Atomic Red Team: Where Adversary Emulation and EDR Testing Meet
summary
Atomic Red Team is a library of small, focused adversary-emulation tests that are mapped to the MITRE ATT&CK matrix and include configuration and cleanup commands. The talk covers using these tests for validating defenses and testing EDR capabilities, and provides practical guidance and resources for getting started with the framework.
AI-written summary · about
chapters (18)
- 0:00Start
- 2:15Key Takeaways
- 2:47Execution Frameworks
- 3:24Terminology
- 5:29The Mitre Attack Matrix
- 8:30Account Discovery
- 19:22How Do You Model Threat Actor Behavior
- 21:47Example of an Atomic Test
- 24:59How Difficult Is a Test To Execute
- 33:54Chain Reactor
- 35:24Atomic Confetti Bomb
- 36:38The Threat Detection Report
- 38:09Threat Detection Report
- 40:23Atomic Red Team Repository
- 41:20Atomic Unit Test
- 43:46Cybersecurity Maturity
- 49:53Adversary Emulation Plans
- 50:48Multi-Stage Attacks
related talks
40mFantastic Red-Team Attacks and How to Find Them
53mIncreasing Security ROI with Adversary Simulation and Purple Teaming
50mAdversary Emulation: How I Stopped Being Polite and Got Real Results
33mBuilding Red Team Capability
48mMITRE ATT&CK: The Play at Home Edition
40mAdversary Simulation: Close the Gaps in Your Security Posture
41mPurple Is the New Red - Providing the Most Value from Offensive Security
50mThe ART of Probable: Test with AI, Atomic Red Team, and Threat Metrics