Purple › Module 6 › Lesson 1
Atomic Named
Atomic simulation literacy — named Atomic Red Team concepts, test atom structure, ATT&CK technique mapping — defender vocabulary on YOUR `$PURPLE_LAB` lab VMs only.
Visual · t35_atomic_named
Atomic = named simulation literacy. $PURPLE_LAB. Original Cyberlium.
Opening
Atomic tests validate detections on YOUR lab hosts — name Atomic Red Team vocabulary on `$PURPLE_LAB` before running simulations against stranger networks.
Atomic simulation literacy names: Atomic Red Team test atom category, ATT&CK technique ID mapping category, executor and platform literacy stub category, expected telemetry category, and detection validation goal category. Analyst documents atomic test card on `$PURPLE_LAB` instructor lab VM — maps technique to detection rule from Module 4–5 — without running atomics on unauthorized prod endpoints, without stranger-network attack sims, without weaponized red playbooks. Cyberlium teaches purple simulation vocabulary on YOUR labeled notes under $HOME/cyberlium-lab/t35-purple/ — coverage and tuning literacy only. Refused: prod atomic runs without ticket, stranger org sims, full attack chain cookbooks. Lab row: atomic test card (technique ID, executor stub, expected telemetry, detection goal). chmod 600.
1. Named atomic literacy rows
Test atom, ATT&CK technique ID, executor/platform stub, expected telemetry, detection goal — five literacy anchors.
Each row cites YOUR lab VM scope — not generic red-team blog advice.
Command guide
Try these commands — Named atomic literacy rows
═══ LINUX / macOS (Terminal Practice) ═══
Check system state and user context
Command — copy this
id whoami uname -a
Inspect network sockets listening for connections
Command — copy this
ss -tuln 2>/dev/null || netstat -tuln
Audit active processes
Command — copy this
ps aux | grep -v "\[" | head -15
═══ WINDOWS (POWERSHELL) ═══ Query user identity and system information
Command — copy this
whoami /all Get-ComputerInfo | Select-Object CsName, OsName, OsVersion
Primary tools to practice this lesson: curl, grep. Reference sites: Atomic Red Team (https://github.com/redcanaryco/atomic-red-team); Atomic Red Team site (https://redcanary.com/atomic-red-team/); MITRE ATT&CK (https://attack.mitre.org/). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Detection validation link
Atomic tests exist to validate blue detections — link Module 5 rule test rows.
Success = telemetry observed and rule fired on lab stub — not 'got shell.'
3. $PURPLE_LAB boundary
Atomic notes from YOUR authorized lab VMs only — not stranger org networks.
Refused: prod atomic deploy, weaponized playbooks, unauthorized ATT&CK sims.
4. What you ship: atomic test card
Technique ID + executor stub + expected telemetry + detection goal + NEVER stranger-network sim line.
5. What you record before the next lesson
Atomic test card path.
6. Wrong vs right: stranger networks vs YOUR purple lab
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Run Atomic Red Team tests against employer prod endpoints without ticket as 'detection validation.'
Right
Atomic test card from `$PURPLE_LAB` lab VM stub. Next: Scope and RoE.
Mission: atomic test card
1) Name five atomic literacy rows. 2) Map technique to detection rule from Module 5. 3) Expected telemetry and detection goal per row. 4) Write NEVER stranger-network atomic sim line.
Stuck? Ask Cyberlium AI Mentor
Ask Mentor: “Atomic test vs full attack chain — literacy boundary?”
Knowledge Check
APPLY: Atomic literacy on Cyberlium uses:
Multiple choice
Knowledge Check
APPLY: True or False: Stranger org atomic sims belong in purple lab.
True or False
Knowledge Check
APPLY: Atomic test card includes:
Multiple choice