My Solo Dive into the world of Atomic Red Team Testing

1. Introduction

1.1 "Teaser" overview

In this project, I took a personal journey, with the guidance and support of my instructors and people very dear to me, into the world of Atomic Red Team (ART) testing. I navigated virtual machines, executed commands using PowerShell, and documented each step to provide a clear insight into how I completed the process.

The thought of completing this project on my own and successfully running three different experiments had me on the edge of my seat—literally! It was both exciting and challenging to see everything come together as I worked through each test and learned from the experience.

I hope you enjoy reading about this journey as much as I enjoyed completing it. As I continue to learn from my mistakes, overcome challenges, and build upon my experiences, I look forward to growing and developing my skills in the ever-evolving world of cybersecurity.

1.2 Introducing yourself to the cyber community

Good day, everyone!

My name is Augustine, and I’m grateful to be part of the cybersecurity community.

I’m currently building my cybersecurity skills and knowledge through a recognized bootcamp that has provided me with a strong foundation in defensive security techniques, threat analysis, incident response, and security operations. I believe that understanding how to identify security gaps and respond effectively to threats is an essential asset in the cybersecurity field.

I know there is still so much to learn, and I’m excited about the journey ahead. I’m taking the time to understand how the different pieces fit together—from analyzing web traffic using SIEM platforms to monitoring network activity and identifying potential threats. I’m also looking forward to connecting with other cybersecurity enthusiasts and professionals, regardless of their level of experience.

My interest in cybersecurity stems from the fact that the world has become a digital village, where so much of our personal information is available online. Protecting that information has become absolutely imperative. While laws and security standards are important, skilled cybersecurity professionals are also needed to identify, prevent, and respond to threats targeting our digital world.

Thank you for welcoming me into the community. I look forward to learning from all of you, sharing my progress, and growing alongside this amazing community.

1. Setup

I added my ART-Workstation to WAZUH- SIEM to be monitored to determine the traffic flowing through it. To achieve this, I had to first set up my Workstation on my SIEM.
I went to my Menu Page on my SIEM, under the Agent Management, and I clicked on the Summary tab
![[Pasted image 20260721081727.png]]

On this page, I clicked on the Deploy New Agent Option
![[Pasted image 20260721081843.png]]
The next page asked me to fill out the necessary information for the endpoint I was looking to add, such as the Operating System (OS), Server address, Agent Name Etc.
![[Pasted image 20260721082101.png]]
After going over the VM list, I could verify the information needed to fill the page.
![[Pasted image 20260721082213.png]]
And like that, my ART-Workstation was added to my SIEM
![[Pasted image 20260721082515.png]]
But it was not yet active, I had to go to the work station and run a command in the PowerShell NET START WazuhSvc
![[Pasted image 20260721082915.png]]

I then went into my OSSEC within my OSSEC-AGENT, located in the Program Files
![[Pasted image 20260721083108.png]]

Here, I changed the Client IP address to my SIEM's IP address
![[Pasted image 20260721083339.png]]
![[Pasted image 20260721083354.png]]
My ART Workstation endpoint became active at this time
![[Pasted image 20260721083427.png|601]]
The big mistake I made was that I did not change the client IP address in my ART-Workstation OSSEC_CONFIG file to my target host. I was not able to launch my tests initially because of that.

1. Experiment time!

Experiment 1- Account Manipulation T1098

I ran the Import-Module "C:\AtomicRedTeam\invoke-atomicredteam\Invoke-AtomicRedTeam.psd1" -Force in PowerShell for ART to know where it is currently operating

![[Pasted image 20260720094247.png]]

I looked at active ART Tests with Invoke-AtomicTest T1098 -ShowDetailsBrief and saw there are 16 tests available

![[Pasted image 20260720094311.png]]

I decided to run Test 1 because it has Prerequisites Met

![[Pasted image 20260720094332.png]]

Ran a Test

![[Pasted image 20260720094346.png]]

Then I had to run a cleanup

![[Pasted image 20260720094405.png]]

Moved over to my SIEM. I was seeing traffic flowing, but not my tests

![[Pasted image 20260720094434.png]]
![[Pasted image 20260720094444.png]]
Went back to my original POWERSHELL and established a session using

$sess = New-PSSession -ComputerName 10.170.0.10 -Credential administrator

I decided to run Test 1 because it has Prerequisites Met, but I noticed it had No Preqs Defined, so I am leaning towards Test 2
![[Pasted image 20260720094519.png]]
Invoke-AtomicTest T1098 -TestNumbers 2 -Session $sess was run successfully, then I ran a cleanup command of Invoke-AtomicTest T1098 -TestNumbers 2 -cleanup -Session $sess
Searched in threat intelligence, under MITRE ATTACKs and saw my tests recorded
![[Pasted image 20260720094557.png]]
Event Viewer also showed the activity of the ART test being run
![[Pasted image 20260720094621.png]]

Experiment 2 - File Deletion T1070

For my second experiment, I decided to test a File Deletion ART.

I ran my command Import-Module "C:\AtomicRedTeam\invoke-atomicredteam\Invoke-AtomicRedTeam.psd1" -Force in PowerShell to bring my Atomic Test to life

The command Invoke-AtomicTest T1070.004 -TestNumbers 4 -ShowDetails showed me details of each Test, like the actual Test name, Number, description, executor, etc.

![[Pasted image 20260721074509.png]]
The command Invoke-AtomicTest T1070.004 -CheckPrereqs brought my attention to the possible tests I can run because that test has Prerequisites met

Running Invoke-AtomicTest T1070.004 -TestNumbers 4 -GetPrereqs allowed me to install the necessary prerequisites needed for my test

![[Pasted image 20260721074534.png]]

I could now run my invoke command to run my test from the workstation using Invoke-AtomicTest T1070.004 -TestNumbers 4

![[Pasted image 20260721074600.png]]

After every test, it was advised to run a -Cleanup

![[Pasted image 20260721074620.png]]

Now I am ready to launch my test to see if traffic flows to my target endpoint.  To establish communication, I have to run a $sess = New-PSSession -ComputerName 10.170.0.10 -Credential administrator command

I can now install my prerequisites on the remote endpoint

![[Pasted image 20260721074650.png]]

I ran my ART Test using Invoke-AtomicTest T1070.004 -Session $sess

![[Pasted image 20260721074714.png]]

After every ART test, it was advised to from -Cleanup to get rid of any undesired leftovers from your ART test

![[Pasted image 20260721074736.png]]

Looked in Event Viewer and saw details of the traffic I developed

![[Pasted image 20260721074757.png]]

On the SIEM, under the MITRE ATTACK-Framework options, I can also see the recent events for the File Deletion attacks from the test I ran

![[Pasted image 20260721074821.png]]

Experiment 3 – Valid Account T1078

My last experiment was focused on Valid Account T1078. I ran the command Invoke-AtomicTest T1078.001 -ShowDetails to see what tests were available. The search found two tests

Next, I ran Invoke-AtomicTest T1078.001 -CheckPrereqs to determine if Prerequisites were available to me and if they were met

![[Pasted image 20260721075412.png]]

Then I ran Invoke-AtomicTest T1078.001 -GetPrereqs so I could run my last experiment successfully

![[Pasted image 20260721075517.png]]

I had already established a session using PowerShell during my last experiment, so I did not have to do that again. Ran my Test immediately

![[Pasted image 20260721075539.png]]

Switched over to my SIEM station to look for evidence of traffic flowing through it. Yes, there it was

![[Pasted image 20260721075619.png]]

The MITRE ATTACK on my SIEM is generating logs for the traffic flowing through it, and I can see the Tests I ran

![[Pasted image 20260721075640.png]]

The Event Viewer on my target host also generated an event

![[Pasted image 20260721075701.png]]

1. Conclusion

Each experimental test that I ran highlighted security gaps within the network that could potentially be exploited. Using the existing Security Information and Event Management (SIEM) platform, I was able to gather important information about each test, including when it occurred and the specific Tactics, Techniques, and Procedures (TTPs) identified by the MITRE ATT&CK framework.

The results demonstrated that the SIEM was functioning properly and successfully detected and recorded the activity generated by the Atomic Red Team (ART) tests. The tests also confirmed that the simulated activities were successfully executed from the host device to the target device.

To avoid some of the mistakes I encountered during this project, I would advise anyone planning to conduct similar tests to follow these guidelines:

• Document every change you make so you can refer back to your work and troubleshoot issues more effectively.
• Confirm that all prerequisites are met before attempting to run an Atomic Red Team (ART) test.
• Develop a strong understanding of the resources available to you and learn how each tool can support your testing and analysis.
• Verify your user privileges before running tests and ensure that you are running PowerShell or other required tools with Administrator privileges when necessary.

1. Final thoughts

5.1 The coolest thing I learned

The coolest thing I have learned so far is how to navigate the Wazuh SIEM. At first, it felt like there was a lot to handle. Still, running these Atomic Red Team (ART) tests helped me become more comfortable navigating the platform and moving between the different options available to investigate traffic and security events.

Understanding the functionalities available within a Security Information and Event Management (SIEM) platform and knowing where to find the necessary resources helped me tremendously. Initially, I felt like I was running around in circles, playing a guessing game with the different options and hoping to find what I was looking for. However, once I developed a better understanding of how the Wazuh SIEM works, everything began to fall into place.

After spending a significant amount of time working with the SIEM and conducting ART tests, I am now able to navigate the Wazuh platform with much more confidence and efficiency. This experience has shown me that becoming familiar with the tools available to cybersecurity professionals is just as important as understanding the underlying concepts. The more I practiced, the more comfortable I became, and I now feel much better equipped to use Wazuh for security monitoring and investigation.

5.2 One piece of advice

After successfully wrapping up my tests, I came to understand one important takeaway that I would gladly share with anyone: understand the task, break it down into manageable parts, and address each part accordingly.

If I had approached this project with this mindset from the very beginning, I would have saved a significant amount of time and avoided putting myself in situations that could have been easily prevented. This experience taught me the importance of taking a structured and methodical approach when working on complex tasks.

Breaking a project into smaller, more manageable steps makes it easier to stay focused, identify potential problems, and address challenges as they arise. Most importantly, this approach allows you to learn from each step of the process and ultimately work toward a more successful outcome.

5.3 My favorite resource

Chamkar, S. A., Maleh, Y., & Gherabi, N. (2024). Security Operations Centers: Use Case Best Practices, Coverage, and Gap Analysis Based on MITRE Adversarial Tactics, Techniques, and Common Knowledge. Journal of Cybersecurity and Privacy, 4(4), 777–793. https://doi.org/10.3390/jcp4040036
This publication mentions that a properly functioning Security Information and Event Management (SIEM) is crucial for a successful Security Operations Centre. This led me to a proper deep dive into the internal workings of SIEMs

5.4 Thank you (gratitudes)!
Winnifred Ndule
Christine Ndule
Odibei Mogekwu
Jean Fobe
Abygayle Lveyy

1. Annotated resources

1.

Chamkar, S. A., Maleh, Y., & Gherabi, N. (2024). Security Operations Centers: Use Case Best Practices, Coverage, and Gap Analysis Based on MITRE Adversarial Tactics, Techniques, and Common Knowledge. Journal of Cybersecurity and Privacy, 4(4), 777–793. https://doi.org/10.3390/jcp4040036
This publication mentions that a properly functioning Security Information and Event Management (SIEM) is crucial for a successful Security Operations Centre.

2.
Imran, W. (2025). ATOMIC RED TEAM. https://medium.com/@write2wania/atomic-red-team-c11b01084941
This article mentions that Atomic Red Team Tests should not be random but tailored for each company looking for loopholes within its security apparatus.

3.
Nutile, T. (2019). Testing Your Network Defenses by Imitating Malicious Adversaries.
https://www.mitre.org/news-insights/impact-story/testing-your-network-defenses-imitating-malicious-adversaries#:~:text=Testing%20Your%20Network%20Defenses%20by,that%20are%20difficult%20to%20penetrate.
Introduced the CALDERA platform to me. This platform does not need users to turn off their antivirus software during testing, leaving their systems exposed.

4.
Sanchez, J. (2025). Atomic Red Team: The Detection Engineer's Reality Check. https://www.linkedin.com/pulse/atomic-red-team-detection-engineers-reality-check-julio-sanchez-u8m3c/
This article speaks about the gaps in coverage and the advantages of SIEM deployments.

5.
Bino, D. (2026). "Atomic Red Team PowerShell Tests: Examples & How to Run." RST, https://www.redsecuretech.co.uk/blog/post/atomic-red-team-powershell-tests-examples-and-how-to-run/904
This article highlights the fact that, though Cleanup after each Test is often run automatically, you should still verify if it needs to be done manually.