Testing out detection capabilities before putting them into operation is important, even if you don’t have a big production environment to protect (yet). That’s where Atomic Red Team comes in! Together, we’ll talk about an open source library of prebuilt tests to evaluate your environment’s visibility and how you can make your own environment to test them in. We’ll walk through a real world threat (Gootloader!), how it works, and how we can test each of its behaviors to see how our environment stands up against it. Then, we’ll talk a little about the differences between this and live environments. If you want to learn about testing detectors in live environments, this is for you!