Technical requirements

• The virtual environment from Chapter 7, Creating a research environment, up and running.
• Git installed in the system
• Access to Atomic Red Team website: https://atomicredteam.io/
• Access to QuasarRat GitHub repository: https://github.com/quasar/Quasar
• Access to Invoke-AtomicRedTeam repository: https://github.com/redcanaryco/invoke-atomicredteam
• Access to the MITRE ATT&CK Matrix at: https://attack.mitre.org/

Atomic Hunting with Atomic Red Team

We talked about Red Canary’s Atomic Red Team in Chapter 6, Emulating the Adversary. Just to refresh your memory, Atomic Red Team is an open source project to carry out scripted atomic test towards an organization’s defenses. Atomic Red Team is also mapped to the MITRE ATT&CK™ Framework and offers an extensive coverage of the frameworks’ techniques.

In this section, we are going to use atomic tests to learn how to execute test, collect the evidence from our HELK instance and how to develop...