Atomic Red Team
Open-source library of small, portable tests mapped to MITRE ATT&CK for validating detection and prevention controls across operating systems.
Technical Architecture & Overview
Atomic Red Team is an open-source library of small, focused tests mapped to the MITRE ATT&CK framework. Each test is defined in a structured YAML file and includes command examples, prerequisites, and cleanup steps. Red Canary maintains the project and the community contributes new tests. The tests are short and can be run manually or through execution frameworks such as Invoke-AtomicRedTeam.
Targeted Technical Use Cases
Quickly validate whether detection and prevention controls catch specific ATT&CK techniques, build repeatable purple-team tests, and onboard new analysts with concrete procedures.
Evaluation & Trade-offs
Core Strengths
- +Large catalog of ATT&CK-mapped tests with structured YAML definitions.
- +Portable, documented tests with prerequisites and cleanup guidance.
- +Simple integration with PowerShell and automation frameworks.
Trade-Offs & Limitations
- -Tests are atomic and do not chain into full adversary campaigns.
- -Execution requires elevated privileges or test credentials on the target.
- -Coverage varies by technique and operating system.
Defensive Security Application
Execute benign but representative actions for each ATT&CK technique and verify that sensors, EDR, SIEM, and response processes generate the expected alerts.
Frequently Asked Questions
What is Atomic Red Team?→
Atomic Red Team is an open-source library of small, focused tests mapped to the MITRE ATT&CK framework. Each test is defined in a structured YAML file and includes command examples, prerequisites, and cleanup steps. Red Canary maintains the project and the community contributes new tests. The tests are short and can be run manually or through execution frameworks such as Invoke-AtomicRedTeam.
What is Atomic Red Team used for?→
Quickly validate whether detection and prevention controls catch specific ATT&CK techniques, build repeatable purple-team tests, and onboard new analysts with concrete procedures.
What are the strengths of Atomic Red Team?→
- +Large catalog of ATT&CK-mapped tests with structured YAML definitions.
- +Portable, documented tests with prerequisites and cleanup guidance.
- +Simple integration with PowerShell and automation frameworks.
What are the limitations of Atomic Red Team?→
- +Tests are atomic and do not chain into full adversary campaigns.
- +Execution requires elevated privileges or test credentials on the target.
- +Coverage varies by technique and operating system.
How is Atomic Red Team used defensively?→
Execute benign but representative actions for each ATT&CK technique and verify that sensors, EDR, SIEM, and response processes generate the expected alerts.