skills.rest
xalgord
xalgordCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

performing-purple-team-atomic-testing

Executes Atomic Red Team tests and validates SIEM detection coverage against MITRE ATT&CK techniques.

954|172|Updated Mar 13, 2026
Search Tags:#mitre att&ck#detection engineering#adversary emulation#purple team#atomic red team#coverage gap analysis#siem validation
One-click install
npx skills add https://github.com/xalgord/xalgorix --skill performing-purple-team-atomic-testing
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: performing-purple-team-atomic-testing
Source: https://github.com/xalgord/xalgorix/tree/main/internal/tools/skills/data/purple-team/performing-purple-team-atomic-testing
Command: npx skills add https://github.com/xalgord/xalgorix --skill performing-purple-team-atomic-testing

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires mitreattack-python, pyyaml, requests.

What problem does it solve?

Security teams often cannot tell whether their SIEM and EDR actually detect real attack techniques, because a test executing successfully does not prove an alert fired. This Skill closes that gap by running Atomic Red Team tests mapped to MITRE ATT&CK, querying the SIEM for matching alerts, and producing coverage gap analysis and ATT&CK Navigator heatmaps.

Core Features & Use Cases

  • Atomic Test Execution: Run Invoke-AtomicRedTeam tests by technique ID, test number, name, or GUID with prerequisite checks, timeouts, structured JSON logging, and mandatory cleanup.
  • Detection Validation: Query Splunk (SPL) or Elastic (KQL) for the specific EventCodes and artifacts each technique should generate, distinguishing raw telemetry from actual fired alerts.
  • Coverage Gap Analysis & Heatmaps: Parse atomics YAML inventory, correlate execution logs with detection results, and generate per-tactic coverage reports plus ATT&CK Navigator layer JSON for executive reporting.
  • Use Case: A detection engineer runs the top 10 prevalent ATT&CK techniques (T1059.001, T1003.001, T1547.001) on a lab endpoint, waits for SIEM ingestion, then generates a Navigator heatmap showing which techniques are blind spots requiring new Sigma rules.

Quick Start

Ask the AI to execute Atomic Red Team test T1059.001 on a Windows lab host, verify the corresponding PowerShell alert in Splunk, and generate an ATT&CK Navigator coverage layer.

Frequently Asked Questions about performing-purple-team-atomic-testing

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I run Atomic Red Team tests with PowerShell?▼

Install the Invoke-AtomicRedTeam module from PSGallery, clone the atomics repository, then run Invoke-AtomicTest with a technique ID such as T1059.001. Use -CheckPrereqs and -GetPrereqs before execution and always run -Cleanup afterward to remove artifacts.

How do I validate that my SIEM detects an atomic test?▼

After executing the test, wait for log ingestion delay, then query Splunk with SPL or Elastic with KQL for the relevant EventCode, such as 4104 for PowerShell script blocks or 4688/1 for process creation. A detection is confirmed only when a rule fired and an alert was created, not merely when raw telemetry exists.

What is ATT&CK coverage gap analysis?▼

It compares the set of techniques with available atomic tests against those actually executed and those detected by your SIEM, producing per-tactic coverage percentages. Techniques executed but not detected are flagged as blind spots requiring new detection rules.

Can Atomic Red Team tests run on Linux and macOS?▼

Yes, many atomics support Linux and macOS in addition to Windows, and PowerShell Core 7+ enables cross-platform execution. Each test's YAML file lists its supported_platforms, which you can enumerate programmatically before selecting targets.

When should I not use Atomic Red Team for adversary emulation?▼

Atomic tests are unsuitable for full-scope red team engagements requiring custom implants, chained multi-stage attacks, or live adversary simulation. Use Caldera, SCYTHE, or Cobalt Strike for advanced adversary emulation beyond discrete technique tests.

Why does an atomic test succeed but no alert appears in the SIEM?▼

Common causes include missing prerequisites causing silent no-ops, log ingestion delay, telemetry being logged without any rule firing, or the endpoint not forwarding the relevant event source. Verify execution logs, wait for ingestion, and confirm a rule actually produced an alert.

Related Skills

Explore More Software Engineering Skills→
GhostPWNGhostPWN
4

Log Analysis & SIEM Integration

Parse security logs and generate SIEM detection queries for Splunk, Elastic, QRadar, Sentinel, and Sigma.

Official
Advanced
briiirussellbriiirussell
345

siem-detection

Assess log source coverage, author Sigma rules, and translate to SIEM query languages.

Community
Advanced
copyleftdevcopyleftdev

mitre-attack-framework

Map adversary TTPs to MITRE ATT&CK techniques for detection engineering.

Community
Advanced
AeonDaveAeonDave
15

cobalt-strike

Deploy Cobalt Strike Beacon implants with customizable C2 profiles.

Community
Advanced