Suggest capturing Exit Status and PID

[rc-GeorgeAllen]

Suggest adding the PID of the process starting the test, and an exit status for the test, for completeness.

This allows the timestamps to scope to a specific parent pid on a specific host, further easing follow-on telemetry analysis.
Tests that report a correct exit status on success or failure can easily indicate state without parsing stdout/stderr.

eg:

            "steps": [
                {
                    "command": "powershell.exe -File \"T1218010 - Regsvr32 remote COM scriptlet execution\"",
                    "executor": "POWERSHELL",
                    "order": 1,
+                   "pid": 1234,
+                   "exit": 1,
                    "output": [
                        {
                            "content": "File C:\\Users\\User\\Desktop\\AEv1.0 - Administrator-10\\T1218010 - Regsvr32 remote COM scriptlet executio.ps1 cannot be \r\nloaded. The file C:\\Users\\User\\Desktop\\AEv1.0 - Administrator-10\\T1218010 - Regsvr32 remote COM scriptlet executio is not digitally signed. You cannot run this script on the current system. For more information \r\nabout running scripts and setting execution policy, see about_Execution_Policies at \r\nhttps:/go.microsoft.com/fwlink/?LinkID=135170.\r\n    + CategoryInfo          : SecurityError: (:) [], ParentContainsErrorRecordException\r\n    + FullyQualifiedErrorId : UnauthorizedAccess",
                            "level": "STDERR",
                            "type": "console"
                        }
                    ],
                    "time-start": "2021-10-27T02:02:23.000Z",
                    "time-stop": "2021-10-27T02:02:25.000Z"
                }
            ]

[hxnoyd]

I vote for this suggestion! @rc-GeorgeAllen did you got any feedback, or found a workaround?

[thebleucheese]

I vote for this suggestion! @rc-GeorgeAllen did you got any feedback, or found a workaround?

this is a good idea. I'll see if there's anything we can do with it to allow for more flexible data capture.

Right now I think VECTR is overly strict with how it validates incoming ATTiRe logs.

[hxnoyd]

I did some research and concluded that the process id and exit code need to be provided by Invoke-AtomicRedTeam.psd1, specifically Invoke-Process.ps1. Interestingly they are already providing the Process exit code here. Invoke-Process wil need to return something like $Process.Id, so that Invoke-AtomicTest.ps1 can write the two additional arguments (exit code and process id) to the logger.