Atomic Red Team
This week I wanted to write about a software application that I am looking to do some more practice with. This application is called Atomic Red Team. Atomic Red Team is a free open-source tool that allows users to simulate different adversary techniques and attacks. It's built upon the MITRE ATT&CK (Adversarial Tactics, Techniques, and Common Knowledge) framework. Which is a globally accessible knowledge base of adversary tactics and techniques based on real-world case studies and statistics. With the MITRE ATT&CK, the Atomic Red Team can replicate specific tactics and methods used by real-world threats.
When employing Atomic Red Team, the user can customize the solution depending on their needs. If the user is employing it to test its large-scale organization enterprise or to test their home network, the Atomic Red Team is able to adapt and scale according to the users’ desired environment, platforms, or systems. It also allows for some great post-simulation analysis. Because Atomic Red Team uses the MITRE ATT&CK mapping, every test it conducts maps to a specific technique that users can learn to better defend against.
I'm still yet to dip my toes into using Atomic Red Team but I'm excited to do so. I envision it is not only a great learning technique in the aspect of learning different adversary techniques but also a great learning technique in how to identify and defend against said adversary techniques.
Sources:
Small and highly portable detection tests based on MITRE's ATT&CK. - redcanaryco/atomic-red-team