Server | Installs MITRE Caldera v5 with Atomic Red Team (~1,300 ATT&CK techniques) and Stockpile (~30 default adversaries). The operator supplies adversaries, abilities, payloads, and operations through LoadConfigsAtPath. UI on port 8888. | Hostname StaticIP SubnetMask Gateway CalderaAdminPassword ApiKeyRed ApiKeyBlue LoadConfigsAtPath | 1 |
| GHOSTS Linux Client | Installs the GHOSTS Linux client agent (.NET 8 + systemd) on a Linux host and points it at a GHOSTS server by IP, with Chromium + chromedriver from the local apt mirror. | GhostsServerIP RunAsUser | 1 |
| GHOSTS Server | Installs the CMU SEI GHOSTS NPC orchestration server stack (API, PostgreSQL 16, Grafana, n8n, Angular frontend) on Linux via Docker Compose. UI on port 4200. | Hostname StaticIP PostgresPassword GrafanaAdminPassword N8nAdminPassword SubnetMask Gateway LoadConfigsAtPath SkipSeedLint N8nAdminEmail | 1 |
| Install Firefox | Installs Mozilla Firefox on Windows via Chocolatey. | None | 1 |
| Install Libre Office | Installs the LibreOffice productivity suite on Windows for open-source document editing, spreadsheets, and presentations. | None | 1 |
| SCCM Primary Site Server | Installs Configuration Manager 2303 Primary Site with SQL Server 2022 Developer Edition co-located. A CSV parameter toggles SpecterOps Misconfiguration Manager attack paths (PXE without password, NTLM fallback, automatic client push, overprivileged NAA, Run Scripts). | NAAPassword Hostname DomainNameFQDN NAAUsername LowPrivUsername LowPrivPassword MisconfigCSV | 1 |
| Install FileZilla | Installs the FileZilla FTP Client (v3.67.1) on Windows silently. | None | 0 |
| Install Foxit PDF Reader | Installs Foxit PDF Reader on Windows silently. | None | 0 |
| Install Putty | Installs the PuTTY SSH client (v0.81) on Windows silently. | None | 0 |
| Install Windows Terminal | Installs Windows Terminal on Windows via Add-AppxPackage, with vclib and ui dependency packages installed first. | username password | 0 |