网有NETHAVE
AGENT SKILL

performing-threat-emulation-with-atomic-red-team

Executes Atomic Red Team tests for MITRE ATT&CK technique validation using the atomic-operator Python framework. Loads test definitions from YAML atomics, runs attack simulations, and validates detection coverage. Use when testing SIEM detection rules, validating EDR coverage, or conducting purple team exercises.

使用场景测试与质量
License 许可
Apache-2.0
最近更新
2026-08-31
Stars
★ 3.6w
Forks
4.4k

01 前言 Front Matter

name
performing-threat-emulation-with-atomic-red-team
tags
[ "threat-emulation", "atomic-red-team", "mitre-attack", "adversary-emulation", "atomic-operator", "purple-team" ]
author
mahipal
domain
cybersecurity
license
Apache-2.0
version
1.0
nist_csf
[ "ID.RA-01", "ID.RA-05", "DE.CM-01", "DE.AE-02" ]
subdomain
threat-intelligence
description
Executes Atomic Red Team tests for MITRE ATT&CK technique validation using the atomic-operator Python framework. Loads test definitions from YAML atomics, runs attack simulations, and validates detection coverage. Use when testing SIEM detection rules, validating EDR coverage, or conducting purple team exercises.
nist_ai_rmf
[ "MEASURE-2.7", "MAP-5.1", "MANAGE-2.4" ]
mitre_attack
[ "T1591", "T1592", "T1593", "T1589", "T1685.002" ]
atlas_techniques
[ "AML.T0070", "AML.T0066", "AML.T0082" ]
d3fend_techniques
[ "Executable Denylisting", "Execution Isolation", "File Metadata Consistency Validation", "Content Format Conversion", "File Content Analysis" ]

02 资源文件 149

03 SKILL.md 正文

Performing Threat Emulation with Atomic Red Team

When to Use

  • When conducting security assessments that involve performing threat emulation with atomic red team
  • When following incident response procedures for related security events
  • When performing scheduled security testing or auditing activities
  • When validating security controls through hands-on testing

Prerequisites

  • Familiarity with threat intelligence concepts and tools
  • Access to a test or lab environment for safe execution
  • Python 3.8+ with required dependencies installed
  • Appropriate authorization for any testing activities

Instructions

Use atomic-operator to execute Atomic Red Team tests and validate detection coverage against MITRE ATT&CK techniques.

from atomic_operator import AtomicOperator

operator = AtomicOperator()
# Run a specific technique test
operator.run(
    technique="T1059.001",  # PowerShell execution
    atomics_path="./atomic-red-team/atomics",
)

Key workflow:

  1. Clone the atomic-red-team repository for test definitions
  2. Select ATT&CK techniques matching your detection rules
  3. Execute atomic tests using atomic-operator
  4. Check SIEM/EDR for corresponding alerts
  5. Document detection gaps and update rules

Examples

# Parse atomic test YAML definitions
import yaml
with open("atomics/T1059.001/T1059.001.yaml") as f:
    tests = yaml.safe_load(f)
for test in tests.get("atomic_tests", []):
    print(f"Test: {test['name']}")
    print(f"  Platforms: {test.get('supported_platforms', [])}")

04 同仓库更多 Skills

mukul975
mukul975/Anthropic-Cybersecurity-Skills

verifying-build-provenance-with-slsa-sigstore

Verifies artifact signatures and SLSA provenance using Sigstore's cosign (verify, verify-attestation, verify-blob-attestation) and slsa-verifier (verify-artifact), enforcing keyless OIDC builder identity and source repo against SLSA Build levels. Use in CI/CD before deploying artifacts, when consuming third-party attestations, establishing a SLSA Build L3 pipeline, or confirming provenance during incident response or admission control.

Skill与智能体开发
★ 3.6w
mukul975
mukul975/Anthropic-Cybersecurity-Skills

validating-tpm-measured-boot-attestation

Verifies TPM 2.0 measured-boot integrity and remote attestation with tpm2-tools -- reading PCRs (tpm2_pcrread), replaying the boot event log, generating and checking signed quotes (tpm2_quote/tpm2_checkquote), and sealing secrets to a PCR policy. Use to confirm a system booted trusted firmware/kernel for Zero Trust device posture, detect boot-chain tampering via PCR drift, or build a golden-value baseline for fleet attestation.

Skill与智能体开发
★ 3.6w
mukul975
mukul975/Anthropic-Cybersecurity-Skills

validating-backup-integrity-for-recovery

Validates backup integrity through cryptographic hash verification, automated restore testing, corruption detection, and recoverability checks to confirm backups are reliable for disaster recovery and ransomware response. Use before relying on backups for recovery, when building post-backup validation pipelines, auditing backup infrastructure for compliance, or checking immutable/air-gapped backups for silent corruption or tampering.

测试与质量Skill与智能体开发
★ 3.6w
mukul975
mukul975/Anthropic-Cybersecurity-Skills

triaging-windows-with-kape

Runs KAPE (Kroll Artifact Parser and Extractor) to collect targeted forensic artifacts (registry hives, $MFT, event logs, prefetch, browser data) via Targets and parse them with Modules wrapping Eric Zimmerman's EZ Tools (PECmd, MFTECmd, RECmd). Use during early incident containment/triage when full disk imaging is impractical but a defensible, parseable Windows artifact set is needed quickly, including at-scale remote collection.

Skill与智能体开发
★ 3.6w
mukul975
mukul975/Anthropic-Cybersecurity-Skills

triaging-vulnerabilities-with-ssvc-framework

Triages and prioritizes vulnerabilities with CISA's Stakeholder-Specific Vulnerability Categorization (SSVC) decision tree, weighing exploitation status (via the CISA KEV catalog and FIRST EPSS API), technical impact, automatability, and mission prevalence to output Track/Track*/Attend/Act decisions. Use when prioritizing vulnerability scan results (OpenVAS, Nessus, Qualys) for remediation planning beyond raw CVSS scores.

Skill与智能体开发
★ 3.6w
mukul975
mukul975/Anthropic-Cybersecurity-Skills

triaging-security-incident

Performs initial triage of security incidents using the NIST SP 800-61r3 and SANS PICERL frameworks, classifying incident type, assigning priority by business impact, and routing to the appropriate response team. Use when a SIEM/EDR alert needs human classification, concurrent alerts must be prioritized, or a user report or threat-intel IOC match requires initial incident categorization.

Skill与智能体开发
★ 3.6w