Atomic Red T1547.001

Invoke-AtomicTest T1547.001

Executes the atomic test for registry Run keys (T1547.001) with Atomic Red Team, validating detection of registry persistence.

Run it in the purple team lab when you want to validate detection of Run key persistence: the T1547.001 atomic adds the registry key (HKCU\...\Run with the payload) and the team checks what was detected — Sysmon Event 13 (registry set), SIEM rules, EDR. It's the validation of registry persistence detection: the real technique executed. In purple teaming, the atomic validates Run key rules and the result feeds the matrix.

Do not run it in production: the atomic modifies the registry of the test host (real persistence) — the lab is the place and the key is cleaned up at the end (the atomic's cleanup). The noise is planned. And note: the atomic validates the Run key variant (HKCU/HKLM) — other persistence keys (RunOnce, Startup) have other atomics; coverage is validated per variant. Detection of the registry change (Sysmon Event 13 on the Run key) is the rule being validated; without it, the attacker's registry persistence goes unnoticed.