A victory lap for

Atomic-Runner

We recently launched Atomic-Runner, an automation feature for the Invoke-AtomicRedTeam execution framework that allows you to run a configurable list of atomic tests unattended via a service or scheduled task at your desired cadence. Along with Windows, this script works on Linux and macOS environments that have PowerShell Core installed.

Run away

Gone LNK phishing

This technical deep dive from the Splunk Research Team highlights several ways to emulate malicious LNK files, including an Atomic Red Team test for T1547.009, which uses uses PowerShell to create a LNK file in the Startup directory that will spawn cmd.exe.

READ MORE

NEW AND FEATURED TESTS

T1112 - Modify Registry

Flush Shimcache

T1082 - System Information Discovery

sysctl to gather macOS hardware info

T1046 - Network Service Discovery

Remote Desktop Services discovery via PowerShell

Top contributors

First-time contributors

Atomic in the wild

WATCH: Atomic Red Team at RSA

At this year's RSA Conference, Brian Donohue and Adam Mashinichi spoke on how to build a rapid cybersecurity validation program with open-source frameworks, public threat intelligence, and generative AI. Watch their talk to learn how to construct robust atomic tests, develop detection analytics, and prioritize detection efforts.

Join Red Canary’s Gerry Johansen on May 31 as he presents how to use Atomic Red Team to validate your defenses against ransomware attacks.

Catch the Atomic-Football

Contributor "Mad White Hatter" created this fun GUI that launches a set of PowerShell scripts for executing Atomic Red Team tests, managing exclusions in various security products, and handling setup and dependencies for smooth execution.

GO LONG