Atomic Red Team is a library of portable detection tests mapped to the MITRE ATT&CK framework that security teams use to validate their defensive capabilities.
The tool addresses the challenge of testing whether security controls can detect known adversarial techniques. It provides small, self-contained tests that simulate tactics and procedures from the ATT&CK framework, allowing teams to execute them directly from the command line without installation and verify that their detection systems respond appropriately. Tests are organized by ATT&CK technique, making it straightforward to map coverage gaps to the framework.
Security teams should adopt this tool if they need to validate detection coverage across their environment in a reproducible, portable manner. It suits organizations that want to move beyond theoretical security assessments and run actual simulated attacks to confirm their monitoring and alerting work. The project acknowledges that for more sophisticated testing workflows, users may want to layer an execution framework like Invoke-Atomic on top of the atomic tests themselves.
The project maintains an active validation pipeline that checks atomics for correctness. Community contribution is actively encouraged through a dedicated Slack workspace, a structured contribution guide, and support for contributors working through GitHub Codespaces. The tool is open source and community developed, with a clear code of conduct and established processes for reporting issues and submitting new tests.
