Atomic Red Team

Atomic Red Team is a library of tests mapped to the MITRE ATT&CK framework that security teams can use to quickly, portably, and reproducibly test their environments.

Installation & Setup

Command	Description
`git clone https://github.com/redcanaryco/atomic-red-team.git`	Clone Atomic Red Team repository
`cd atomic-red-team`	Navigate to repository
`Install-Module -Name invoke-atomicredteam,powershell-yaml -Scope CurrentUser`	Install PowerShell modules
`Import-Module "C:\AtomicRedTeam\invoke-atomicredteam\Invoke-AtomicRedTeam.psd1" -Force`	Import PowerShell module
`Invoke-AtomicTest T1003.001 -ShowDetails`	Show test details

Basic Usage

Command	Description
`Invoke-AtomicTest T1003.001`	Execute specific atomic test
`Invoke-AtomicTest T1003.001 -TestNumbers 1`	Execute specific test number
`Invoke-AtomicTest T1003.001 -ShowDetails`	Show test details without executing
`Invoke-AtomicTest T1003.001 -CheckPrereqs`	Check prerequisites
`Invoke-AtomicTest T1003.001 -GetPrereqs`	Install prerequisites
`Invoke-AtomicTest T1003.001 -Cleanup`	Run cleanup for test

Test Discovery

Command	Description
`Get-AtomicTechnique`	List all available techniques
`Get-AtomicTechnique -Path "C:\AtomicRedTeam\atomics"`	List techniques from specific path
`Get-AtomicTechnique \\| Where-Object {$_.DisplayName -match "credential"}`	Search techniques by keyword
`Get-AtomicTechnique T1003`	Get details for specific technique

MITRE ATT&CK Techniques

Initial Access

Command	Description
`Invoke-AtomicTest T1566.001`	Spearphishing Attachment
`Invoke-AtomicTest T1566.002`	Spearphishing Link
`Invoke-AtomicTest T1190`	Exploit Public-Facing Application
`Invoke-AtomicTest T1133`	External Remote Services
`Invoke-AtomicTest T1200`	Hardware Additions

Execution

Command	Description
`Invoke-AtomicTest T1059.001`	PowerShell execution
`Invoke-AtomicTest T1059.003`	Windows Command Shell
`Invoke-AtomicTest T1059.004`	Unix Shell
`Invoke-AtomicTest T1059.006`	Python execution
`Invoke-AtomicTest T1053.005`	Scheduled Task/Job

Persistence

Command	Description
`Invoke-AtomicTest T1547.001`	Registry Run Keys
`Invoke-AtomicTest T1053.005`	Scheduled Task
`Invoke-AtomicTest T1543.003`	Windows Service
`Invoke-AtomicTest T1136.001`	Local Account creation
`Invoke-AtomicTest T1098`	Account Manipulation

Privilege Escalation

Command	Description
`Invoke-AtomicTest T1548.002`	Bypass User Account Control
`Invoke-AtomicTest T1055`	Process Injection
`Invoke-AtomicTest T1134`	Access Token Manipulation
`Invoke-AtomicTest T1068`	Exploitation for Privilege Escalation

Defense Evasion

Command	Description
`Invoke-AtomicTest T1027`	Obfuscated Files or Information
`Invoke-AtomicTest T1070.004`	File Deletion
`Invoke-AtomicTest T1562.001`	Disable or Modify Tools
`Invoke-AtomicTest T1218.010`	Regsvr32
`Invoke-AtomicTest T1036`	Masquerading

Credential Access

Command	Description
`Invoke-AtomicTest T1003.001`	LSASS Memory dump
`Invoke-AtomicTest T1003.002`	Security Account Manager
`Invoke-AtomicTest T1003.003`	NTDS.dit
`Invoke-AtomicTest T1110.001`	Password Spraying
`Invoke-AtomicTest T1555.003`	Credentials from Web Browsers

Discovery

Command	Description
`Invoke-AtomicTest T1087.001`	Local Account Discovery
`Invoke-AtomicTest T1087.002`	Domain Account Discovery
`Invoke-AtomicTest T1018`	Remote System Discovery
`Invoke-AtomicTest T1083`	File and Directory Discovery
`Invoke-AtomicTest T1057`	Process Discovery

Lateral Movement

Command	Description
`Invoke-AtomicTest T1021.001`	Remote Desktop Protocol
`Invoke-AtomicTest T1021.002`	SMB/Windows Admin Shares
`Invoke-AtomicTest T1021.003`	Distributed Component Object Model
`Invoke-AtomicTest T1021.006`	Windows Remote Management
`Invoke-AtomicTest T1550.002`	Pass the Hash

Collection

Command	Description
`Invoke-AtomicTest T1005`	Data from Local System
`Invoke-AtomicTest T1039`	Data from Network Shared Drive
`Invoke-AtomicTest T1113`	Screen Capture
`Invoke-AtomicTest T1123`	Audio Capture
`Invoke-AtomicTest T1115`	Clipboard Data

Command and Control

Command	Description
`Invoke-AtomicTest T1071.001`	Web Protocols
`Invoke-AtomicTest T1071.004`	DNS
`Invoke-AtomicTest T1090.003`	Multi-hop Proxy
`Invoke-AtomicTest T1573.002`	Asymmetric Cryptography

Exfiltration

Command	Description
`Invoke-AtomicTest T1041`	Exfiltration Over C2 Channel
`Invoke-AtomicTest T1048.003`	Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol
`Invoke-AtomicTest T1567.002`	Exfiltration to Cloud Storage

Impact

Command	Description
`Invoke-AtomicTest T1485`	Data Destruction
`Invoke-AtomicTest T1486`	Data Encrypted for Impact
`Invoke-AtomicTest T1490`	Inhibit System Recovery
`Invoke-AtomicTest T1498`	Network Denial of Service

Advanced Usage

Custom Parameters

Command	Description
`Invoke-AtomicTest T1003.001 -InputArgs @{"output_file"="C:\temp\lsass.dmp"}`	Pass custom parameters
`Invoke-AtomicTest T1087.001 -InputArgs @{"username"="testuser"}`	Specify username parameter

Batch Execution

Command	Description
`Invoke-AtomicTest T1003.001,T1003.002,T1003.003`	Execute multiple tests
`Get-AtomicTechnique \\| ForEach-Object {Invoke-AtomicTest $_.Technique}`	Execute all available tests

Logging and Output

Command	Description
`Invoke-AtomicTest T1003.001 -LoggingModule "Attire-ExecutionLogger"`	Enable logging
`Invoke-AtomicTest T1003.001 -ExecutionLogPath "C:\logs\atomic.log"`	Specify log path
`Invoke-AtomicTest T1003.001 -TimeoutSeconds 60`	Set execution timeout

Configuration

Config File (config.yaml)

# Atomic Red Team Configuration
atomics_folder: "C:\\AtomicRedTeam\\atomics"
log_folder: "C:\\AtomicRedTeam\\logs"
default_timeout: 120
check_prereqs: true
get_prereqs: false
cleanup: true

Environment Variables

Variable	Description
`$env:ATOMIC_RED_TEAM_PATH`	Path to Atomic Red Team directory
`$env:ATOMIC_LOG_PATH`	Path for execution logs
`$env:ATOMIC_TIMEOUT`	Default timeout for tests

Linux/macOS Usage

Installation

Command	Description
`git clone https://github.com/redcanaryco/atomic-red-team.git`	Clone repository
`cd atomic-red-team`	Navigate to directory
`chmod +x atomics//src/`	Make scripts executable

Execution

Command	Description
`bash atomics/T1059.004/src/T1059.004.sh`	Execute bash-based test
`python3 atomics/T1059.006/src/T1059.006.py`	Execute Python-based test
`./atomics/T1083/src/T1083-1.sh`	Execute specific test variant

Integration with SIEM

Splunk Integration

Command	Description
`Invoke-AtomicTest T1003.001 -LoggingModule "Splunk"`	Log to Splunk
`index=atomic_red_team technique=T1003.001`	Search Splunk for test results

ELK Stack Integration

Command	Description
`Invoke-AtomicTest T1003.001 -LoggingModule "Elasticsearch"`	Log to Elasticsearch

Custom Test Development

Test Structure

attack_technique: T1003.001
display_name: "LSASS Memory"
atomic_tests:
- name: Dump LSASS.exe Memory using ProcDump
  auto_generated_guid: 0be2230c-9ab3-4ac2-8826-3199b9a0ebf8
  description: |
    The memory of lsass.exe is often dumped for offline credential theft attacks.
  supported_platforms:
  - windows
  input_arguments:
    output_file:
      description: Path where resulting dump should be placed
      type: Path
      default: C:\Windows\Temp\lsass_dump.dmp
  executor:
    command: |
      procdump.exe -accepteula -ma lsass.exe #{output_file}
    name: command_prompt

Custom Test Execution

Command	Description
`Invoke-AtomicTest -AtomicsFolder "C:\CustomAtomics" T9999.001`	Execute custom test

Reporting and Analysis

Command	Description
`Get-AtomicTestResults`	Get execution results
`Export-AtomicTestResults -Format CSV -Path "results.csv"`	Export results to CSV
`Get-AtomicCoverage`	Show MITRE ATT&CK coverage
`Show-AtomicTestMatrix`	Display test matrix

Automation and Scheduling

PowerShell Scheduled Jobs

$trigger = New-JobTrigger -Daily -At "2:00 AM"
Register-ScheduledJob -Name "AtomicRedTeam" -Trigger $trigger -ScriptBlock {
    Import-Module Invoke-AtomicRedTeam
    Invoke-AtomicTest T1003.001 -Cleanup
}

Continuous Testing

Command	Description
`Start-AtomicContinuousTesting -Techniques @("T1003.001","T1087.001") -Interval 3600`	Run tests every hour

Security Considerations

Run tests in isolated environments only
Ensure proper cleanup after test execution
Monitor for false positives in security tools
Document all test executions for compliance
Use least privilege principles
Implement proper access controls
Regular backup before testing
Coordinate with security operations center

Best Practices

Start with low-impact techniques
Always run prerequisite checks first
Use cleanup functions after testing
Document test results and observations
Coordinate with blue team activities
Test in non-production environments first
Implement proper logging and monitoring
Regular updates to test library
Validate detection capabilities
Create custom tests for specific environments

Troubleshooting

Command	Description
`Get-Help Invoke-AtomicTest -Full`	Get detailed help
`Test-AtomicTestInputArgs T1003.001`	Validate input arguments
`Get-AtomicTestPrerequisites T1003.001`	Check prerequisites
`Repair-AtomicTest T1003.001`	Attempt to fix test issues

Common Issues

Antivirus interference with test execution
Missing prerequisites or dependencies
Insufficient privileges for test execution
Network connectivity issues for external resources
Path-related issues on different operating systems