About

Imported from mukul975/anthropic-cybersecurity-skills (skills/performing-threat-emulation-with-atomic-red-team/SKILL.md). Install upstream with npx skills add mukul975/anthropic-cybersecurity-skills --skill performing-threat-emulation-with-atomic-red-team. Copyright stays with the author (Apache-2.0).

Performing Threat Emulation with Atomic Red Team

Name: performing-threat-emulation-with-atomic-red-team
Author: mukul975

When to Use

When conducting security assessments that involve performing threat emulation with atomic red team
When following incident response procedures for related security events
When performing scheduled security testing or auditing activities
When validating security controls through hands-on testing

Prerequisites

Familiarity with threat intelligence concepts and tools
Access to a test or lab environment for safe execution
Python 3.8+ with required dependencies installed
Appropriate authorization for any testing activities

Instructions

Use atomic-operator to execute Atomic Red Team tests and validate detection coverage against MITRE ATT&CK techniques.

from atomic_operator import AtomicOperator

operator = AtomicOperator()
# Run a specific technique test
operator.run(
    technique="T1059.001",  # PowerShell execution
    atomics_path="./atomic-red-team/atomics",
)

Key workflow:

Clone the atomic-red-team repository for test definitions
Select ATT&CK techniques matching your detection rules
Execute atomic tests using atomic-operator
Check SIEM/EDR for corresponding alerts
Document detection gaps and update rules

Examples

# Parse atomic test YAML definitions
import yaml
with open("atomics/T1059.001/T1059.001.yaml") as f:
    tests = yaml.safe_load(f)
for test in tests.get("atomic_tests", []):
    print(f"Test: {test['name']}")
    print(f"  Platforms: {test.get('supported_platforms', [])}")

Use it

Copy one of these into your project. Installing also returns the manifest and these snippets.

yaml

targets:
  - https://api.opensmartroute.ai/api/v1/registry/mukul975-anthropic-cybersecurity-skills-performing-threa-8bf634/manifest   # or paste the manifest below

Manifest

An Open Capability Manifest: the router reads it to know what this does, what it costs and when to pick it.

mukul975-anthropic-cybersecurity-skills-performing-threa-8bf634.ocm.jsonjson

{
  "ocm": "1",
  "id": "mukul975-anthropic-cybersecurity-skills-performing-threa-8bf634",
  "kind": "skill",
  "name": "performing-threat-emulation-with-atomic-red-team",
  "description": "Executes Atomic Red Team tests for MITRE ATT&CK technique validation using the atomic-operator Python framework. Loads test definitions from YAML atomics, runs attack simulations, and validates detection coverage. Use when testing SIEM detection rules, validating EDR coverage, or conducting purple team exercises.",
  "publisher": "mukul975",
  "version": "1.0.0",
  "capabilities": {
    "domains": [
      "coding"
    ],
    "tags": [
      "skill-md",
      "threat-emulation",
      "atomic-red-team",
      "mitre-attack",
      "adversary-emulation",
      "atomic-operator",
      "purple-team",
      "skills-sh"
    ],
    "languages": [
      "en"
    ]
  },
  "quality_prior": 0.6,
  "examples": [
    "Executes Atomic Red Team tests for MITRE ATT&CK technique validation using the atomic-operator Python framework. Loads test definitions from YAML atomics, runs attack simulations, and validates detection coverage. Use when testing SIEM detection rules, validating EDR coverage, or conducting purple team exercises."
  ],
  "primary": false,
  "metadata": {
    "source": {
      "provider": "skills.sh",
      "repository": "https://github.com/mukul975/anthropic-cybersecurity-skills",
      "path": "skills/performing-threat-emulation-with-atomic-red-team/SKILL.md",
      "ref": "HEAD",
      "url": "https://github.com/mukul975/anthropic-cybersecurity-skills/blob/HEAD/skills/performing-threat-emulation-with-atomic-red-team/SKILL.md",
      "key": "mukul975/anthropic-cybersecurity-skills/skills/performing-threat-emulation-with-atomic-red-team/SKILL.md"
    },
    "license": "Apache-2.0"
  },
  "instructions": "# Performing Threat Emulation with Atomic Red Team\n\n\n## When to Use\n\n- When conducting security assessments that involve performing threat emulation with atomic red team\n- When following incident response procedures for related security events\n- When performing scheduled security testing or auditing activities\n- When validating security controls through hands-on testing\n\n## Prerequisites\n\n- Familiarity with threat intelligence concepts and tools\n- Access to a test or lab environment for safe execution\n- Python 3.8+ with required dependencies installed\n- Appropriate authorization for any testin",
  "cost": {
    "context_tokens": 387
  }
}

Fetch it by URL: GET /api/v1/registry/mukul975-anthropic-cybersecurity-skills-performing-threa-8bf634/manifest?version=1.0.0

Reviews

Star ratings from people who tried it. One review per account; edit yours any time.

No reviews yet. Install it, try it, and be the first to rate it.