redcanaryco/atomic-red-team
Atomic Red Team
Atomic Red Team is an adversary simulation tool and detection validation suite designed to emulate attacker behaviors. It functions as a security control testing framework that uses a library of portable tests to verify if security monitoring and alerting systems correctly identify specific malicious techniques.
The project serves as a MITRE ATT&CK emulation framework, mapping individual test executions to a standardized industry taxonomy of adversary behaviors. This mapping allows for the validation of security controls against the MITRE ATT&CK matrix to identify gaps in detection and response capabilities.
The system covers security detection engineering and control verification by executing attack patterns through shell-based commands. These tests are defined as structured data files and can be run within containerized environments or via cloud-based development containers to ensure consistent results across different hosts.
Features
- Adversary Emulation Tools - Provides modular scripts that mimic real-world attacker behaviors to test security monitoring and alerting.
- Adversary Technique Mappings - Aligns individual security tests with the MITRE ATT&CK taxonomy to identify gaps in detection capabilities.
- Adversary Emulation Frameworks - Implements a library of portable security tests mapped to the MITRE ATT&CK matrix for validating detection capabilities.
- Security Testing - Provides a standardized system for executing attack patterns to find gaps in endpoint and network security visibility.
- Security Testing Tools - Provides portable tests that mimic threat actor methods to verify that security tools function as expected.
- Security Detection Test Suites - Ships a collection of atomic tests used to verify that security software correctly identifies malicious techniques.
- Framework-Based Validation - Tests security controls against the MITRE ATT&CK framework to identify gaps in detection and response.
- Shell Command Execution - Executes portable shell commands across different operating systems to trigger and verify security alerts.
- YAML-Based Task Definitions - Uses YAML-formatted files to declaratively define attack techniques, shell commands, and expected security outcomes.
- Threat Simulation Tools - Library of small, portable tests mapped to adversary tactics.
- Adversary Simulation - Portable detection tests based on MITRE ATT&CK.
- Adversary Emulation - Executes detection tests mapped to the MITRE ATT&CK framework.
- General Security Utilities - Library of tests mapped to the ATT&CK framework for security validation.
- Adversary Emulation - Portable detection tests mapped to the MITRE ATT&CK framework.
- Blue Team Tools - Detection tests based on MITRE ATT&CK.
- Detection Engineering - Library of tests mapped to MITRE ATT&CK techniques.
- Penetration Testing Toolkits - A library of tests mapped to the MITRE ATT&CK framework.
- Vulnerability Scanning and Auditing - Library of tests mapped to adversary tactics.
Star history
How this analysis was created: This summary and feature list are AI-generated from collected project material and can contain mistakes. Stars, license and language are imported from GitHub. Inclusion does not mean that we have tested or audited this project. Check the source documentation for any feature you depend on. Learn more on our About page.
