Skip to content

Deploy MITRE Caldera Agents

Connect one authorised endpoint first. An agent is execution access to the system, so treat its deployment command, contact configuration, group, and privileges as security-sensitive material.

Review bootstrap abilities

The preserved proof of concept edited simple environment-check abilities for Python, Chrome, and Go before agent deployment.

Search for the Check Python ability Edit the Linux and Windows executors for Check Python Review the saved Check Python executor Configure the Check Chrome ability Review the Check Chrome executors Configure the Check Go ability Review the Check Go executors

Use platform-appropriate commands. On Linux, command -v python3 is safer than running an unknown payload. On Windows PowerShell, use Get-Command python -ErrorAction SilentlyContinue. Do not add destructive deadman abilities to a beginner exercise.

Configure and deploy Sandcat

Open Agents, review agent configuration, and generate the deployment command for the correct platform and server contact.

Open agent configuration Review agent name, bootstrap abilities, and deadman abilities

Do not disable endpoint protection as a routine instruction

The legacy Windows procedure advised disabling Microsoft Defender. That is not appropriate as a general prerequisite. Use an isolated training VM, obtain approval for any narrowly scoped exclusion if required, document it, and restore the original protection after the exercise.

Linux client

Generate the Sandcat Linux deployment command Run the generated command on the authorised Linux client Confirm the Linux agent is alive

Windows client

Generate the Sandcat Windows deployment command Run the generated command on the authorised Windows client Confirm the Windows agent is alive

Never reuse a command copied from another environment: the contact address, agent binary, group, and generated values must match your server and approved target. Record the agent paw, hostname, platform, executors, group, privilege, first seen, last seen, and contact method.

Verify agent access

The Access plugin can show bootstrap and deadman results for each connected agent. A green agent status proves check-in, not that every ability is safe or that every defensive control observed it.

Review Linux agent bootstrap results in Access Review Windows agent bootstrap results in Access

Agent checkpoint

Continue only when one authorised agent is alive, its identity matches the VM, the expected executor is available, bootstrap results are understood, and you have recorded how to terminate and remove the agent.

PreviousInstall MITRE CalderaNextBuild abilities and adversaries