1 min read
|
Saved February 14, 2026
|
Copied!
Do you care about this?
NEBULA is a PowerShell tool designed for testing Windows execution and persistence methods, including LOLBAS techniques. It provides a menu-driven interface for security researchers and teams to execute tests and log results. Example payloads sourced from Atomic Red Team are included for safe experimentation.
If you do, here's more
NEBULA is a PowerShell-based testing framework tailored for security professionals, enabling them to explore and test various Windows execution techniques. It focuses on methods like WMI and COM objects, along with LOLBAS techniques. The tool offers an interactive, menu-driven user interface where users can easily select options using number keys, go back, or exit the application. Each test execution is logged with detailed information, including timestamps and status indicators like SUCCESS or FAILED, allowing users to track their activities.
To run NEBULA, users can execute a batch file or use a PowerShell command, provided they have the necessary permissions. The framework works on Windows 10/11 and Windows Server 2016 or later, requiring PowerShell 5.1 or newer. Included in the package are example payloads that demonstrate specific LOLBAS techniques sourced from Atomic Red Team. These payloads, such as regsvr32_squiblydoo.sct and mshta_calc.hta, perform benign actions like launching calculator applications, ensuring safety during testing.
NEBULA’s integration with Atomic Red Team enhances its functionality, allowing users to conduct reproducible tests that align with the MITRE ATT&CK® framework. This connection provides a structured approach for security teams to evaluate their defenses against real-world attack vectors. The tool's design emphasizes a controlled environment for testing, making it a practical resource for both red and blue team activities.
Questions about this article
No questions yet.