2) Add a System Target

2) Add a System Target

A System Target is a machine that receives the events executed at OS level. You assign targets when creating a campaign, which gives you full control over the test scope.


During a simulation, the Attack Vector connects to each System Target and runs the commands, programs or tools that reproduce attacker behavior. A System Target is a physical or virtual server or workstation running Windows, Linux or macOS.
Best practice. For meaningful results, a System Target should be representative of your real defenses (EDR, antivirus, SIEM integration, etc.).


How the Attack Vector connects to a target

The Attack Vector reaches each System Target over a protocol that depends on the OS, using credentials you provide. Two things must be in place: valid credentials and open network flows.

Protocols and credentials

System Target OS
Connection protocol
Account requirements
Windows
WinRM (NTLM authentication) or WMI
Local or domain account, with local admin privileges on the target
Linux / macOS
SSH
Local account, with login & password or key

Network flows

Open the required ports between the Attack Vector and the target (add rules if a host or network firewall sits between them):
  • WinRM: TCP 5985
  • WMI: TCP 135 and 445, plus a dynamic RPC port range (Windows default 49152–65535; 60000–61000 if you enable WMI with the BlackNoise script)
  • SSH: TCP 22

Account privileges

The higher the account's privileges, the more events actually run, since some actions require elevated rights. This is useful either way: with a standard account you can verify that a user cannot run certain commands (or that an EDR blocks them); with an admin account you get deeper detection coverage when commands are not blocked.
Some scenarios require specific accounts or privileges; these prerequisites are stated in each scenario's description.


1. Create a System Target

    Go to Resources > System Targets and click Create a system target (top right).
    Provide the target's essential information:
  • Name (used to identify it in BlackNoise)
  • IPv4 address
  • OS type
    Choose an authentication method based on the OS (see the table above). These credentials are what let the Attack Vector connect to the target and execute events, so they are required.

For Windows targets, remote access (WinRM or WMI) must be enabled on the machine first. See  Enable Windows remote access (WinRM & WMI) .


2. Test the connection

Always test the connection between an Attack Vector and a new System Target before running a simulation, to confirm that:
  • the network flows are open,
  • the remote-access service is active,
  • the credentials are correct.
You can test at two moments:
  • During creation: enable the Launch a connection test before creating the system target switch, then choose an Attack Vector and protocol. The target is created only if the test passes.
  • Any time after: open the target's detail view and use Connection testing.
A SUCCESS message confirms the target is ready to use in a campaign.


Troubleshooting: connection test errors

A connection test runs automatically when you create a simulation, and on demand from Resources > System Targets. The message you get depends on the protocol.
WMI
  • Connectivity or service error — confirm the target is powered on and operational; verify the WMI service is running (start or restart it if needed); check that TCP 135, 445 and the RPC high ports (60000–61000 if you used the BlackNoise script) are not blocked between the Attack Vector and the target.

https://slite.com/api/files/URWWo7XmO_J4zk/image.png?apiToken=eyJhbGciOiJIUzI1NiIsImtpZCI6IjIwMjMtMDUtMDQifQ.eyJzY29wZSI6Im5vdGUtZXhwb3J0IiwibmlkIjoiX1huRjl4MnFqdXJLNmYiLCJpYXQiOjE3ODUyNTc0NTYsImlzcyI6Imh0dHBzOi8vc2xpdGUuY29tIiwianRpIjoibDF0NC1UMTY1OE9oemUiLCJleHAiOjE3ODc4NDk0NTZ9.DDlQwu_qUZVde2GpWDYnkbs0PBItxcICSkW9ychNFc4
  • Authentication error — confirm the username and password are correct (reset if needed) and that the account has local admin rights.
SSH
  • Connectivity or service error — confirm the target is powered on and operational; verify the SSH service is running (start or restart it if needed); check that TCP 22 is not blocked.
  • Authentication error — confirm the username and password (or key) are correct (reset if needed).