redcanaryco/atomic-red-team
Atomic Red Team
Atomic Red Team is an adversary simulation tool and detection validation suite designed to emulate attacker behaviors. It functions as a security control testing framework that uses a library of portable tests to verify if security monitoring and alerting systems correctly identify specific malicious techniques.
The project serves as a MITRE ATT&CK emulation framework, mapping individual test executions to a standardized industry taxonomy of adversary behaviors. This mapping allows for the validation of security controls against the MITRE ATT&CK matrix to identify gaps in detection and response capabilities.
The system covers security detection engineering and control verification by executing attack patterns through shell-based commands. These tests are defined as structured data files and can be run within containerized environments or via cloud-based development containers to ensure consistent results across different hosts.
Features
- Adversary Emulation Tools - Provides modular scripts that mimic real-world attacker behaviors to test security monitoring and alerting.
- Adversary Technique Mappings - Aligns individual security tests with the MITRE ATT&CK taxonomy to identify gaps in detection capabilities.
- Adversary Emulation Frameworks - Implements a library of portable security tests mapped to the MITRE ATT&CK matrix for validating detection capabilities.
- Security Testing - Provides a standardized system for executing attack patterns to find gaps in endpoint and network security visibility.
- Security Testing Tools - Provides portable tests that mimic threat actor methods to verify that security tools function as expected.
- Security Detection Test Suites - Ships a collection of atomic tests used to verify that security software correctly identifies malicious techniques.
- Framework-Based Validation - Tests security controls against the MITRE ATT&CK framework to identify gaps in detection and response.
- Shell Command Execution - Executes portable shell commands across different operating systems to trigger and verify security alerts.
- YAML-Based Task Definitions - Uses YAML-formatted files to declaratively define attack techniques, shell commands, and expected security outcomes.
- Threat Simulation Tools - Library of small, portable tests mapped to adversary tactics.
- Adversary Simulation - Portable detection tests based on MITRE ATT&CK.
- Adversary Emulation - Executes detection tests mapped to the MITRE ATT&CK framework.
- General Security Utilities - Library of tests mapped to the ATT&CK framework for security validation.
- Adversary Emulation - Portable detection tests mapped to the MITRE ATT&CK framework.
- Blue Team Tools - Detection tests based on MITRE ATT&CK.
- Detection Engineering - Library of tests mapped to MITRE ATT&CK techniques.
- Penetration Testing Toolkits - A library of tests mapped to the MITRE ATT&CK framework.
- Vulnerability Scanning and Auditing - Library of tests mapped to adversary tactics.
