Atomic Red Team
Open-source library of small, focused tests mapped to MITRE ATT&CK for validating detection and prevention controls across operating systems.
Technical Architecture & Overview
Atomic Red Team is an open-source library of small, focused tests mapped to the MITRE ATT&CK framework. Each test is defined in a structured YAML file and includes command examples, prerequisites, and cleanup steps. Red Canary maintains the project and the community contributes new tests. The tests are short and can be run manually or through execution frameworks such as Invoke-AtomicRedTeam.
Targeted Technical Use Cases
Quickly validate whether security controls catch specific ATT&CK techniques and build repeatable tests.
Evaluation & Trade-offs
Core Strengths
- +Large catalog of ATT&CK-mapped tests with structured YAML definitions.
- +Documented tests with prerequisites and cleanup commands.
- +Simple integration with PowerShell and automation frameworks.
Trade-Offs & Limitations
- -Each test is small and focused on one technique rather than a full adversary campaign.
- -Some tests require elevated privileges on the target, flagged per test in the YAML definitions.
- -Coverage varies by technique and operating system.
Defensive Security Application
Execute focused tests for each ATT&CK technique on a test machine with the security solution active, then use the collected data to evaluate and improve detection coverage.
Frequently Asked Questions
What is Atomic Red Team?→
Atomic Red Team is an open-source library of small, focused tests mapped to the MITRE ATT&CK framework. Each test is defined in a structured YAML file and includes command examples, prerequisites, and cleanup steps. Red Canary maintains the project and the community contributes new tests. The tests are short and can be run manually or through execution frameworks such as Invoke-AtomicRedTeam.
What is Atomic Red Team used for?→
Quickly validate whether security controls catch specific ATT&CK techniques and build repeatable tests.
What are the strengths of Atomic Red Team?→
- +Large catalog of ATT&CK-mapped tests with structured YAML definitions.
- +Documented tests with prerequisites and cleanup commands.
- +Simple integration with PowerShell and automation frameworks.
What are the limitations of Atomic Red Team?→
- +Each test is small and focused on one technique rather than a full adversary campaign.
- +Some tests require elevated privileges on the target, flagged per test in the YAML definitions.
- +Coverage varies by technique and operating system.
How is Atomic Red Team used defensively?→
Execute focused tests for each ATT&CK technique on a test machine with the security solution active, then use the collected data to evaluate and improve detection coverage.