Installing FortiAgent
FortiAgent is a Windows service that facilitates communication between the FortiTester and the RATs. The FortiAgent program should be installed on every target host that is taking part in the adversary emulation operation. Once installed, they will communicate with FortiTester and interact with the RATs to participate in the adversary operation.
It requires admin permission of the Windows system to install FortiAgent.
To install FortiAgent on target hosts:
- Install Visual C++ Redistributable for Visual Studio 2015.
Visual C++ Redistributable may fail to install if Windows is not fully updated. If you encounter problems, try fully updating Windows. - Download the latest release of FortiAgent from FortiTester.
- Go to ATT&CK > ATT&CK Cases > Resources.
- In the Available Clients table, click the Download icon to download FortiAgent and confg.yml.
- Place fortiagent.exe and confg.yml in the desired installation location. The recommended location is c:\Program Files\FortiAgent\fortiagent.exe.
- In an Administrator command prompt, run the following command to install FortiAgent:
fortiagent.exe --startup auto install - Run the following command to start FortiAgent:
fortiagent.exe start - After FortiAgent is successfully started on the target hosts, it is listed on Agent Monitor page on FortiTester (ATT&CK > ATT&CK Cases > Monitor).
- Repeat step 3 to 5 to install FortiAgent on every target host.