Installing FortiAgent

FortiAgent is a service that facilitates communication between FortiTester and the RATs. The FortiAgent program should be installed on every target host that is taking part in the adversary emulation operation.

FortiAgent can be installed on the following platforms:

• Windows

• Linux

• Mac OS

After FortiAgent is successfully started on the target hosts, it is listed on Agent Monitor page on FortiTester (ATT&CK > ATT&CK Cases > Monitor).

To install FortiAgent on Windows:

You must have admin permission on the Windows system to install FortiAgent.

1. Install Visual C++ Redistributable for Visual Studio 2015.
   Visual C++ Redistributable may fail to install if Windows is not fully updated. If you encounter problems, try fully updating Windows.

2. Download the latest release of FortiAgent from FortiTester:

   1. Go to ATT&CK > ATT&CK Cases > Maintenance > Resources.

   2. In the Available Clients table, click the Download icon to download FortiAgent and confg.yml for Windows.

3. Place FortiAgent.exe and confg.yml in the desired installation locations. The recommended locations are C:\Program Files\FortiAgent\FortiAgent.exe and C:\Users\Public\config.yml.

4. In an Administrator command prompt, run the following command to install FortiAgent:

   fortiagent-windows.exe --startup auto --username <username> --password <password> install

5. Run the following command to start FortiAgent:

   fortiagent-windows.exe start

To install FortiAgent on Linux:

You must have Python 3.6.1 or greater (with Pip) installed on the target system.

1. Download the latest release of FortiAgent from FortiTester.

   1. Go to ATT&CK > ATT&CK Cases > Maintenance > Resources.

   2. In the Available Clients table, click the Download icon to download FortiAgent and confg.yml for the appropriate Linux platform.

2. Run the following command to extract fortiagent-linux.tar:

   tar xf fortiagent-linux.tar

3. In the extracted fortiagent directory, run the following command to install the python requirements:

   pip install -r requirements.txt

4. Put the downloaded conf.yml into the /etc/fortiagent directory.

5. Run the following command to install FortiAgent:

   sudo dpkg -i fortiagent_<version>_<platform>.deb

   The fortiagent service is automatically started.

   Start, restart, or stop the fortiagent service with systemctl. For example:

   sudo systemctl restart fortiagent

To install FortiAgent on Mac OS:

You must have Python 3.6.1 or greater (with Pip) installed on the target system.

1. Download the latest release of FortiAgent from FortiTester.

   1. Go to ATT&CK > ATT&CK Cases > Maintenance > Resources.

   2. In the Available Clients table, click the Download icon to download FortiAgent and confg.yml for Mac OS.

2. Run the following command to extract fortiagent-mac.tar:

   tar xf fortiagent-mac.tar

3. Double-click FortiAgentInstaller.pkg to run the installer. Do not change the default install location.

4. Put the downloaded conf.yml into the /Users/Shared/FortiAgent directory.

5. In the /Users/Shared/FortiAgent directory, run the following command to install the python requirements:

   pip install -r requirements.txt

6. Run the folloddwing command to start FortiAgent:

   python3 activate.py

   The fortiagent service is started.