Atomic Red Team

Health v2 · maintenance only

Flags: no_releases

Adoption not part of the score

12457 stars · 3198 forks observed · 2026-08-28

What it is AI-extracted, prompt v1, taxonomy v1, 2026-08-29, confidence not recorded

Atomic Red Team is a library of small, portable detection tests mapped to the MITRE ATT&CK framework, letting security teams validate their defenses reproducibly. It includes an execution framework (Invoke-AtomicRedTeam) for running tests from the command line or automation.

Use cases

• test whether my EDR detects ATT&CK techniques
• simulate adversary techniques to validate detections
• run MITRE ATT&CK mapped tests against my environment
• validate security controls with reproducible attack tests
• automate purple team exercises
• test detection coverage for specific ATT&CK tactics

When to choose

• you need portable, scriptable detection tests mapped to MITRE ATT&CK
• you want to validate EDR or SIEM detections without a full red team
• you are running purple team or continuous security validation programs

When to avoid

• you need a full adversary emulation platform with multi-stage attack chains
• you want a passive vulnerability scanner rather than active technique execution
• you lack authorization to execute attack techniques in the target environment

Facets

library · maturity active

testing security penetration-testing security developer-tools testing cross-platform windows cli mitre-attack detection-testing adversary-simulation red-team threat-detection invoke-atomicredteam linux macos

Member repositories

For agents

markdown · JSON · MCP: product_card(name="redcanaryco/atomic-red-team")