2a) Add a System Target

2a) Add a System Target

A System Target is a machine that receives the events executed at OS level. You assign targets when creating a campaign, which gives you full control over the test scope.


During a simulation, the Attack Vector connects to each System Target and runs the commands, programs or tools that reproduce attacker behavior. A System Target is a physical or virtual server or workstation running Windows, Linux or macOS.
To add a cloud environment instead of a machine, see  Add a Cloud Target .
Best practice. For meaningful results, a System Target should be representative of your real defenses (EDR, antivirus, SIEM integration, etc.).


Prepare your target depending how the Attack Vector connects to it

The Attack Vector reaches each System Target over a protocol that depends on the OS, using credentials you provide. Two things must be in place: valid credentials and open network flows.

Protocols and credentials

Recommendation. For a Windows target, we strongly recommend SSH, then WinRM, and WMI only as a last resort.
SSH is the quickest option to put in place: it is enabled by following Microsoft's own OpenSSH procedure, and it uses a single fixed, well-known port, which makes the flow simpler to open and to manage when a firewall sits between the Attack Vector and the target. It also generates fewer detections tied to the WMI and WinRM mechanisms, which some environments report as false positives. WinRM comes next: it uses a single port too (TCP 5985) and relies on NTLM authentication. WMI is the last resort: it requires TCP 135 and 445 plus a dynamic RPC port range, which makes the flows harder to open and to manage.
System Target OS
Connection protocol
Account requirements
Windows
SSH (strongly recommended), WinRM (NTLM authentication) or WMI (last resort)
Local or domain account, with login & password or key for SSH (optionally protected by a passphrase) and with local admin privileges on the target
Linux / macOS
SSH
Local account, with login & password or key (optionally protected by a passphrase)
SSH key and passphrase. For every SSH connection by key, on Windows, Linux or macOS, you can specify a passphrase for the key.

Network flows

Open the required ports between the Attack Vector and the target (add rules if a host or network firewall sits between them):
  • SSH: TCP 22 — the port is fixed and applies to Windows, Linux and macOS targets alike
  • WinRM: TCP 5985
  • WMI: TCP 135 and 445, plus a dynamic RPC port range (Windows default 49152–65535; 60000–61000 if you enable WMI with the BlackNoise script)

Account privileges

The higher the account's privileges, the more events actually run, since some actions require elevated rights. This is useful either way: with a standard account you can verify that a user cannot run certain commands (or that an EDR blocks them); with an admin account you get deeper detection coverage when commands are not blocked.
Some scenarios require specific accounts or privileges; these prerequisites are stated in each scenario's description.


1. Create a System Target

    Go to Resources > System Targets and click Create a system target (top right).
    Provide the target's essential information:
  • Name (used to identify it in BlackNoise)
  • IPv4 address
  • OS type
    Choose an authentication method based on the OS (see the table above). For an SSH key, you can also enter the key's passphrase. These credentials are what let the Attack Vector connect to the target and execute events, so they are required.
Remote access must be enabled on the machine first as described before.


2. Test the connection

Always test the connection between an Attack Vector and a new System Target before running a simulation, to confirm that:
  • the network flows are open,
  • the remote-access service is active,
  • the credentials are correct.
You can test at two moments:
  • During creation: enable the Launch a connection test before creating the system target switch, then choose an Attack Vector and protocol. The target is created only if the test passes.
  • Any time after: open the target's detail view and use Connection testing.
A SUCCESS message confirms the target is ready to use in a campaign.


Troubleshooting: connection test errors

A connection test runs automatically when you create a simulation, and on demand from Resources > System Targets. The message you get depends on the protocol.
SSH — the same messages apply to Windows, Linux and macOS targets.
  • Connectivity or service error — confirm the target is powered on and operational; verify the SSH service is running (start or restart it if needed); check that TCP 22 is not blocked.
  • Authentication error — confirm the username and password (or key and its passphrase) are correct (reset if needed).
WMI
  • Connectivity or service error — confirm the target is powered on and operational; verify the WMI service is running (start or restart it if needed); check that TCP 135, 445 and the RPC high ports (60000–61000 if you used the BlackNoise script) are not blocked between the Attack Vector and the target.

  • Authentication error — confirm the username and password are correct (reset if needed) and that the account has local admin rights.