Small detection tests mapped to MITRE ATT&CK
Red Canary's library of small, portable tests mapped to MITRE ATT&CK techniques, used to check whether detections and logging work.
Each atomic test describes one technique from MITRE ATT&CK, with prerequisites, the action to run and clean-up steps. Defenders run them in controlled environments to verify that the expected telemetry is collected and that alerts fire.
Tests can be run manually or through execution frameworks such as Invoke-AtomicRedTeam. Run them only on systems you control and agree on scope first.
MIT · MIT License · Open source
Checked by ThreatWire against the repository's licence file on 2026-10-20. GitHub detects: MIT.
No published advisory found for Atomic Red Team in GitHub repository advisories. That does not mean the tool has no vulnerabilities.
Sources: GitHub repository advisories · checked 2026-10-20.
Automated adversary emulation platform
Adversary emulation platform created by MITRE, now in the Apache organisation on GitHub, that runs ATT&CK-mapped operations through agents to test defences.
Penetration testing framework
Rapid7's open-source framework for developing, testing and running exploit modules and auxiliary checks in authorised security assessments.
Phishing simulation framework for awareness programmes
Open-source framework to run authorised phishing simulation campaigns, with templates, landing pages, scheduling and result tracking.
