How do I install the Performing Threat Emulation With Atomic Red Team skill?

Run npx skillmds@latest add 26zl/performing-threat-emulation-with-atomic-red-team in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.

Is Performing Threat Emulation With Atomic Red Team safe to use?

This skill has not completed SkillMD's automated safety review yet. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.

Which AI agents work with Performing Threat Emulation With Atomic Red Team?

This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.

Is Performing Threat Emulation With Atomic Red Team free to use?

Yes. Installing skills from SkillMD is free. This skill is licensed under Apache-2.

Who published Performing Threat Emulation With Atomic Red Team?

26zl (@26zl) published this skill. Their other Agent Skills are listed on their SkillMD profile.

Performing Threat Emulation With Atomic Red Team by 26zl

Name: Performing Threat Emulation With Atomic Red Team
Author: 26zl

Performing Threat Emulation With Atomic Red Team

Executes Atomic Red Team tests for MITRE ATT&CK technique validation using the atomic-operator Python framework. Loads test definitions from YAML atomics, runs attack simulations, and validates detection coverage. Use when testing SIEM detection rules, validating EDR coverage, or conducting purple team exercises.

26zl Updated Sep 17, 2026

File contents

Performing Threat Emulation with Atomic Red Team

When to Use

When conducting security assessments that involve performing threat emulation with atomic red team
When following incident response procedures for related security events
When performing scheduled security testing or auditing activities
When validating security controls through hands-on testing

Prerequisites

Familiarity with threat intelligence concepts and tools
Access to a test or lab environment for safe execution
Python 3.8+ with required dependencies installed
Appropriate authorization for any testing activities

Instructions

Use atomic-operator to execute Atomic Red Team tests and validate detection coverage against MITRE ATT&CK techniques.

from atomic_operator import AtomicOperator

operator = AtomicOperator()
# Run a specific technique test
operator.run(
    technique="T1059.001",  # PowerShell execution
    atomics_path="./atomic-red-team/atomics",
)

Key workflow:

Clone the atomic-red-team repository for test definitions
Select ATT&CK techniques matching your detection rules
Execute atomic tests using atomic-operator
Check SIEM/EDR for corresponding alerts
Document detection gaps and update rules

Examples

# Parse atomic test YAML definitions
import yaml
with open("atomics/T1059.001/T1059.001.yaml") as f:
    tests = yaml.safe_load(f)
for test in tests.get("atomic_tests", []):
    print(f"Test: {test['name']}")
    print(f"  Platforms: {test.get('supported_platforms', [])}")

---name: performing-threat-emulation-with-atomic-red-teamdescription: Executes Atomic Red Team tests for MITRE ATT&CK technique validation using the atomic-operator Python framework. Loads test definitions from YAML atomics, runs attack simulations, and validates detection coverage. Use when testing SIEM detection rules, validating EDR coverage, or conducting purple team exercises.license: Apache-2.0---# Performing Threat Emulation with Atomic Red Team## When to Use- When conducting security assessments that involve performing threat emulation with atomic red team- When following incident response procedures for related security events- When performing scheduled security testing or auditing activities- When validating security controls through hands-on testing## Prerequisites- Familiarity with threat intelligence concepts and tools- Access to a test or lab environment for safe execution- Python 3.8+ with required dependencies installed- Appropriate authorization for any testing activities## InstructionsUse atomic-operator to execute Atomic Red Team tests and validate detection coverageagainst MITRE ATT&CK techniques.```pythonfrom atomic_operator import AtomicOperatoroperator = AtomicOperator()# Run a specific technique testoperator.run( technique="T1059.001", # PowerShell execution atomics_path="./atomic-red-team/atomics",)```Key workflow:1. Clone the atomic-red-team repository for test definitions2. Select ATT&CK techniques matching your detection rules3. Execute atomic tests using atomic-operator4. Check SIEM/EDR for corresponding alerts5. Document detection gaps and update rules## Examples```python# Parse atomic test YAML definitionsimport yamlwith open("atomics/T1059.001/T1059.001.yaml") as f: tests = yaml.safe_load(f)for test in tests.get("atomic_tests", []): print(f"Test: {test['name']}") print(f" Platforms: {test.get('supported_platforms', [])}")```

Frequently asked questions