mcpField
P
performing-threat-emulation-with-atomic-red-team

performing-threat-emulation-with-atomic-red-team

github.com/mukul975Security35.2k70 installsUpdated 8w ago
Repository

About performing-threat-emulation-with-atomic-red-team

A security skill for running Atomic Red Team tests with atomic-operator and checking detection coverage against MITRE ATT&CK. It is intended for authorized assessments in test or lab environments.

Key features

  1. 01Run Atomic Red Team technique tests
  2. 02Select tests mapped to detection rules
  3. 03Check SIEM/EDR alerts
  4. 04Document detection gaps
  5. 05Parse atomic test YAML definitions

Use cases

  1. 01Validate detection of selected ATT&CK techniques
  2. 02Test security controls in a lab environment
  3. 03Check SIEM/EDR responses to simulated activity
  4. 04Identify gaps and update detection rules

Install

Copy the command and run it in a terminal.

$npx skills add https://github.com/mukul975/anthropic-cybersecurity-skills --skill performing-threat-emulation-with-atomic-red-team

After installing, type/performing-threat-emulation-with-atomic-red-teamin Claude Code to confirm it loaded.

Bundled files

References and scripts installed along with SKILL.md.

LICENSE
references/
api-reference.md
scripts/
agent.py

Details

From the project README

Performing Threat Emulation with Atomic Red Team

When to Use

  • When conducting security assessments that involve performing threat emulation with atomic red team
  • When following incident response procedures for related security events
  • When performing scheduled security testing or auditing activities
  • When validating security controls through hands-on testing

Prerequisites

  • Familiarity with threat intelligence concepts and tools
  • Access to a test or lab environment for safe execution
  • Python 3.8+ with required dependencies installed
  • Appropriate authorization for any testing activities

Instructions

Use atomic-operator to execute Atomic Red Team tests and validate detection coverage against MITRE ATT&CK techniques.

from atomic_operator import AtomicOperator

operator = AtomicOperator()
# Run a specific technique test
operator.run(
    technique="T1059.001",  # PowerShell execution
    atomics_path="./atomic-red-team/atomics",
)

Key workflow:

  1. Clone the atomic-red-team repository for test definitions
  2. Select ATT&CK techniques matching your detection rules
  3. Execute atomic tests using atomic-operator
  4. Check SIEM/EDR for corresponding alerts
  5. Document detection gaps and update rules

Examples

# Parse atomic test YAML definitions
import yaml
with open("atomics/T1059.001/T1059.001.yaml") as f:
    tests = yaml.safe_load(f)
for test in tests.get("atomic_tests", []):
    print(f"Test: {test['name']}")
    print(f"  Platforms: {test.get('supported_platforms', [])}")

Comments

Markdown supported