← LeaderboardThe Skill Leaderboard

performing-threat-emulation-with-atomic-red-team

Executes Atomic Red Team tests for MITRE ATT&CK technique validation using the atomic-operator Python framework. Loads test definitions from YAML atomics, runs attack simulations, and validates detection coverage. Use when testing SIEM detection rules, validating EDR coverage, or conducting purple team exercises.

Published by mukul975 ↗mukul975/Anthropic-Cybersecurity-Skills

Try your first task

performing-threat-emulation-with-atomic-red-team

Start a fresh conversation. Replace the highlighted placeholders.

Use performing-threat-emulation-with-atomic-red-team to run explicitly authorized Atomic Red Team detection-validation tests for [MITRE techniques] in [test or lab environment], then report detection coverage.

Required inputs

  • [MITRE techniques]
  • [test or lab environment]

User-approved starter prompt based on a pinned source version; check current skill requirements before running. Task evidence ↗

SKILL.md

name: performing-threat-emulation-with-atomic-red-teamdescription: 'Executes Atomic Red Team tests for MITRE ATT&CK technique validation  using the atomic-operator Python framework. Loads test definitions from YAML atomics,  runs attack simulations, and validates detection coverage. Use when testing SIEM  detection rules, validating EDR coverage, or conducting purple team exercises.  'domain: cybersecuritysubdomain: threat-intelligencetags: - threat-emulation- atomic-red-team- mitre-attack- adversary-emulation- atomic-operator- purple-teamversion: '1.0'author: mahipallicense: Apache-2.0nist_ai_rmf: - MEASURE-2.7- MAP-5.1- MANAGE-2.4atlas_techniques: - AML.T0070- AML.T0066- AML.T0082d3fend_techniques: - Executable Denylisting- Execution Isolation- File Metadata Consistency Validation- Content Format Conversion- File Content Analysisnist_csf: - ID.RA-01- ID.RA-05- DE.CM-01- DE.AE-02mitre_attack: - T1591- T1592- T1593- T1589- T1685.002

Performing Threat Emulation with Atomic Red Team

When to Use

  • When conducting security assessments that involve performing threat emulation with atomic red team
  • When following incident response procedures for related security events
  • When performing scheduled security testing or auditing activities
  • When validating security controls through hands-on testing

Prerequisites

  • Familiarity with threat intelligence concepts and tools
  • Access to a test or lab environment for safe execution
  • Python 3.8+ with required dependencies installed
  • Appropriate authorization for any testing activities

Instructions

Use atomic-operator to execute Atomic Red Team tests and validate detection coverage against MITRE ATT&CK techniques.

from atomic_operator import AtomicOperator

operator = AtomicOperator()
# Run a specific technique test
operator.run(
    technique="T1059.001",  # PowerShell execution
    atomics_path="./atomic-red-team/atomics",
)

Key workflow:

  1. Clone the atomic-red-team repository for test definitions
  2. Select ATT&CK techniques matching your detection rules
  3. Execute atomic tests using atomic-operator
  4. Check SIEM/EDR for corresponding alerts
  5. Document detection gaps and update rules

Examples

# Parse atomic test YAML definitions
import yaml
with open("atomics/T1059.001/T1059.001.yaml") as f:
    tests = yaml.safe_load(f)
for test in tests.get("atomic_tests", []):
    print(f"Test: {test['name']}")
    print(f"  Platforms: {test.get('supported_platforms', [])}")