Atomic Red Team cheatsheet

Atomic Red Team is an open-source library of small, portable tests mapped directly to the MITRE ATT&CK framework. Maintained by Red Canary, each "atomic" is a focused test that exercises a single technique, making it ideal for purple team validation and detection engineering.

• Tests are organized by technique ID (e.g., T1059.001)
• Each test includes description, supported platforms, commands, and cleanup
• Works on Windows, Linux, and macOS

Install the PowerShell execution framework and the atomics folder containing all test definitions.

# Install the Invoke-AtomicRedTeam module
Install-Module -Name invoke-atomicredteam -Scope CurrentUser -Force

# Install the atomics folder (test definitions) - Install-AtomicRedTeam ships with the module above
Import-Module invoke-atomicredteam -Force
Install-AtomicRedTeam -getAtomics

# Or clone the repo directly
git clone https://github.com/redcanaryco/atomic-red-team.git C:\AtomicRedTeam

After installation, import the module and set the atomics path so the framework knows where to find test definitions.

# Import the module
Import-Module invoke-atomicredteam

# Set the default atomics path
$PSDefaultParameterValues = @{
  "Invoke-AtomicTest:PathToAtomicsFolder" = "C:\AtomicRedTeam\atomics"
}

# Verify installation
Get-Module invoke-atomicredteam

PowerShell execution policy must allow script execution. Set this before running any atomics.

# Allow script execution for current user
Set-ExecutionPolicy -ExecutionPolicy Bypass -Scope CurrentUser -Force

# Or for the entire machine (requires admin)
Set-ExecutionPolicy -ExecutionPolicy Bypass -Scope LocalMachine -Force

# Verify
Get-ExecutionPolicy -List

The primary command for running atomic tests. Supports multiple modes of operation.

# Run all tests for a technique
Invoke-AtomicTest T1059.001

# Show detailed description of all tests
Invoke-AtomicTest T1059.001 -ShowDetails

# Show brief one-line summary per test
Invoke-AtomicTest T1059.001 -ShowDetailsBrief

# Check if prerequisites are met
Invoke-AtomicTest T1059.001 -CheckPrereqs

# Automatically install prerequisites
Invoke-AtomicTest T1059.001 -GetPrereqs

# Run cleanup commands after testing
Invoke-AtomicTest T1059.001 -Cleanup

Each technique can have multiple tests numbered sequentially. Target specific tests by number.

# Run only the first test
Invoke-AtomicTest T1059.001 -TestNumbers 1

# Run tests 1 and 3
Invoke-AtomicTest T1059.001 -TestNumbers 1,3

# Run tests 2 through 5
Invoke-AtomicTest T1059.001 -TestNumbers 2,3,4,5

# Check prereqs for a specific test
Invoke-AtomicTest T1059.001 -TestNumbers 2 -CheckPrereqs

Some tests may hang or take too long. Use timeout to enforce a maximum execution time in seconds.

# Set a 30-second timeout
Invoke-AtomicTest T1059.001 -TimeoutSeconds 30

# Timeout with specific test
Invoke-AtomicTest T1003.001 -TestNumbers 1 -TimeoutSeconds 120

# Short timeout for quick validation
Invoke-AtomicTest T1082 -TimeoutSeconds 10

Override default test parameters with custom values using InputArgs.

# Override a single argument
Invoke-AtomicTest T1136.001 -InputArgs @{
  "username" = "testadmin"
  "password" = "P@ssw0rd123!"
}

# Override output file path
Invoke-AtomicTest T1005 -TestNumbers 1 -InputArgs @{
  "output_file" = "C:\Temp\collected.txt"
}

# Multiple overrides
Invoke-AtomicTest T1021.001 -InputArgs @{
  "remote_host" = "10.0.0.50"
  "username"    = "admin"
  "password"    = "Spring2026!"
}

Enable structured logging to capture test execution results for reporting and analysis.

# Enable default logging module
Invoke-AtomicTest T1059.001 -LoggingModule "Default"

# Specify custom log path
Invoke-AtomicTest T1059.001 -ExecutionLogPath "C:\Logs\atomic-log.csv"

# Combine logging with test execution
Invoke-AtomicTest T1003.001 -TestNumbers 1 `
  -LoggingModule "Default" `
  -ExecutionLogPath "C:\Logs\credaccess.csv"

# Attire logging format (structured JSON)
Invoke-AtomicTest T1059.001 `
  -LoggingModule "Attire-ExecutionLogger" `
  -ExecutionLogPath "C:\Logs\attire-log.json"

Standard workflow: check prerequisites, run the test, then clean up artifacts.

# Full workflow for a single technique
$technique = "T1547.001"

# Step 1 - Check and install prereqs
Invoke-AtomicTest $technique -GetPrereqs

# Step 2 - Run the test
Invoke-AtomicTest $technique

# Step 3 - Cleanup artifacts
Invoke-AtomicTest $technique -Cleanup

# One-liner: run all tests for a technique in sequence
Invoke-AtomicTest T1053.005 -GetPrereqs; `
Invoke-AtomicTest T1053.005; `
Invoke-AtomicTest T1053.005 -Cleanup

Techniques simulating how attackers gain their first foothold in a target environment.

Invoke-AtomicTest T1566.001
Invoke-AtomicTest T1566.002
Invoke-AtomicTest T1078

Techniques for running adversary-controlled code on local or remote systems.

Invoke-AtomicTest T1059.001
Invoke-AtomicTest T1059.003
Invoke-AtomicTest T1204.002

Techniques to maintain access across reboots, credential changes, or other disruptions.

Invoke-AtomicTest T1547.001
Invoke-AtomicTest T1053.005
Invoke-AtomicTest T1136.001

Techniques for gaining higher-level permissions on a system or network.

Invoke-AtomicTest T1548.002
Invoke-AtomicTest T1134.001
Invoke-AtomicTest T1134.002

Techniques used to avoid detection by security tools and analysts.

Invoke-AtomicTest T1562.001
Invoke-AtomicTest T1070.001
Invoke-AtomicTest T1218.011

Techniques for stealing credentials such as passwords, hashes, and tokens.

Invoke-AtomicTest T1003.001
Invoke-AtomicTest T1558.003
Invoke-AtomicTest T1552.001

Techniques used by adversaries to learn about the target environment.

Invoke-AtomicTest T1087.001
Invoke-AtomicTest T1082
Invoke-AtomicTest T1016
Invoke-AtomicTest T1049

Techniques for moving through the network to reach target systems.

Invoke-AtomicTest T1021.001
Invoke-AtomicTest T1021.002
Invoke-AtomicTest T1021.006

Techniques for gathering data of interest prior to exfiltration.

Invoke-AtomicTest T1560.001
Invoke-AtomicTest T1005
Invoke-AtomicTest T1115

Techniques for stealing data from the target environment.

Invoke-AtomicTest T1041
Invoke-AtomicTest T1048.003
Invoke-AtomicTest T1567.002

Run all techniques associated with a MITRE tactic in sequence, with cleanup between each test.

# Discovery techniques batch run
$discoveryTechniques = @(
  "T1087.001", "T1082", "T1016",
  "T1049", "T1083", "T1057"
)

foreach ($t in $discoveryTechniques) {
  Write-Host "[*] Running $t" -ForegroundColor Cyan
  Invoke-AtomicTest $t -GetPrereqs
  Invoke-AtomicTest $t -TimeoutSeconds 60
  Start-Sleep -Seconds 5
  Invoke-AtomicTest $t -Cleanup
  Write-Host "[+] Completed $t" -ForegroundColor Green
}

Run multiple techniques while capturing structured execution logs for post-analysis.

$logDir = "C:\Logs\AtomicResults"
New-Item -Path $logDir -ItemType Directory -Force

$techniques = @(
  "T1059.001", "T1547.001", "T1003.001",
  "T1562.001", "T1082"
)

$timestamp = Get-Date -Format "yyyyMMdd-HHmmss"

foreach ($t in $techniques) {
  $logFile = "$logDir\${t}_${timestamp}.csv"
  Write-Host "[*] Executing $t - Log: $logFile"

  Invoke-AtomicTest $t -GetPrereqs
  Invoke-AtomicTest $t `
    -LoggingModule "Default" `
    -ExecutionLogPath $logFile `
    -TimeoutSeconds 120

  Start-Sleep -Seconds 3
  Invoke-AtomicTest $t -Cleanup
}

Write-Host "[+] Batch complete. Logs in $logDir"

Full script template for an automated purple team exercise with reporting.

# weekly-atomic.ps1 - Automated purple team
param(
  [string]$LogDir = "C:\Logs\PurpleTeam",
  [int]$Timeout = 120
)

Import-Module invoke-atomicredteam
$timestamp = Get-Date -Format "yyyyMMdd-HHmmss"
$runDir = "$LogDir\run-$timestamp"
New-Item -Path $runDir -ItemType Directory -Force

# Define test matrix - technique and test numbers
$testMatrix = @(
  @{ Tech = "T1059.001"; Tests = @(1,2) },
  @{ Tech = "T1547.001"; Tests = @(1) },
  @{ Tech = "T1003.001"; Tests = @(1) },
  @{ Tech = "T1082";     Tests = @(1,2,3) },
  @{ Tech = "T1562.001"; Tests = @(1) }
)

$results = @()
foreach ($entry in $testMatrix) {
  $t = $entry.Tech
  foreach ($num in $entry.Tests) {
    $logFile = "$runDir\${t}_test${num}.csv"
    try {
      Invoke-AtomicTest $t -TestNumbers $num `
        -GetPrereqs
      Invoke-AtomicTest $t -TestNumbers $num `
        -LoggingModule "Default" `
        -ExecutionLogPath $logFile `
        -TimeoutSeconds $Timeout
      $status = "Success"
    } catch {
      $status = "Failed: $_"
    } finally {
      Invoke-AtomicTest $t -TestNumbers $num `
        -Cleanup
    }
    $results += [PSCustomObject]@{
      Technique  = $t
      TestNumber = $num
      Status     = $status
      LogFile    = $logFile
    }
  }
}

# Export summary
$results | Export-Csv "$runDir\summary.csv" -NoType
Write-Host "[+] Run complete: $runDir"

The core loop of purple teaming: execute a known attack, check if your defenses detected it, and record the results.

1. Select technique (e.g., T1003.001 - LSASS dump)
2. Document expected detection sources
   - EDR alert, SIEM rule, log event
3. Run the atomic test
   Invoke-AtomicTest T1003.001 -TestNumbers 1
4. Wait for log ingestion (30s - 5min)
5. Query SIEM/EDR for detection
6. Record result: Detected / Partial / Missed
7. Cleanup
   Invoke-AtomicTest T1003.001 -Cleanup
8. If missed - create or tune detection rule
9. Re-test to confirm new detection works

Areas where security tooling frequently fails to alert. Focus validation efforts on these first.

Map atomic test results to Sigma rules to track which detections cover which techniques.

# Example: Find Sigma rules for a technique
# Sigma rules repo: github.com/SigmaHQ/sigma

# Search for rules covering T1003.001
Get-ChildItem -Path "C:\sigma\rules" -Recurse `
  -Filter "*.yml" |
  Select-String "T1003.001" |
  Select-Object -ExpandProperty Path

# Cross-reference matrix
$coverage = @(
  [PSCustomObject]@{
    Technique = "T1003.001"
    SigmaRule = "win_lsass_access.yml"
    AtomicTest = 1
    Detected  = $true
  },
  [PSCustomObject]@{
    Technique = "T1059.001"
    SigmaRule = "win_powershell_suspicious.yml"
    AtomicTest = 2
    Detected  = $false
  }
)
$coverage | Format-Table -AutoSize

For SIEM-specific query examples after running atomics (Splunk SPL, Elastic KQL, Sentinel KQL), see the MITRE ATT&CK Detection Engineering section and the Sigma cheatsheet for cross-SIEM detection rules.

• Atomic Red Team GitHub
• MITRE ATT&CK
• Red Canary Blog
• Invoke-AtomicRedTeam Wiki
• Red Canary Threat Detection Report
• Atomic Test Harnesses

• MITRE ATT&CK (Framework reference, APT groups, detection EIDs, coverage matrix)
• Sigma (Cross-SIEM detection rules + Rule Builder widget)
• Caldera (Automated adversary emulation platform)
• Velociraptor (DFIR and threat hunting with VQL)
• Purple Team Toolkit (Purple team workflow and tool selection)
• EDR Evasion (Bypass techniques that atomics may trigger)
• AMSI (PowerShell AMSI bypass for atomic execution)