Atomic Red Team

v24.06Red Canary

Small, single-technique tests you run to prove a detection fires. The range's Invoke-AtomicTest describes each technique, emits the telemetry a real run would produce, and marks the simulated event in the SIEM — but never actually executes the payload.

Category: Post-exploitation & lateral movement
Package: invoke-atomicredteam
Runs on: Linux · Windows
Commands: invoke-atomictest, invoke-atomic, atomic

Emits authored ATT&CK-mapped telemetry. No test executes on the simulated host, let alone a real one.

Install it

The scripts below install the real Red Canary package on your own machine — read them first, and run them somewhere you are allowed to change. Inside the range, one press puts the simulated package on your next machine.

Linux installer (shell script)

install-atomic.sh

Windows installer (PowerShell)

Install-atomic.ps1

On a range machine

Add it to your kit and every machine you launch comes with it.

On Linux

Debian, Ubuntu, Kali (apt)

Refresh the package lists
```
sudo apt update
```

Install Atomic Red Team

sudo apt install -y invoke-atomicredteam

RHEL, Fedora (dnf)

Install Atomic Red Team
```
sudo dnf install -y invoke-atomicredteam
```
Package names drift between distributions; search first if this one misses.

Arch (pacman)

Install Atomic Red Team

sudo pacman -S --noconfirm invoke-atomicredteam

Alpine (apk)

Install Atomic Red Team
```
sudo apk add invoke-atomicredteam
```
Package names drift between distributions; search first if this one misses.

Check it worked

Confirm it landed on PATH
```
which invoke-atomictest
```
Check the version
```
invoke-atomictest --version
```
The range reports 24.06.

Remove it

Take it off again

sudo apt remove --purge invoke-atomicredteam

On Windows

PowerShell Gallery

Allow signed modules for this session

Set-ExecutionPolicy -Scope Process -ExecutionPolicy RemoteSigned

Install Atomic Red Team

Install-Module -Name invoke-atomicredteam -Scope CurrentUser -Force

Load it
```
Import-Module invoke-atomicredteam
```

Check it worked

Confirm it resolves
```
where invoke-atomictest
```
Check the version
```
invoke-atomictest --version
```
The range reports 24.06.

Remove it

Take it off again

Uninstall-Module -Name invoke-atomicredteam

Inside the range

Tick it on the launch screen
Under Atomic Red Team's category on the advanced tool shelf. A lab that depends on it locks the toggle on and says why.
Or install it from a range terminal
```
sudo apt install -y invoke-atomicredteam
```
The simulated package manager seeds the same binaries, config and receipt the shelf toggle does.
Everything here is simulated
No software is downloaded and nothing executes — the range answers from authored fixtures.

Labs that use Atomic Red Team

Pentest: Purple-Team EmulationPlay both seats. Fire five ATT&CK techniques from the C2 console, check the SIEM after each one, and file a detection-gap finding for the two that produced nothing. Score is the ratio of techniques with a signal.
Pentest: Defense Evasion and EDR SidestepOn an authorized workstation, land a payload past an EDR that is watching AMSI, ETW and the usual hooked syscalls. Every step files an evidence line and a matching detection ask, so the report reads as both an attack write-up and a purple-team gap register.
Pentest: Ransomware Adversary EmulationEmulate a named ransomware crew end-to-end against the simulated estate: scheduled-task persistence, token-theft privilege escalation, WinRM lateral hop, benign fixture-swap impact, then hand the recovery team a per-stage detection-gap table linked to the RAN track.