skills.rest
MHaggis
MHaggisCOMMUNITY
Explore all skills by this author →
Website𝕏@M_haggisGitHub

Atomic Red Team Testing

Execute and validate Atomic Red Team adversary emulation tests across SIEMs.

471|74|Updated Jan 13, 2026
Search Tags:#validation#security testing#mitre att&ck#detection engineering#adversary emulation#atomic red team
One-click install
npx skills add https://github.com/MHaggis/Security-Detections-MCP --skill atomic-red-team-testing
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: Atomic Red Team Testing
Source: https://github.com/MHaggis/Security-Detections-MCP/tree/main/.claude/skills/atomic-red-team-testing
Command: npx skills add https://github.com/MHaggis/Security-Detections-MCP --skill atomic-red-team-testing

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) and references (resource) components.

What problem does it solve?

This Skill automates the execution and validation of adversary emulation tests using Atomic Red Team, ensuring your security detections are effective against real-world attack techniques.

Core Features & Use Cases

  • Standard Atomic Execution: Run pre-defined tests for known MITRE ATT&CK techniques.
  • Custom Atomic Deployment: Create and execute your own tests (T9999.XXX) for specific detection scenarios.
  • Detection Validation: Verify that your SIEM rules correctly identify the telemetry generated by executed tests.
  • Use Case: A security analyst needs to confirm a newly written Splunk detection for T1059.001 (PowerShell execution) is working. They use this Skill to run a relevant Atomic Red Team test on a target endpoint, then query Splunk to ensure the expected logs are generated and the detection fires.

Quick Start

Use the Atomic Red Team Testing skill to execute test number 1 for technique T1059.001 on the target named 'ar-win-1'.

Frequently Asked Questions about Atomic Red Team Testing

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I validate SIEM detections using Atomic Red Team tests?▼

You can validate SIEM detections by executing Atomic Red Team adversary emulation tests on a target endpoint, then querying your SIEM platform to verify that expected logs are generated and detection rules fire correctly.

Can I create and execute custom adversary emulation tests for specific MITRE ATT&CK scenarios?▼

Yes, custom adversary emulation tests can be created and executed using custom atomic definitions like T9999.XXX, allowing you to validate specific detection engineering scenarios beyond standard pre-defined MITRE ATT&CK techniques.

What configuration is required to run Atomic Red Team tests remotely?▼

Remote execution and validation require configuring your SIEM platform, Attack Range environment, and atomic paths before triggering adversary emulation tests across target endpoints.

How does adversary emulation help with detection engineering workflows?▼

Adversary emulation automates the execution of real-world attack techniques against your environment, ensuring your security detections are effective and generating the telemetry needed to verify SIEM rules.

How do I execute a specific Atomic Red Team test for a technique like T1059.001?▼

You can execute a specific test by providing the technique identifier, such as T1059.001 for PowerShell execution, and the target endpoint name to run the corresponding atomic test and validate your detection.

Are there limitations when using standard atomics for detection validation?▼

Standard atomics cover known MITRE ATT&CK techniques but may not fit unique environments; creating custom atomics provides comprehensive detection engineering and testing for specific scenarios not covered by default tests.

Related Skills

Explore More Software Engineering Skills→
MHaggisMHaggis
471

Custom Atomics Deployment

Create, deploy, and execute custom Atomic Red Team YAML tests.

Community
Advanced
ensingm2ensingm2
12

threat-modeler

Apply STRIDE, MITRE ATT&CK, and Kill Chain frameworks to identify and model security threats.

Community
Advanced
MHaggisMHaggis
471

detection-test-engineer

Generate and execute security detection test scenarios across SIEM platforms.

Community
Advanced
vudovnvudovn
8.1k

red-team-tactics

Plan adversary simulations using MITRE ATT&CK aligned tactics.

Community
Basic