<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->

# API Reference — Executing Atomic Red Team Tests

## Invoke-AtomicRedTeam

### Cmdlets

| Command | Description |
|---|---|
| `Invoke-AtomicTest <TechniqueID>` | Execute all tests for a technique |
| `Invoke-AtomicTest <TechniqueID> -TestNumbers <N>` | Execute specific test |
| `Invoke-AtomicTest <TechniqueID> -ShowDetailsBrief` | List available tests |
| `Invoke-AtomicTest <TechniqueID> -GetPrereqs` | Install prerequisites |
| `Invoke-AtomicTest <TechniqueID> -CheckPrereqs` | Verify prerequisites |
| `Invoke-AtomicTest <TechniqueID> -Cleanup` | Remove test artifacts |

### Parameters

| Parameter | Type | Description |
|---|---|---|
| `-TestNumbers` | int[] | Specific test numbers to execute |
| `-InputArgs` | hashtable | Override default input arguments |
| `-TimeoutSeconds` | int | Execution timeout (default: 120) |
| `-GetPrereqs` | switch | Download and install prerequisites |
| `-CheckPrereqs` | switch | Check if prerequisites are met |
| `-Cleanup` | switch | Run cleanup commands |
| `-ShowDetailsBrief` | switch | Show test summary without executing |
| `-ShowDetails` | switch | Show full test details |

### Atomic Test YAML Schema

| Field | Type | Description |
|---|---|---|
| `attack_technique` | string | ATT&CK technique ID |
| `display_name` | string | Human-readable technique name |
| `atomic_tests[].name` | string | Test name |
| `atomic_tests[].auto_generated_guid` | string | Unique test identifier |
| `atomic_tests[].supported_platforms` | list | `windows`, `linux`, `macos` |
| `atomic_tests[].executor.command` | string | Command to execute |
| `atomic_tests[].executor.cleanup_command` | string | Cleanup command |
| `atomic_tests[].executor.elevation_required` | bool | Requires admin/root |
| `atomic_tests[].dependencies` | list | Prerequisite checks |

## Agent Script

```bash
# List tests for technique
node agent.js list T1003.001

# Execute specific test
node agent.js execute T1003.001 -n 1

# Check prerequisites
node agent.js check-prereqs T1003.001

# Cleanup after test
node agent.js cleanup T1003.001 -n 1

# Batch execute multiple techniques
node agent.js batch T1003.001 T1059.001 T1053.005
```
