Atomic Red Team Testing

What problem does it solve?

This Skill automates the execution and validation of adversary emulation tests using Atomic Red Team, ensuring your security detections are effective against real-world attack techniques.

Core Features & Use Cases

• Standard Atomic Execution: Run pre-defined tests for known MITRE ATT&CK techniques.
• Custom Atomic Deployment: Create and execute your own tests (T9999.XXX) for specific detection scenarios.
• Detection Validation: Verify that your SIEM rules correctly identify the telemetry generated by executed tests.
• Use Case: A security analyst needs to confirm a newly written Splunk detection for T1059.001 (PowerShell execution) is working. They use this Skill to run a relevant Atomic Red Team test on a target endpoint, then query Splunk to ensure the expected logs are generated and the detection fires.

Quick Start

Use the Atomic Red Team Testing skill to execute test number 1 for technique T1059.001 on the target named 'ar-win-1'.