atomic-operator

Overview

atomic-operator is a Python framework that runs the community-maintained Atomic Red Team test library (mapped to MITRE ATT&CK techniques) against local or remote hosts. It automates fetching prerequisites, executing the atomic test commands, and cleaning up afterward, making it useful for purple-team exercises to validate whether detections fire for a given technique.

Common Usage

Install

pip install atomic-operator

Run a single technique locally by ATT&CK ID

atomic-operator run T1003 --check-prereqs

Run against a remote Windows host over WinRM

atomic-operator run T1055 --hosts 10.10.10.5 --username admin --password 'Passw0rd!'

Run against a remote Linux/macOS host over SSH

atomic-operator run T1070 --hosts 10.10.10.20 --username user --ssh-key-path ~/.ssh/id_rsa

Run and automatically clean up afterward

atomic-operator run T1053 --cleanup

Python API Usage

from atomic_operator import AtomicOperator

runner = AtomicOperator()
runner.run(
    techniques=["T1059.001"],
    check_prereqs=True,
    cleanup=True,
)

Tips

• Pair with a SIEM/EDR dashboard open in another window to watch which techniques actually generate alerts
• --check-prereqs will attempt to install missing dependencies for a test — review what it’s about to do before running unattended on production hosts
• Only run against lab or explicitly authorized detection-validation environments; several atomics are genuinely destructive (e.g. credential dumping, persistence)

usage: atomic-operator run [-h] [--hosts HOSTS] [--username USERNAME]
                            [--password PASSWORD] [--ssh-key-path PATH]
                            [--check-prereqs] [--cleanup] [--test-guids GUIDS]
                            technique [technique ...]

positional arguments:
  technique             ATT&CK technique ID(s), e.g. T1003 T1055

options:
  --hosts HOSTS         Comma-separated list of remote hosts (default: local)
  --username USERNAME   Remote auth username
  --password PASSWORD   Remote auth password
  --ssh-key-path PATH   SSH private key for *nix targets
  --check-prereqs       Verify/install test prerequisites before running
  --cleanup             Run the test's cleanup commands afterward
  --test-guids GUIDS    Run specific atomic test GUIDs instead of all for a technique

Vue d’ensemble

atomic-operator est un framework Python qui exécute la bibliothèque de tests Atomic Red Team maintenue par la communauté (mappée sur les techniques MITRE ATT&CK) contre des hôtes locaux ou distants. Il automatise la récupération des prérequis, l’exécution des commandes de test atomiques et le nettoyage ensuite, ce qui le rend utile pour les exercices purple team afin de valider si les détections se déclenchent pour une technique donnée.

Utilisation courante

# Installer
pip install atomic-operator

# Lancer une seule technique en local par son ID ATT&CK
atomic-operator run T1003 --check-prereqs

# Lancer contre un hôte Windows distant via WinRM
atomic-operator run T1055 --hosts 10.10.10.5 --username admin --password 'Passw0rd!'

# Lancer contre un hôte Linux/macOS distant via SSH
atomic-operator run T1070 --hosts 10.10.10.20 --username user --ssh-key-path ~/.ssh/id_rsa

# Lancer et nettoyer automatiquement ensuite
atomic-operator run T1053 --cleanup

Utilisation via l’API Python

from atomic_operator import AtomicOperator

runner = AtomicOperator()
runner.run(
    techniques=["T1059.001"],
    check_prereqs=True,
    cleanup=True,
)

Conseils

• Gardez un tableau de bord SIEM/EDR ouvert dans une autre fenêtre pour observer quelles techniques génèrent réellement des alertes
• --check-prereqs tentera d’installer les dépendances manquantes d’un test : vérifiez ce qu’il s’apprête à faire avant de le lancer sans surveillance sur des hôtes de production
• À lancer uniquement contre des environnements de lab ou explicitement autorisés pour la validation de détection ; plusieurs atomics sont réellement destructeurs (par exemple dumping d’identifiants, persistance)

usage: atomic-operator run [-h] [--hosts HOSTS] [--username USERNAME]
                            [--password PASSWORD] [--ssh-key-path PATH]
                            [--check-prereqs] [--cleanup] [--test-guids GUIDS]
                            technique [technique ...]

positional arguments:
  technique             ATT&CK technique ID(s), e.g. T1003 T1055

options:
  --hosts HOSTS         Comma-separated list of remote hosts (default: local)
  --username USERNAME   Remote auth username
  --password PASSWORD   Remote auth password
  --ssh-key-path PATH   SSH private key for *nix targets
  --check-prereqs       Verify/install test prerequisites before running
  --cleanup             Run the test's cleanup commands afterward
  --test-guids GUIDS    Run specific atomic test GUIDs instead of all for a technique