The maintainers team welcomes Paul Michaud, a Principal Incident Handler at Red Canary who brings deep knowledge of Windows internals and firsthand perspective from years of experience responding to threats in customers’ environments.

Watch Adam Mashinchi’s top-rated talk, “Atomic Red Team: Where Adversary Emulation and EDR Testing Meet” from this year’s RSA conference.

Invoke-Atomic's new -noPayloads option lets you download the YAML files from the atomic-install script without any of the /src and /bin files. You can then use getPrereqs to download only the payloads for which you are testing.

Thanks to maintainer Mike Haag, the test for T1556.002 now includes a DLL that will load into lsass.exe upon reboot when run successfully.