atomic-operator: Atomic Red Team Python Execution Framework

The talk introduces atomic-operator, an open-source Python execution framework built on the Atomic Red Team project from Red Canary. The speaker begins with background on MITRE ATT&CK, describing it as a flexible blueprint of tactics and techniques that teams should adapt to their own environments rather than follow literally. He explains that Atomic Red Team supplies test definitions for individual techniques, which are useful for preparing defenses and for learning how attacks work.

The middle of the talk covers the gap between those YAML definitions and actual execution, which atomic-operator fills. It runs tests on Windows, Linux and macOS, either locally or remotely over PowerShell remoting or SSH. The command-line tool can download the atomics repository, select tests, check and run prerequisites, run cleanup commands and pass input arguments. A Python package interface allows the same logic to be built into other automation. The demo walks through installing the package, running techniques, skipping tests that do not match the current operating system, reviewing logs, and running tests against a remote CentOS host.

The talk closes with the configuration file, which groups hosts into inventories with their own credentials and input values for repeatable runs across environments. The speaker explains that he built the tool to test security products such as EDR and SIEM platforms and to generate alerts for detection engineering. The main takeaway for practitioners is that scripted, repeatable test runs can show which techniques their defenses catch and where coverage is missing.