Validating detections with Atomic Red Team in a lab

What atomics are

Atomic Red Team is an open-source library from Red Canary of small tests mapped to ATT&CK techniques. Each atomic is a short, documented action, such as creating a scheduled task or running a discovery command, with a cleanup step. They are meant for defenders to check whether their telemetry and detections work, and they belong only on lab or explicitly approved systems.

Run safely

Use an isolated, snapshotted VM that you own, with your endpoint agent and log forwarding installed. Read each test’s YAML before running it, prefer tests marked as safe discovery or persistence simulations, and always run the cleanup command. Get written approval before running any test outside a personal lab.

• Isolated VM with a snapshot
• Read the atomic YAML first
• Run the cleanup
• Approval for anything beyond your lab

Lab: test a scheduled task detection

On a Windows lab VM, install the Invoke-AtomicRedTeam PowerShell module, list the details of the scheduled task technique, check prerequisites, run one test, confirm in your SIEM that Event ID 4698 and the Sysmon process creation for schtasks.exe arrived and your rule fired, then run cleanup and revert the snapshot.

IEX (IWR 'https://raw.githubusercontent.com/redcanaryco/invoke-atomicredteam/master/install-atomicredteam.ps1' -UseBasicParsing); Install-AtomicRedTeam -getAtomics
Invoke-AtomicTest T1053.005 -ShowDetailsBrief
Invoke-AtomicTest T1053.005 -TestNumbers 1 -CheckPrereqs
Invoke-AtomicTest T1053.005 -TestNumbers 1
# check SIEM for 4698 and the rule alert, then:
Invoke-AtomicTest T1053.005 -TestNumbers 1 -Cleanup

Record results

For each test, record whether telemetry arrived, whether the rule fired, the delay, and any gaps. A missing alert can mean a rule bug, a parsing issue, or missing data, and each needs a different fix. Repeat the tests after SIEM or agent upgrades, because pipelines break silently.