# Performing Threat Emulation With Atomic Red Team

> 使用 atomic-operator Python 框架执行 Atomic Red Team 测试，进行 MITRE ATT&CK 技术验证。 从 YAML 原子测试加载测试定义、运行攻击模拟并验证检测覆盖率。适用于测试 SIEM 检测规则、 验证 EDR 覆盖率或开展紫队演练。

- Skill: `killvxk/performing-threat-emulation-with-atomic-red-team` (Agent Skill, multi-file: 4 files)
- Install (CLI): `npx skillmds@latest add killvxk/performing-threat-emulation-with-atomic-red-team`
- Raw SKILL.md: https://api.skillmd.com/api/skills/killvxk/performing-threat-emulation-with-atomic-red-team/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Security
- License: Apache-2.0
- Author: killvxk (https://skillmd.com/u/killvxk)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/killvxk/performing-threat-emulation-with-atomic-red-team

---


# 使用 Atomic Red Team 执行威胁模拟

## 说明

使用 atomic-operator 执行 Atomic Red Team 测试，针对 MITRE ATT&CK 技术验证检测覆盖率。

```python
from atomic_operator import AtomicOperator

operator = AtomicOperator()
# 运行指定技术测试
operator.run(
    technique="T1059.001",  # PowerShell 执行
    atomics_path="./atomic-red-team/atomics",
)
```

关键工作流程：
1. 克隆 atomic-red-team 仓库获取测试定义
2. 选择与检测规则匹配的 ATT&CK 技术
3. 使用 atomic-operator 执行原子测试
4. 在 SIEM/EDR 中检查相应告警
5. 记录检测缺口并更新规则

## 示例

```python
# 解析原子测试 YAML 定义
import yaml
with open("atomics/T1059.001/T1059.001.yaml") as f:
    tests = yaml.safe_load(f)
for test in tests.get("atomic_tests", []):
    print(f"测试：{test['name']}")
    print(f"  支持平台：{test.get('supported_platforms', [])}")
```