Atomic Red Team

Overview

Atomic Red Team is a collection of small security tests intended to help teams check what their defenses can see and whether detection coverage exists. Each test represents an adversary behavior and is mapped to the MITRE ATT&CK matrix, so teams can exercise controls against individual techniques.

The project combines the test library with utilities for executing, validating, and documenting tests. Its tests have few dependencies and use a structured format that automation frameworks can consume. Atomic Red Team does not automatically recreate a specific threat group’s full operation; teams can chain tests manually when they need a broader sequence.

Execution requires authorization: users are instructed to obtain permission from the owner of the environment before running a test.

Key features

• ATT&CK mapping: Tests align with the MITRE ATT&CK matrix and cover Windows, Linux, macOS, cloud infrastructure, containers, SaaS, Azure AD, Google Workspace, Office 365, and IaaS providers. Cloud infrastructure tests are marked with iaas as a supported platform.
• Automation-friendly tests: Tests use a structured format and have few dependencies, making them usable with automation frameworks.
• PowerShell execution: Invoke-AtomicRedTeam is a PowerShell module for testing security controls against attack techniques. Invoke-AtomicTest can execute tests locally or on remote machines through PowerShell Remoting.
• Scheduled runs: Atomic Runner executes a configurable list of tests unattended, with weekly runs as its default schedule.
• Ruby API and ATT&CK data: The Ruby API helps validate tests and generate documentation. The project obtains ATT&CK data in STIX representation.
• Integrations: Listed products include Microsoft Defender for Endpoint, AttackIQ, Datadog Workload Security Evaluator, OpenBAS, Splunk Attack Range, and Tidal Cyber.
• Community updates: The public Slack Workspace’s #atomic-git channel posts notifications about new contributions.

Custom attack scenarios are supported, but group-level emulation is not automated. A team seeking to represent a sequence of behaviors must assemble the tests itself.

Pricing

Atomic Red Team is an open-source project with a free plan priced at 0.00 USD per free. The listed plan includes tests that run in five minutes or less, minimal setup, and community development.

Platforms

Listed platforms are API, Linux, macOS, and Windows. The project also lists cloud infrastructure, containers, SaaS, Azure AD, Google Workspace, Office 365, and IaaS providers among its covered attack surfaces. Its deployment model is on-premises.

Who it's for

Atomic Red Team is suited to security teams that want to validate visibility, exercise detection coverage, or emulate individual adversary techniques. Its ATT&CK mapping and automation-friendly test format support structured control checks, while Invoke-AtomicTest offers local and remote execution options. Teams should be prepared to manage permissions and assemble multi-test scenarios manually.

Pros and cons

• Pros: Free access; tests mapped to MITRE ATT&CK; broad listed attack-surface coverage; support for scheduled execution; and tests designed for automation.
• Cons: It does not automatically emulate a whole specific attack group, and test execution requires permission from the environment owner.

Alternatives

For more options, browse Breach and Attack Simulation Software. Other listed alternatives include OpenAEV, Keysight Eggplant Test, Infection Monkey, Picus Security Platform, SCYTHE, BlackNoise BAS, Cymulate Platform, and PurpleSharp.

Verdict

Atomic Red Team offers a free, ATT&CK-mapped set of tests with execution and scheduling tools for teams checking their defensive visibility and detection coverage. Its scope is individual behaviors rather than automated, end-to-end emulation of a particular attack group. Teams that need that broader scenario must chain tests themselves and should establish authorization before execution.