12.7K ·GitHub
What is this?
Atomic Red Team is a library of small, portable security tests, each mapped to a specific MITRE ATT&CK technique, that security teams run to check whether their defenses actually detect real attacker behavior.
Atomic Red Team is a library of small, portable security tests, each mapped to a specific MITRE ATT&CK technique, that security teams run to check whether their defenses actually detect real attacker behavior.Is this an exploit toolkit or test definitions for defenders?It is not a hacking toolkit - it's a curated set of 'atomic' test procedures that blue/red teams run on purpose to simulate specific ATT&CK techniques and validate monitoring and detection coverage.
It is not a hacking toolkit - it's a curated set of 'atomic' test procedures that blue/red teams run on purpose to simulate specific ATT&CK techniques and validate monitoring and detection coverage.How do I run an atomic test?You can execute an atomic test straight from the command line with no setup at all - the wiki's Getting started page walks through the exact syntax for a given technique.
You can execute an atomic test straight from the command line with no setup at all - the wiki's Getting started page walks through the exact syntax for a given technique.Do I need Invoke-Atomic to run the tests?No, it's optional. Invoke-Atomic is a separate execution framework recommended only if you want a more robust testing experience (batch runs, dependency checks, cleanup, etc.).
No, it's optional. Invoke-Atomic is a separate execution framework recommended only if you want a more robust testing experience (batch runs, dependency checks, cleanup, etc.).Who is this meant for?Security teams (red teams and blue/detection teams) who need to repeatedly and reliably simulate known ATT&CK techniques to validate their monitoring and alerting.
Security teams (red teams and blue/detection teams) who need to repeatedly and reliably simulate known ATT&CK techniques to validate their monitoring and alerting.Which operating systems do the tests target?The project explicitly calls out Linux-specific atomics (with a Codespaces-based contribution path), alongside the broader cross-platform test library.
The project explicitly calls out Linux-specific atomics (with a Codespaces-based contribution path), alongside the broader cross-platform test library.How are the tests organized?Each atomic test is tied to a specific MITRE ATT&CK technique ID, so you can look up a technique and find a matching, ready-to-run test procedure for it.
Each atomic test is tied to a specific MITRE ATT&CK technique ID, so you can look up a technique and find a matching, ready-to-run test procedure for it.Is there a quick way to try it without setting anything up locally?Yes, the repo supports contributing to and running Linux atomics directly from GitHub Codespaces, no local environment needed.
Yes, the repo supports contributing to and running Linux atomics directly from GitHub Codespaces, no local environment needed.What are similar projects?Decepticon, Claude-AD, beef, Claude-Red, unleashed-firmware, bug-bounty-hunting-prompts, CVE-2026-62911, metasploit-framework
Decepticon, Claude-AD, beef, Claude-Red, unleashed-firmware, bug-bounty-hunting-prompts, CVE-2026-62911, metasploit-frameworkWhich topics is it in?mitre-attack, offensive-security, red-team, ruby, pentesting, penetration-testing, hacking, ci, cybersecurity, security-tools, c, testing
mitre-attack, offensive-security, red-team, ruby, pentesting, penetration-testing, hacking, ci, cybersecurity, security-tools, c, testing