Create, deploy, and execute custom Atomic Red Team tests (T9999.XXX series) for detection validation. Covers YAML authoring, Ansible deployment, and manual alternatives.
Install with Codex or Claude Copy this prompt, paste it into Codex, Claude, or another assistant, and let it review the skill page and install it for you.
A direct command skips the review prompt. Inspect the source before running it.
Create, deploy, and execute custom Atomic Red Team tests (T9999.XXX series) for detection validation. Covers YAML authoring, Ansible deployment, and manual alternatives.
Custom Atomics Deployment Skill
Overview
When no standard Atomic Red Team test covers your detection scenario, create a custom atomic using the T9999.XXX numbering scheme. This avoids collisions with upstream technique IDs while giving you full control over the test payload.
Configuration
Required environment variables:
Variable
Description
Example
$ATOMICS_PATH
Path to atomic-red-team atomics directory
/opt/atomic-red-team/atomics
$CUSTOM_ATOMICS_PATH
Path to your custom atomics repo/directory
/opt/custom-atomics
$ATTACK_RANGE_PATH
Path to Attack Range (if using AR for deployment)
/opt/attack-range
$ATTACK_RANGE_VENV
Attack Range Python venv
/opt/attack-range/.venv
$ANSIBLE_INVENTORY
Path to Ansible inventory file
/etc/ansible/hosts
Target placeholders:
<TARGET_IP> — IP address of the test endpoint
<TARGET_NAME> — Hostname of the test endpoint (e.g., ar-win-1)
attack_technique:T9999.001display_name:"Custom - Suspicious Encoded PowerShell Download"atomic_tests:-name:"PowerShell download cradle with Net.WebClient and encoding"auto_generated_guid:<generate-a-uuid>description:|
Simulates an encoded PowerShell download cradle using Net.WebClient.
Maps to T1059.001 (PowerShell) + T1105 (Ingress Tool Transfer).
Designed to trigger detections for encoded command execution.
supported_platforms:-windowsinput_arguments:target_url:description:URLtodownloadfromtype:urldefault:"http://127.0.0.1:8080/test.txt"dependency_executor_name:powershelldependencies:-description:"PowerShell must be available"prereq_command:"Get-Command powershell.exe"get_prereq_command:"echo 'PowerShell not found'"executor:command:|
$encoded = [Convert]::ToBase64String([Text.Encoding]::Unicode.GetBytes("(New-Object Net.WebClient).DownloadString('#{target_url}')"))
powershell.exe -EncodedCommand $encoded
cleanup_command:|
echo "No cleanup required"
name:powershellelevation_required:false
YAML Authoring Tips
Always include auto_generated_guid — Generate with uuidgen or any UUID tool
Use input_arguments — Makes tests reusable across environments
Include dependencies — Prerequisite checks prevent confusing failures
Include cleanup_command — Even if it's just a no-op, document it
Map to real techniques — Note which ATT&CK technique(s) the custom atomic simulates in the description
Deployment Methods
Method 1: Ansible (Recommended)
Ansible provides idempotent, repeatable deployment to one or many targets.
