My First Steps in Purple Teaming with Atomic Red Team

I just started a deep dive journey into Purple Teaming after finishing my four first years of engineering school. The first and main topic I dived into was Atomic Red Team !

What is Purple Team & Atomic Red Team ?

Purple Team : Emerging approach that aimed to bridge the gap between two worlds : the Red Team (attackers) and the Blue Team (defenders).. Essentially, they are performing ethical hacking operations and building a stronger defense based on the gaps identified during these attacks.

Atomic Red Team : An open-source library of tests that emulate adversary behaviors like hackers/ APT. (Small, fast and highly targeted). These tests are directly mapped from the framework MITRE ATT&CK.

The full library is available on GitHub :

Atomic Red Team is reachable on Github

MITRE ATT&CK : Knowledge base for all the tests. Each one corresponds to a technique commonly used by hackers/ APT.

But how to settle properly Atomic Red Team on your computer ?

The ART repository is available on this link : https://github.com/redcanaryco/atomic-red-team.

• The first step is to install the executor, which will give you access to the ART repository from your terminal.

The executor fetches the attack script from Github, downloads any missing dependencies, executes the simulation on your machine, and offers to clean up everything afterwards.

I recommend using Invoke-AtomicRedTeam : PowerShell-based, works on Windows. You must install Powershell-core for Linux/macOS.

1/ Installation (framework + atomics) :

IEX (IWR ‘https://raw.githubusercontent.com/redcanaryco/invoke-atomicredteam/master/install-atomicredteam.ps1' -UseBasicParsing); Install-AtomicRedTeam -getAtomics

2/ Test Execution :

Invoke-AtomicTest T1059.001 -PathToAtomicsFolder “”C:\your\path\atomics”” (+ Rule)

I also recommend using Atomic Operator : Python-based, works on Linux/macOS. You must install Python for Windows.

1/ Installation (framework + atomics) :

pip install atomic-operator atomic-operator get_atomics

2/ Test Execution :

atomic-operator run — atomics-path “/your/path/atomics” — techniques T1059

⚠️WARNING : If it does not work on your OS, you can create a script — for example automate.sh that executes the techniques in the correct ️folder:

bash ~/automate.sh

3/ Available options for both options :

• -ShowDetails → See the technics details
• -CheckPrereqs → Verify the prereqs
• -GetPrereqs → Install the missing prerequisites
• -Cleanup → Clean after the test

⚠️WARNING (if you are working on VMs) : You must disable Windows Defender for a better SIEM experience. The windows defender can block many techniques from ART :

→ In a lab, we disable our main defender in order to prove that our SIEM rules are working, but in production, the purple team aim to verify whether Defender is actually doing its job.

How to validate that an ART test actually worked?

First and foremost, you need to look into your SIEM or EDR. In my lab, I personally used Wazuh.

If your victim machine is a Windows VM, you can easily confirm that an event took place by checking the Windows Event Viewer. Before jumping into the SIEM, it is always a good practice to verify that Sysmon (powered by a solid configuration like Olaf Hartong’s) is fetching and logging the raw data correctly on the host.

Once you confirm the telemetry is visible locally, it’s time to check your SIEM dashboard. You must ask yourself:

• Did the expected alert trigger?
• Which Rule ID was fired, and what was its severity level?
• If nothing appeared, why? Is it a detection gap, or did our logging pipeline fail?

Purple Teaming with Atomic Red Team gave me a completely different perspective on detection engineering. You stop thinking like someone who just reads alerts → You start thinking like the attacker generating them.

If you’re just getting started, my advice : pick one technique, run it, and follow the data all the way from the host to your SIEM. That end-to-end trace teaches you more than any documentation ever will.