mirror of
https://github.com/mukul975/Anthropic-Cybersecurity-Skills.git
synced 2026-08-07 19:20:17 +03:00
mukul975
27c6414ca5
Complete skill folder anatomy across all cybersecurity skills: - scripts/agent.py: 80-150 line Python agents using real libraries (impacket, boto3, azure-mgmt-*, kubernetes, pefile, yara, scapy, shodan, stix2, etc.) - references/api-reference.md: real API documentation with method signatures - LICENSE: MIT license for all skill folders
1.4 KiB
1.4 KiB
name, description
| name | description |
|---|---|
| performing-threat-emulation-with-atomic-red-team | Executes Atomic Red Team tests for MITRE ATT&CK technique validation using the atomic-operator Python framework. Loads test definitions from YAML atomics, runs attack simulations, and validates detection coverage. Use when testing SIEM detection rules, validating EDR coverage, or conducting purple team exercises. |
Performing Threat Emulation with Atomic Red Team
Instructions
Use atomic-operator to execute Atomic Red Team tests and validate detection coverage against MITRE ATT&CK techniques.
from atomic_operator import AtomicOperator
operator = AtomicOperator()
# Run a specific technique test
operator.run(
technique="T1059.001", # PowerShell execution
atomics_path="./atomic-red-team/atomics",
)
Key workflow:
- Clone the atomic-red-team repository for test definitions
- Select ATT&CK techniques matching your detection rules
- Execute atomic tests using atomic-operator
- Check SIEM/EDR for corresponding alerts
- Document detection gaps and update rules
Examples
# Parse atomic test YAML definitions
import yaml
with open("atomics/T1059.001/T1059.001.yaml") as f:
tests = yaml.safe_load(f)
for test in tests.get("atomic_tests", []):
print(f"Test: {test['name']}")
print(f" Platforms: {test.get('supported_platforms', [])}")