art_search
Search Atomic Red Team tests by keyword to locate relevant attack techniques, commands, or artifacts. Filter results by platform or executor to identify tests matching your detection scenario.
Instructions
Full-text search across all Atomic Red Team tests (~1,770+). Searches test names, descriptions, commands, arguments, file paths, and binary names. Use to find tests by attack tool (e.g., "mimikatz"), binary (e.g., "certutil"), technique pattern (e.g., "registry run key"), or artifact (e.g., "powershell -enc").
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| limit | No | Maximum results to return (default: 30, max: 100) | |
| keyword | Yes | Search keyword (e.g., "mimikatz", "certutil", "registry", "download cradle", "webshell") | |
| executor | No | Optional: filter by executor — powershell, command_prompt, bash, sh, manual | |
| platform | No | Optional: filter by platform — windows, linux, macos |