Atomic Red T1071.001

Invoke-AtomicTest T1071.001

Executes the C2 atomic test over web protocols (T1071.001) with Atomic Red Team, validating detection of C2 communication.

Run it in the purple team lab when you want to validate C2 detection: the T1071.001 atomic replicates HTTP/HTTPS communication (the periodic request to the control server) and the team checks what was detected — the proxy/network logs, the IDS, the SIEM beaconing rules. It's the validation of C2 detection: the attacker's real communication. In purple teaming, the atomic validates C2 rules (beaconing, domains) and the result feeds the matrix.

Do not run it in production: communication with the control server generates real traffic — the lab (with the local atomic server) is the place. And note: the atomic validates the simple HTTP variant — encrypted C2, with jitter, or over DNS are other variants with other atomics; coverage is validated per channel. Proxy detection (the destination) and periodicity detection (the beaconing) are the validated layers. The atomic's local server (the listener) is part of the test: without it, communication is not established.