Atomic Red T1003.001

Invoke-AtomicTest T1003.001

Executes the LSASS dump atomic test (T1003.001) with Atomic Red Team, validating that credential dumping detections work.

Run it in the purple team lab when you want to validate detection of LSASS dumping: the T1003.001 atomic replicates credential dumping (procdump -ma lsass or the atomic's method) and the team verifies what was detected — Sysmon Event 10, the EDR, SIEM rules. It's the detection validation cycle: the real technique executed in a controlled manner and coverage measured. In purple teaming, the atomic is executed after deploying the detection and the result (detected or not) feeds the ATT&CK coverage matrix.

Don't run it in production: the atomic dumps LSASS (generates real dumping events) and EDRs may block it or SOCs may treat it as an incident — the test host or lab is the place. The exercise noise is planned (teams notified). And note: the atomic validates detection of the technique, not prevention — the EDR allowing the dump to execute but generating an alert is a valid result. The test runs with the environment's credentials (Invoke-AtomicTest with the lab's admin user); without permissions, the atomic fails and the result is not interpretable.