Purple › Module 6 › Lesson 1
Atomic Named
Atomic simulation literacy — named Atomic Red Team concepts, test atom structure, ATT&CK technique mapping — defender vocabulary on YOUR `$PURPLE_LAB` lab VMs only.
Visual · t35_atomic_named
Atomic = named simulation literacy. $PURPLE_LAB. Original Cyberlium.
Opening
Atomic tests validate detections on YOUR lab hosts — name Atomic Red Team vocabulary on `$PURPLE_LAB` before running simulations against stranger networks.
Atomic simulation literacy names: Atomic Red Team test atom category, ATT&CK technique ID mapping category, executor and platform literacy stub category, expected telemetry category, and detection validation goal category. Analyst documents atomic test card on `$PURPLE_LAB` instructor lab VM — maps technique to detection rule from Module 4–5 — without running atomics on unauthorized prod endpoints, without stranger-network attack sims, without weaponized red playbooks. Cyberlium teaches purple simulation vocabulary on YOUR labeled notes under $HOME/cyberlium-lab/t35-purple/ — coverage and tuning literacy only. Refused: prod atomic runs without ticket, stranger org sims, full attack chain cookbooks. Lab row: atomic test card (technique ID, executor stub, expected telemetry, detection goal). chmod 600.
1. Named atomic literacy rows
Test atom, ATT&CK technique ID, executor/platform stub, expected telemetry, detection goal — five literacy anchors.
Each row cites YOUR lab VM scope — not generic red-team blog advice.
Command guide
Try these commands — Named atomic literacy rows
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
Atomic Red Team — https://github.com/redcanaryco/atomic-red-team Atomic Red Team site — https://redcanary.com/atomic-red-team/ MITRE ATT&CK — https://attack.mitre.org/
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install curl
macOS: Built-in
Windows: Built-in (PowerShell: Invoke-WebRequest)
═══ LINUX / macOS ═══
Command — copy this
export PURPLE_LAB=${PURPLE_LAB:-$HOME/cyberlium-lab/t35-purple}
curl -sS https://redcanary.com/atomic-red-team/ | head -10
cat > "$PURPLE_LAB/atomic/atomic-literacy.txt" <<'EOF'
Atomic Red Team — NAMED LITERACY (defensive catalog):
Structure: atomics/T1XXX/technique.yaml + platform tests
Invoke-AtomicTest: PowerShell runner — YOUR lab VM ONLY
Safe lab example: T1082 System Information Discovery (read-only)
Document: git clone https://github.com/redcanaryco/atomic-red-team
List tests: ls atomics/T1082/ — read YAML, do NOT run banned tests
HARD BAN: ransomware atomics; credential dump atomics; stranger-network sims
Prefer: exercise plan markdown + coverage CSV — Atomic install optional
EOFCommand — copy this
grep -E 'T1082|HARD BAN|Prefer|clone' "$PURPLE_LAB/atomic/atomic-literacy.txt"
Primary tools to practice this lesson: curl, grep. Reference sites: Atomic Red Team (https://github.com/redcanaryco/atomic-red-team); Atomic Red Team site (https://redcanary.com/atomic-red-team/); MITRE ATT&CK (https://attack.mitre.org/). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Detection validation link
Atomic tests exist to validate blue detections — link Module 5 rule test rows.
Success = telemetry observed and rule fired on lab stub — not 'got shell.'
3. $PURPLE_LAB boundary
Atomic notes from YOUR authorized lab VMs only — not stranger org networks.
Refused: prod atomic deploy, weaponized playbooks, unauthorized ATT&CK sims.
4. What you ship: atomic test card
Technique ID + executor stub + expected telemetry + detection goal + NEVER stranger-network sim line.
5. What you record before the next lesson
Atomic test card path.
6. Wrong vs right: stranger networks vs YOUR purple lab
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Run Atomic Red Team tests against employer prod endpoints without ticket as 'detection validation.'
Right
Atomic test card from `$PURPLE_LAB` lab VM stub. Next: Scope and RoE.
Mission: atomic test card
1) Name five atomic literacy rows. 2) Map technique to detection rule from Module 5. 3) Expected telemetry and detection goal per row. 4) Write NEVER stranger-network atomic sim line.
Stuck? Ask Cyberlium AI Mentor
Ask Mentor: “Atomic test vs full attack chain — literacy boundary?”
Knowledge Check
APPLY: Atomic literacy on Cyberlium uses:
Multiple choice
Knowledge Check
APPLY: True or False: Stranger org atomic sims belong in purple lab.
True or False
Knowledge Check
APPLY: Atomic test card includes:
Multiple choice