← retour aux outils back to tools

# atomic-operator

Exécute les tests MITRE Atomic Red Team sous Windows, Linux et macOS pour l'émulation d'adversaire et la validation de détection. Executes MITRE Atomic Red Team tests across Windows, Linux, and macOS for adversary emulation and detection validation.

↗ https://github.com/swimlane/atomic-operator

## Overview

atomic-operator is a Python framework that runs the community-maintained Atomic Red Team test library (mapped to MITRE ATT&CK techniques) against local or remote hosts. It automates fetching prerequisites, executing the atomic test commands, and cleaning up afterward, making it useful for purple-team exercises to validate whether detections fire for a given technique.

## Common Usage

Install

    pip install atomic-operator

Run a single technique locally by ATT&CK ID

    atomic-operator run T1003 --check-prereqs

Run against a remote Windows host over WinRM

    atomic-operator run T1055 --hosts 10.10.10.5 --username admin --password 'Passw0rd!'

Run against a remote Linux/macOS host over SSH

    atomic-operator run T1070 --hosts 10.10.10.20 --username user --ssh-key-path ~/.ssh/id_rsa

Run and automatically clean up afterward

    atomic-operator run T1053 --cleanup

## Python API Usage

    from atomic_operator import AtomicOperator

    runner = AtomicOperator()
    runner.run(
        techniques=["T1059.001"],
        check_prereqs=True,
        cleanup=True,
    )

## Tips

- Pair with a SIEM/EDR dashboard open in another window to watch which techniques actually generate alerts
- `--check-prereqs` will attempt to install missing dependencies for a test — review what it’s about to do before running unattended on production hosts
- Only run against lab or explicitly authorized detection-validation environments; several atomics are genuinely destructive (e.g. credential dumping, persistence)

Help / Man page

    usage: atomic-operator run [-h] [--hosts HOSTS] [--username USERNAME]
                                [--password PASSWORD] [--ssh-key-path PATH]
                                [--check-prereqs] [--cleanup] [--test-guids GUIDS]
                                technique [technique ...]

    positional arguments:
      technique             ATT&CK technique ID(s), e.g. T1003 T1055

    options:
      --hosts HOSTS         Comma-separated list of remote hosts (default: local)
      --username USERNAME   Remote auth username
      --password PASSWORD   Remote auth password
      --ssh-key-path PATH   SSH private key for *nix targets
      --check-prereqs       Verify/install test prerequisites before running
      --cleanup             Run the test's cleanup commands afterward
      --test-guids GUIDS    Run specific atomic test GUIDs instead of all for a technique

## Vue d’ensemble

atomic-operator est un framework Python qui exécute la bibliothèque de tests Atomic Red Team maintenue par la communauté (mappée sur les techniques MITRE ATT&CK) contre des hôtes locaux ou distants. Il automatise la récupération des prérequis, l’exécution des commandes de test atomiques et le nettoyage ensuite, ce qui le rend utile pour les exercices purple team afin de valider si les détections se déclenchent pour une technique donnée.

## Utilisation courante

    # Installer
    pip install atomic-operator

    # Lancer une seule technique en local par son ID ATT&CK
    atomic-operator run T1003 --check-prereqs

    # Lancer contre un hôte Windows distant via WinRM
    atomic-operator run T1055 --hosts 10.10.10.5 --username admin --password 'Passw0rd!'

    # Lancer contre un hôte Linux/macOS distant via SSH
    atomic-operator run T1070 --hosts 10.10.10.20 --username user --ssh-key-path ~/.ssh/id_rsa

    # Lancer et nettoyer automatiquement ensuite
    atomic-operator run T1053 --cleanup

## Utilisation via l’API Python

    from atomic_operator import AtomicOperator

    runner = AtomicOperator()
    runner.run(
        techniques=["T1059.001"],
        check_prereqs=True,
        cleanup=True,
    )

## Conseils

- Gardez un tableau de bord SIEM/EDR ouvert dans une autre fenêtre pour observer quelles techniques génèrent réellement des alertes
- `--check-prereqs` tentera d’installer les dépendances manquantes d’un test : vérifiez ce qu’il s’apprête à faire avant de le lancer sans surveillance sur des hôtes de production
- À lancer uniquement contre des environnements de lab ou explicitement autorisés pour la validation de détection ; plusieurs atomics sont réellement destructeurs (par exemple dumping d’identifiants, persistance)

Aide / Page de manuel

    usage: atomic-operator run [-h] [--hosts HOSTS] [--username USERNAME]
                                [--password PASSWORD] [--ssh-key-path PATH]
                                [--check-prereqs] [--cleanup] [--test-guids GUIDS]
                                technique [technique ...]

    positional arguments:
      technique             ATT&CK technique ID(s), e.g. T1003 T1055

    options:
      --hosts HOSTS         Comma-separated list of remote hosts (default: local)
      --username USERNAME   Remote auth username
      --password PASSWORD   Remote auth password
      --ssh-key-path PATH   SSH private key for *nix targets
      --check-prereqs       Verify/install test prerequisites before running
      --cleanup             Run the test's cleanup commands afterward
      --test-guids GUIDS    Run specific atomic test GUIDs instead of all for a technique