How kaushalrog/atomic-red-team works
Atomic Red Team is a library of portable security tests mapped to MITRE ATT&CK. The main workflow is to choose a technique and atomic test, run its documented command directly on a target environment, and observe the resulting behavior for security testing. The repository also has a Ruby library for discovering and validating test definitions, plus Python runtime modules indicated by the tree. The README establishes direct execution; sampled source shows individual test implementations. The excerpts do not establish how the Python modules are wired into execution.
Main entry points: atomics Atomic definitions · atomic_red_team.rb Atomic test API · runner.py Execution runner · src Test implementations
Components 11
Test catalog
- Atomic definitions
atomics - Test implementations
atomics/T1071/src
Library API
- Atomic test API
atomic_red_team/atomic_red_team.rb - ATT&CK API
atomic_red_team/attack_api.rb - Test models
atomic_red_team/models.py - Definition validator
atomic_red_team/validator.py
Test execution
- Execution runner
atomic_red_team/runner.py
Other components
- Security team
- MITRE ATT&CK
- Test environment
- Security observations
Connections 9
- Security team → Atomic definitions: selects test
- Atomic definitions → MITRE ATT&CK: maps techniques
- Atomic test API → Atomic definitions: discovers tests
- Atomic test API → ATT&CK API: resolves techniques
- Definition validator → Atomic definitions: validates metadata
- Security team → Execution runner: runs directly
- Execution runner → Test environment: executes tests
- Test implementations → Test environment: produce behavior
- Test environment → Security observations: exposes behavior