TTPForge Attacker Action Types

TTPForge supports the following types of actions:

• inline: Run Shell Commands
• create_file: Create Files on Disk
• copy_path: Copy File or Directory on Disk
• edit_file: Append/Delete/Replace Lines in Files
• expect: Automate Interactive Command Executions via Expect.
• remove_path: Delete Files/Directories
• http_request: Executes an HTTP Request and Saves Response as Variable.
• fetch_uri: Downloads a File from URL to Disk
• kill_process: Kill a process by name or ID
• print_str: Print Strings to the Screen
• file: Execute an External Program (No Shell)
• ttp: Chain Multiple TTPForge TTPs together
• connect: Establish a Named SSH Connection for Remote Execution

There is no limit on how many steps: a TTP can have and no restrictions on the mix of action types that you can use in a given TTP. However, each step must map to one and only one action type - for example, if you specify both inline: and create_file:, you'll get an error pointing out that your step has an ambiguous action type.

Remote Execution

Use a connect step to establish a named SSH connection, then add remote: <connection_name> to any step to run it on that remote host. See Remote Execution over SSH for details.