Atomic Red Team: small tests that check whether your detections fire

Atomic Red Team (about 13,000 stars on GitHub) is an open library of security tests maintained by Red Canary, a managed detection and response company, since 2017. Each test, called an atomic, is a short, self contained action that imitates one technique real attackers use, mapped to the corresponding entry in the MITRE ATT&CK catalogue. Examples are creating a scheduled task, dumping a credential file, clearing an event log or adding a user to the administrators group. The library covers Windows, Linux, macOS and some cloud and container environments, and holds well over a thousand tests.

What problem it solves

A monitoring stack is only useful if it actually alerts when an attack happens, and most teams never find out until a real incident. Atomic Red Team gives defenders a cheap way to check. You pick a technique you believe you can detect, run the matching atomic on a lab machine that your tools monitor, and then look at your SIEM, EDR or Wazuh dashboard to see whether the expected alert appeared. If it did not, you have found a gap before an attacker did. Because every test is small and documented, the exercise takes minutes rather than the days of a full penetration test, and it can be repeated after every change to rules or agents.

How the repository is organised

Tests live under the atomics/ directory, one folder per ATT&CK technique identifier, for example T1053.005 for scheduled tasks on Windows. Each folder contains a YAML file that defines the tests and a generated Markdown page that describes them in plain language. A test lists the platforms it supports, the command it runs, any prerequisites, and a cleanup command that reverses its effect. A separate project from the same team, Invoke-AtomicRedTeam, is a PowerShell module that runs the tests from the YAML definitions, checks prerequisites and performs cleanup. The library is also integrated into several commercial breach and attack simulation products.

How to try it

Clone the repository and read the Markdown page for a technique; the documentation alone is valuable as a catalogue of what attacker behaviour looks like on a host. To execute tests, install the PowerShell runner on a lab machine; it works on Windows, Linux and macOS:

git clone --depth 1 https://github.com/redcanaryco/atomic-red-team.git
ls atomic-red-team/atomics | head

The project site has a getting started guide and a browser for the full test catalogue, and the companion Atomic Red Team learning material explains how to turn test results into detection improvements.

Use it responsibly

The tests perform real actions that attackers perform, and some of them disable logging, change permissions or download tooling. Run them only on systems you own or have written permission to test, and never on production machines without explicit approval from whoever is responsible for them. Use a dedicated lab virtual machine that is monitored by the same tools as production, take a snapshot first, and run the cleanup command after each test. Tell your security team before you start so that the alerts you deliberately trigger are not mistaken for a real incident.

Credit

Atomic Red Team is maintained by Red Canary with contributions from hundreds of community members. The content and tooling are released under the MIT licence.