Atomic Red T1046

Invoke-AtomicTest T1046

Executes the network service scanning atomic test (T1046) with Atomic Red Team, validating detection of reconnaissance via scanning.

Run it in the purple team lab when you want to validate detection of network reconnaissance: the T1046 atomic launches the port scan (the atomic's method: TCP scan to services) and the team verifies what was detected — the IDS/IPS (Suricata, the firewall), the EDR, the SIEM rules. It's the validation of reconnaissance detection: the attacker's real technique in its initial phase. In purple teaming, the atomic validates the scan rules and the result feeds the matrix.

Do not run it in production: the scan generates real reconnaissance traffic and IDS flags it — the lab (or the test segment) is the place. The noise is planned. And watch out: the atomic validates detection of basic TCP scan — stealth scans (SYN, fragmented) are another variant with other atomics; coverage is validated by type. The IDS detection (the scan rule) and the firewall (the log) are the validated layers. The 'detected' result depends on deployed network rules: without IDS or without the rules, the scan passes.