Atomic Red Team

What it is

A collection of small, focused checks, each tied to a technique in MITRE ATT&CK, that a team can run in minutes to see whether a behavior is caught.

What it helps with

- Checking whether sensors and alerts catch specific attacker techniques
- Running quick, repeatable tests with matching cleanup commands
- Covering Windows, Linux, and macOS behaviors from one library

Who it's for

Blue teams, detection engineers, and purple teams validating coverage on systems they own or are authorized to test.

Worth knowing

Tests run from the command line or through the separate Invoke-Atomic runner. It ships the tests themselves, not a scoring or reporting console.

Does it have numbered releases?
No. The library updates continuously as new tests are added.

How big is the library?
It includes well over a thousand individual tests.

Who publishes it?
Red Canary maintains the project together with the wider community.