[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6HNHGYAFBNFCWHK902MH46N":3,"skill-same:01M6HNHGYAFBNFCWHK902MH46N":121},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":23,"publishedAt":44,"linkOnly":45,"markdownContent":46,"markdownBody":47,"frontMatter":48,"refName":82,"commitSha":83,"skillDirectory":84,"forksCount":85,"repositoryHtmlUrl":86,"repositoryHomepageUrl":6,"ownerHtmlUrl":87,"ownerBlogUrl":6,"ownerDescription":88,"updatedAt":89,"install":90,"resources":103},"01M6HNHGYAFBNFCWHK902MH46N","performing-threat-emulation-with-atomic-red-team",null,"Executes Atomic Red Team tests for MITRE ATT&CK technique validation using the atomic-operator Python framework. Loads test definitions from YAML atomics, runs attack simulations, and validates detection coverage. Use when testing SIEM detection...","HenriqueMC17\u002Fagente-core","HenriqueMC17","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F206460478?v=4","01M6HB63HBBF18AC4H09XTB549","Henrique Monteiro Cardoso","01M6HB63NGSQXWKWCFWW2B20W0",1,"Apache-2.0","https:\u002F\u002Fgithub.com\u002FHenriqueMC17\u002Fagente-core\u002Fblob\u002Fmain\u002Fmodules\u002Fperforming-threat-emulation-with-atomic-red-team\u002FSKILL.md",[18],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000008","测试与质量","SCENARIO","使用场景",[24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43],"emulation","performing","red team","atomic","with","red","performing threat emulation with atomic red team","team","threat","aml","map","conversion","cm","testing","coverage","analysis","purple-team","mitre-attack","siem","cybersecurity","2026-11-10 10:12:30",false,"---\nname: performing-threat-emulation-with-atomic-red-team\ndescription: Executes Atomic Red Team tests for MITRE ATT&CK technique validation using the atomic-operator Python framework. Loads test definitions from YAML atomics, runs attack simulations, and validates detection coverage. Use when testing SIEM detection...\ndomain: cybersecurity\nsubdomain: threat-intelligence\ntags:\n- threat-emulation\n- atomic-red-team\n- mitre-attack\n- adversary-emulation\n- atomic-operator\n- purple-team\nversion: '1.0'\nauthor: mahipal\nlicense: Apache-2.0\nnist_ai_rmf:\n- MEASURE-2.7\n- MAP-5.1\n- MANAGE-2.4\natlas_techniques:\n- AML.T0070\n- AML.T0066\n- AML.T0082\nd3fend_techniques:\n- Executable Denylisting\n- Execution Isolation\n- File Metadata Consistency Validation\n- Content Format Conversion\n- File Content Analysis\nnist_csf:\n- ID.RA-01\n- ID.RA-05\n- DE.CM-01\n- DE.AE-02\nmitre_attack:\n- T1591\n- T1592\n- T1593\n- T1589\n- T1685.002\ncategory: performing-threat-emulation-with-atomic-red-team\n---\n# Performing-Threat-Emulation-With-Atomic-Red-Team\n\n## Overview\nExecutes Atomic Red Team tests for MITRE ATT&CK technique validation using the atomic-operator Python framework. Loads test definitions from YAML atomics, runs attack simulations, and validates detection coverage. Use when testing SIEM detection rules, validating EDR coverage, or conducting purple team exercises.\n\n\n\n# Performing Threat Emulation with Atomic Red Team\n\n\n## When to Use\n\n- When conducting security assessments that involve performing threat emulation with atomic red team\n- When following incident response procedures for related security events\n- When performing scheduled security testing or auditing activities\n- When validating security controls through hands-on testing\n\n## Prerequisites\n\n- Familiarity with threat intelligence concepts and tools\n- Access to a test or lab environment for safe execution\n- Python 3.8+ with required dependencies installed\n- Appropriate authorization for any testing activities\n\n## Instructions\n\nUse atomic-operator to execute Atomic Red Team tests and validate detection coverage\nagainst MITRE ATT&CK techniques.\n\n```python\nfrom atomic_operator import AtomicOperator\n\noperator = AtomicOperator()\n# Run a specific technique test\noperator.run(\n    technique=\"T1059.001\",  # PowerShell execution\n    atomics_path=\".\u002Fatomic-red-team\u002Fatomics\",\n)\n```\n\nKey workflow:\n1. Clone the atomic-red-team repository for test definitions\n2. Select ATT&CK techniques matching your detection rules\n3. Execute atomic tests using atomic-operator\n4. Check SIEM\u002FEDR for corresponding alerts\n5. Document detection gaps and update rules\n\n## Examples\n\n```python\n# Parse atomic test YAML definitions\nimport yaml\nwith open(\"atomics\u002FT1059.001\u002FT1059.001.yaml\") as f:\n    tests = yaml.safe_load(f)\nfor test in tests.get(\"atomic_tests\", []):\n    print(f\"Test: {test['name']}\")\n    print(f\"  Platforms: {test.get('supported_platforms', [])}\")\n```\n","# Performing-Threat-Emulation-With-Atomic-Red-Team\n\n## Overview\nExecutes Atomic Red Team tests for MITRE ATT&CK technique validation using the atomic-operator Python framework. Loads test definitions from YAML atomics, runs attack simulations, and validates detection coverage. Use when testing SIEM detection rules, validating EDR coverage, or conducting purple team exercises.\n\n\n\n# Performing Threat Emulation with Atomic Red Team\n\n\n## When to Use\n\n- When conducting security assessments that involve performing threat emulation with atomic red team\n- When following incident response procedures for related security events\n- When performing scheduled security testing or auditing activities\n- When validating security controls through hands-on testing\n\n## Prerequisites\n\n- Familiarity with threat intelligence concepts and tools\n- Access to a test or lab environment for safe execution\n- Python 3.8+ with required dependencies installed\n- Appropriate authorization for any testing activities\n\n## Instructions\n\nUse atomic-operator to execute Atomic Red Team tests and validate detection coverage\nagainst MITRE ATT&CK techniques.\n\n```python\nfrom atomic_operator import AtomicOperator\n\noperator = AtomicOperator()\n# Run a specific technique test\noperator.run(\n    technique=\"T1059.001\",  # PowerShell execution\n    atomics_path=\".\u002Fatomic-red-team\u002Fatomics\",\n)\n```\n\nKey workflow:\n1. Clone the atomic-red-team repository for test definitions\n2. Select ATT&CK techniques matching your detection rules\n3. Execute atomic tests using atomic-operator\n4. Check SIEM\u002FEDR for corresponding alerts\n5. Document detection gaps and update rules\n\n## Examples\n\n```python\n# Parse atomic test YAML definitions\nimport yaml\nwith open(\"atomics\u002FT1059.001\u002FT1059.001.yaml\") as f:\n    tests = yaml.safe_load(f)\nfor test in tests.get(\"atomic_tests\", []):\n    print(f\"Test: {test['name']}\")\n    print(f\"  Platforms: {test.get('supported_platforms', [])}\")\n```\n",{"name":5,"tags":49,"author":54,"domain":43,"license":15,"version":55,"category":5,"nist_csf":56,"subdomain":61,"description":7,"nist_ai_rmf":62,"mitre_attack":66,"atlas_techniques":72,"d3fend_techniques":76},[50,51,41,52,53,40],"threat-emulation","atomic-red-team","adversary-emulation","atomic-operator","mahipal","1.0",[57,58,59,60],"ID.RA-01","ID.RA-05","DE.CM-01","DE.AE-02","threat-intelligence",[63,64,65],"MEASURE-2.7","MAP-5.1","MANAGE-2.4",[67,68,69,70,71],"T1591","T1592","T1593","T1589","T1685.002",[73,74,75],"AML.T0070","AML.T0066","AML.T0082",[77,78,79,80,81],"Executable Denylisting","Execution Isolation","File Metadata Consistency Validation","Content Format Conversion","File Content Analysis","main","5eea5b3296f4673b5f481e8bcc1ba76281149f16","modules\u002Fperforming-threat-emulation-with-atomic-red-team",0,"https:\u002F\u002Fgithub.com\u002FHenriqueMC17\u002Fagente-core","https:\u002F\u002Fgithub.com\u002FHenriqueMC17","Qualquer tecnologia suficientemente avançada é indistinguível da mágica.","2026-09-28 22:40:38",{"source":8,"skillName":5,"commands":91,"prompt":101,"zipAvailable":102},[92,95,98],{"tool":93,"command":94},"npx","npx skills add HenriqueMC17\u002Fagente-core --skill performing-threat-emulation-with-atomic-red-team",{"tool":96,"command":97},"bunx","bunx skills add HenriqueMC17\u002Fagente-core --skill performing-threat-emulation-with-atomic-red-team",{"tool":99,"command":100},"pnpm","pnpm dlx skills add HenriqueMC17\u002Fagente-core --skill performing-threat-emulation-with-atomic-red-team","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002FHenriqueMC17\u002Fagente-core\u002Fblob\u002Fmain\u002Fmodules\u002Fperforming-threat-emulation-with-atomic-red-team\u002FSKILL.md",true,[104,109,115],{"path":105,"resourceType":105,"resourceTypeDesc":106,"sizeBytes":107,"sourceHtmlUrl":108},"LICENSE","许可证",11255,"https:\u002F\u002Fgithub.com\u002FHenriqueMC17\u002Fagente-core\u002Fblob\u002Fmain\u002Fmodules\u002Fperforming-threat-emulation-with-atomic-red-team\u002FLICENSE",{"path":110,"resourceType":111,"resourceTypeDesc":112,"sizeBytes":113,"sourceHtmlUrl":114},"references\u002Fapi-reference.md","REFERENCE","参考文档",1709,"https:\u002F\u002Fgithub.com\u002FHenriqueMC17\u002Fagente-core\u002Fblob\u002Fmain\u002Fmodules\u002Fperforming-threat-emulation-with-atomic-red-team\u002Freferences\u002Fapi-reference.md",{"path":116,"resourceType":117,"resourceTypeDesc":118,"sizeBytes":119,"sourceHtmlUrl":120},"scripts\u002Fagent.py","SCRIPT","脚本",7973,"https:\u002F\u002Fgithub.com\u002FHenriqueMC17\u002Fagente-core\u002Fblob\u002Fmain\u002Fmodules\u002Fperforming-threat-emulation-with-atomic-red-team\u002Fscripts\u002Fagent.py",[122,148,173,194,210,229],{"skillNo":123,"name":124,"nameZh":6,"description":125,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":126,"categories":127,"keywords":129,"publishedAt":44},"01M6HPFF0RCN0X6WT5EBSV71GY","validating-backup-integrity-for-recovery","Validate backup integrity through cryptographic hash verification, automated restore testing, corruption detection, and recoverability checks to ensure backups are reliable for disaster recovery and ransomware response scenarios.","https:\u002F\u002Fgithub.com\u002FHenriqueMC17\u002Fagente-core\u002Fblob\u002Fmain\u002Fmodules\u002Fvalidating-backup-integrity-for-recovery\u002FSKILL.md",[128],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[130,131,132,133,134,37,43,135,136,137,138,139,140,141,142,143,144,145,146,147],"integrity","backup","recovery","validating backup integrity for recovery","for","validate","verification","hash-verification","incident-response","ransomware","detection","t1078","t1490","disaster-recovery","restore","incident","disaster recovery","ransomware response",{"skillNo":149,"name":150,"nameZh":6,"description":151,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":152,"categories":153,"keywords":154,"publishedAt":44},"01M6HPFAWJVFK25Q33K3T7WQ8G","triaging-vulnerabilities-with-ssvc-framework","Triage and prioritize vulnerabilities using CISA's Stakeholder-Specific Vulnerability Categorization (SSVC) decision tree framework to produce actionable remediation priorities.","https:\u002F\u002Fgithub.com\u002FHenriqueMC17\u002Fagente-core\u002Fblob\u002Fmain\u002Fmodules\u002Ftriaging-vulnerabilities-with-ssvc-framework\u002FSKILL.md",[],[155,156,157,158,28,43,159,160,161,162,163,164,165,166,167,168,169,170,171,172],"vulnerabilities","framework","ssvc","triaging vulnerabilities with ssvc framework","triage and prioritize","CISA","vulnerability-management","risk-management","cvss","remediation","vulnerability","prioritization","decision-tree","prioritize","decision","priorities","actionable","tree",{"skillNo":174,"name":175,"nameZh":6,"description":176,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":177,"categories":178,"keywords":179,"publishedAt":44},"01M6HPF6JS9X72WP59094H3ASQ","triaging-security-incident","Performs initial triage of security incidents to determine severity, scope, and required response actions using the NIST SP 800-61r3 and SANS PICERL frameworks. Classifies incidents by type, assigns priority based on business impact, and routes...","https:\u002F\u002Fgithub.com\u002FHenriqueMC17\u002Fagente-core\u002Fblob\u002Fmain\u002Fmodules\u002Ftriaging-security-incident\u002FSKILL.md",[],[180,181,145,43,182,183,184,141,142,39,185,186,187,188,189,35,190,191,192,193],"security","triaging security incident","actions","soc","NIST","severity-classification","incident-triage","SANS-PICERL","SOC-operations","picerl","isolation","scope","impact","consistency",{"skillNo":195,"name":196,"nameZh":6,"description":197,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":198,"categories":199,"keywords":200,"publishedAt":44},"01M6HPF2EX6ZYNYYHKBRJN7GEF","triaging-security-incident-with-ir-playbook","Classify and prioritize security incidents using structured IR playbooks to determine severity, assign response teams, and initiate appropriate response procedures.","https:\u002F\u002Fgithub.com\u002FHenriqueMC17\u002Fagente-core\u002Fblob\u002Fmain\u002Fmodules\u002Ftriaging-security-incident-with-ir-playbook\u002FSKILL.md",[],[180,201,202,181,145,28,43,203,183,138,204,205,141,142,206,185,168,207,208,209],"playbook","triaging security incident with ir playbook","teams","IR-playbook","severity","classification","classify","incidents","initiate",{"skillNo":211,"name":212,"nameZh":6,"description":213,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":214,"categories":215,"keywords":216,"publishedAt":44},"01M6HPEY9XPGE7X95AG4XJFQAW","triaging-security-alerts-in-splunk","Triages security alerts in Splunk Enterprise Security by classifying severity, investigating notable events, correlating related telemetry, and making escalation or closure decisions using SPL queries and the Incident Review dashboard. Use when...","https:\u002F\u002Fgithub.com\u002FHenriqueMC17\u002Fagente-core\u002Fblob\u002Fmain\u002Fmodules\u002Ftriaging-security-alerts-in-splunk\u002FSKILL.md",[],[180,217,218,219,220,221,43,42,222,223,183,224,141,225,226,227,188,36,145,228],"security alerts","splunk","triaging security alerts in splunk","alerts","review","dashboard","search","correlation-search","t1566","notable-events","incident-review","de",{"skillNo":230,"name":231,"nameZh":6,"description":232,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":233,"categories":234,"keywords":235,"publishedAt":44},"01M6HPET6XGEPEJPN7V032JGZ0","tracking-threat-actor-infrastructure","Threat actor infrastructure tracking involves monitoring and mapping adversary-controlled assets including command-and-control (C2) servers, phishing domains, exploit kit hosts, bulletproof hosting, a","https:\u002F\u002Fgithub.com\u002FHenriqueMC17\u002Fagente-core\u002Fblob\u002Fmain\u002Fmodules\u002Ftracking-threat-actor-infrastructure\u002FSKILL.md",[],[236,237,238,32,43,239,41,240,61,241,242,225,243,244,36,245,228,246,247,248],"infrastructure","tracking threat actor infrastructure","tracking","monitoring","threat-actor","command-and-control","dns","command","exploit","intelligence","domains","kit","hosts"]