Atomic Red Team
A library of portable security detection tests mapped to MITRE ATT&CK techniques.
- Stars
- 12.8k
- Forks
- 3.2k
- Licence
- MIT
- Language
- C
- Last update
- 5 days ago
- Type
- Learning resource
What it is
Atomic Red Team is a collection of small tests, each mapped to a technique in the MITRE ATT&CK framework, which is a public catalog of how attackers behave. Security teams use the tests to check whether their systems would notice those behaviors, and the README says they are meant to be quick, portable, and repeatable.
- Run a single atomic test from the command line to see whether endpoint monitoring reports it
- Look up which tests map to a given MITRE ATT&CK technique
- Use the tests as a starting point for validating security detections
Great for
- Security teams testing whether their detection tools catch ATT&CK techniques
- Detection engineers who want small, repeatable test cases
- Teams that want to run tests directly from the command line without installing anything
Not ideal for
- People looking for a general-purpose app or library to build software with, since this is a set of security tests
- Anyone who needs a full testing platform by itself; the README points to Invoke-Atomic for a more robust experience
How to get it
- 1
See the README
Clone the repository
git clone https://github.com/redcanaryco/atomic-red-team - 2
Run it
- Read the Getting Started page in the project wiki
- Choose a test mapped to an ATT&CK technique you want to check
- Run the test from the command line in a safe, authorized test environment
- Review the results in your security tooling to see whether it was detected
- 3
Get the most out of it
- Use the wiki's Getting Started page for command-line execution instructions
- Consider Invoke-Atomic for a more robust testing experience, as the README suggests
- Sign up for the Atomic newsletter to stay updated on changes
Downloads
Strengths
- Tests are small and designed to be portable, according to the description
- Mapped to the widely used MITRE ATT&CK framework
- Open source under the MIT license with an active community and Slack workspace
Trade-offs
- The README is short and does not list the tests or their platform coverage, so details must be checked in the wiki
- Running attack-like tests requires care and authorization in the environment where they run
- The README mentions a more robust framework, so the bare tests may not cover full workflows
Stats synced from GitHub. The assessment above was drafted with AI from the project's README on 2026-10-29 and may miss recent changes — check the README before relying on a command. MIT licence: free to use, modify and distribute, including commercially, as long as you keep the copyright notice.