<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: executing-atomic-red-team-tests
description: >-
  Execute, customize, and validate Atomic Red Team tests for technique-level
  detection validation. Covers test selection, prerequisite checks, execution,
  cleanup, and custom atomic development for coverage gaps.
domain: cybersecurity
subdomain: purple-team
tags:
  - atomic-red-team
  - mitre-attack
  - detection-validation
  - red-team
  - technique-testing
  - invoke-atomictest
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["T1003.001", "T1053.005", "T1059.001", "T1059.004"]
---

# Executing Atomic Red Team Tests

## Overview

Atomic Red Team provides small, portable detection tests mapped to MITRE ATT&CK
techniques. Each atomic test validates whether a specific technique generates the
expected telemetry and triggers detection rules. Tests run quickly, clean up after
themselves, and form the backbone of automated detection validation.

## Prerequisites

| Requirement | Install |
|---|---|
| Invoke-AtomicRedTeam | `IEX (IWR 'https://raw.githubusercontent.com/redcanaryco/invoke-atomicredteam/master/install-atomicredteam.ps1' -UseBasicParsing); Install-AtomicRedTeam -getAtomics` |
| atomic-red-team (Linux) | `git clone https://github.com/redcanaryco/atomic-red-team.git` |
| PowerShell 7+ | For cross-platform execution |
| Python 3.10+ | For agent tooling |

## Key Concepts

### Test Structure

Each atomic test YAML contains:

```yaml
attack_technique: T1003.001
display_name: "OS Credential Dumping: LSASS Memory"
atomic_tests:
  - name: Dump LSASS with Mimikatz
    auto_generated_guid: a]f4c5b2-1234-5678-9abc-def012345678
    description: Uses mimikatz to dump credentials from LSASS
    supported_platforms:
      - windows
    input_arguments:
      output_file:
        description: Path to write dump file
        type: path
        default: '%temp%\lsass.dmp'
    dependency_executor_name: powershell
    dependencies:
      - description: Mimikatz must exist on disk
        prereq_command: 'if (Test-Path $env:TEMP\mimikatz.exe) {exit 0} else {exit 1}'
        get_prereq_command: 'Invoke-WebRequest ...'
    executor:
      command: '$env:TEMP\mimikatz.exe "sekurlsa::logonpasswords" "exit"'
      cleanup_command: 'Remove-Item $env:TEMP\lsass.dmp -ErrorAction Ignore'
      name: powershell
      elevation_required: true
```

### Execution Modes

| Mode | Command | Use Case |
|---|---|---|
| Single test | `Invoke-AtomicTest T1003.001 -TestNumbers 1` | Targeted validation |
| All tests for technique | `Invoke-AtomicTest T1003.001` | Full technique coverage |
| Prereq check | `Invoke-AtomicTest T1003.001 -GetPrereqs` | Verify dependencies |
| Cleanup only | `Invoke-AtomicTest T1003.001 -Cleanup` | Remove artifacts |
| Show details | `Invoke-AtomicTest T1003.001 -ShowDetailsBrief` | List available tests |
| Bash execution | `bash -c "$(cat atomics/T1059.004/T1059.004.md)"` | Linux atomics |

## Workflow

### 1. Select Tests by Technique

```powershell
# List all available tests for a technique
Invoke-AtomicTest T1059.001 -ShowDetailsBrief

# List tests for multiple techniques
@('T1003.001','T1059.001','T1053.005') | ForEach-Object {
    Write-Host "`n=== $_ ===" -ForegroundColor Cyan
    Invoke-AtomicTest $_ -ShowDetailsBrief
}
```

### 2. Check and Install Prerequisites

```powershell
# Check prereqs for a technique
Invoke-AtomicTest T1003.001 -GetPrereqs

# Check prereqs for all tests without executing
Invoke-AtomicTest T1003.001 -CheckPrereqs
```

### 3. Execute Tests

```powershell
# Execute with logging
$timestamp = Get-Date -Format "yyyyMMdd_HHmmss"
Invoke-AtomicTest T1003.001 -TestNumbers 1 |
  Tee-Object -FilePath "logs/atomic_${timestamp}.log"

# Execute with custom input arguments
Invoke-AtomicTest T1003.001 -TestNumbers 1 -InputArgs @{
    output_file = "C:\temp\test_dump.dmp"
}

# Execute all tests for a technique with timeout
Invoke-AtomicTest T1059.001 -TimeoutSeconds 120
```

### 4. Validate Detection

```bash
# After execution, check SIEM for alerts (Splunk example)
curl -s -k -u admin:changeme \
  "https://splunk:8089/services/search/jobs" \
  -d 'search=search index=main sourcetype=WinEventLog:Security EventCode=4688 | head 10'

# Check Elastic for alerts
curl -s "http://elastic:9200/alerts-*/_search" \
  -H 'Content-Type: application/json' \
  -d '{"query":{"range":{"@timestamp":{"gte":"now-5m"}}}}'
```

### 5. Cleanup

```powershell
# Cleanup specific test
Invoke-AtomicTest T1003.001 -TestNumbers 1 -Cleanup

# Cleanup all tests for technique
Invoke-AtomicTest T1003.001 -Cleanup
```

## Detection

```yaml
title: Executing Atomic Red Team Tests Detection
id: 2c4aee92-9b1e-4717-865a-71d42b7dc33a
status: experimental
description: Detects suspicious activity related to executing atomic red team tests techniques in purple team context
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    CommandLine: "*executing*atomic*"
  condition: selection
level: medium
tags:
  - attack.t1003.001
  - attack.t1053.005
  - attack.t1059.001
  - attack.t1059.004
  - attack.defense_evasion
falsepositives:
  - Authorized adversary simulation exercises during scheduled windows
```

## Verification

| Check | Method |
|---|---|
| Test executed | Exit code 0 from Invoke-AtomicTest |
| Telemetry generated | Event appears in SIEM within 60 seconds |
| Detection fired | Alert triggered matching technique ID |
| Cleanup complete | Artifacts removed, no residual processes |
| Prereqs restored | System returned to pre-test state |

## References

- [Atomic Red Team Repository](https://github.com/redcanaryco/atomic-red-team)
- [Invoke-AtomicRedTeam Wiki](https://github.com/redcanaryco/invoke-atomicredteam/wiki)
- [Atomic Test Harness](https://github.com/redcanaryco/AtomicTestHarnesses)
