Magic-Atomics: The Prevention Engineer's Toolkit

Atomic Prevention Testing... because not everything needs to be detected.

Last Friday, we released Magic-Atomics, an open-source prevention testing framework that takes the entire Living-Off-the-Land (LOL) ecosystem and turns it into runnable, repeatable simulations so security teams can answer one question with confidence:

"If an adversary tried this on our endpoints right now, would it actually be blocked?"

Not detected. Not alerted on. Blocked.

Why prevention, not just detection?

For the last decade the SOC industry has been obsessed with detection engineering. Build detections. Tune detections. Triage alerts. Calculate MTTD and MTTR. All good things - but they assume the attack already landed and now you're racing the adversary.

We think there's an under-served discipline alongside detection engineering: prevention engineering. Prevention engineers don't ask "will I see this?" They ask "will my controls stop this from running in the first place?" And they want to validate that answer continuously, not once a year during a red team.

So we coined a metric we want every prevention engineer thinking about:
MTTP - Mean Time To Prevent.

How quickly can your stack go from "an adversary ran this LOL technique" to "blocked, contained, cleaned up"?

If your MTTP for certutil.exe -urlcache -split -f <url> is "we'd see it in our SIEM in 3 hours" - that's a detection score, not a prevention score. Prevention engineers want MTTP measured in milliseconds: WDAC, AppLocker, AMSI, EDR exploit prevention, HVCI, attack surface reduction rules - controls that block the binary before it gets a chance to call home.

Magic-Atomics is the test harness for that work.

What's in the box

Magic-Atomics aggregates 11 of the best LOL data sources in the industry into a single FastAPI backend, a Next.js dashboard, and cross-platform agents:

Total: 4,800+ prevention tests across 692 MITRE ATT&CK techniques and 172 threat groups.

Adversary-driven playbooks

Generic test runs are noise. Prevention engineers want to validate against specific threat actors targeting their industry: Volt Typhoon for critical infrastructure, Scattered Spider for SaaS-heavy enterprises, Black Basta for healthcare, FIN7 for retail.

Magic-Atomics ships with 172 MITRE ATT&CK adversary groups parsed from the official STIX data, each with its full technique mapping. Pick a group, pick a platform, click Generate - out comes a playbook tailored to how that group actually operates.

We also built a 5-stage combo playbook called "ClickFix to Crown Jewels" that chains LOLBAS + LOLRMM + LOLDrivers into a realistic kill chain:

1. Initial Access - PowerShell download cradle from a fake CAPTCHA (T1204.004)
2. LOL Binary Abuse - rundll32 proxy execution (T1218.011)
3. RMM Persistence - AnyDesk download and execute (T1219)
4. Discovery - systeminfo, whoami, ipconfig, tasklist (T1082)
5. Credential Dumping - comsvcs.dll LSASS MiniDump (T1003.001)

If your stack blocks every stage, that's a real prevention story you can tell your CISO. If stage 4 makes it through but stage 5 gets caught - now you know where the gap is.

Running it: 60 seconds from clone to first verdict

Spin up the platform

git clone https://github.com/magicsword-io/Magic-Atomics

cd Magic-Atomics

docker compose up -d

That's it. Backend on :8000, dashboard on :3000, SQLite database, all 11 ingestors registered. First boot pulls MITRE ATT&CK STIX data and seeds 692 techniques + 172 groups.

Prefer to see it in action first? Watch the full live demo.

Sync the LOL sources

From the UI, click each source's sync button - or hit the API:

for src in lolbas atomic-red-team loldrivers lolrmm gtfobins loobins loas \

lolapi lottunnels persistence-info sysinternals; do

curl -X POST http://localhost:8000/api/sources/$src/sync

done

Generate a playbook

Pick "Volt Typhoon" from the dropdown, pick Windows, hit Generate. Or via API:

curl -X POST http://localhost:8000/api/playbooks/generate \

-H "Content-Type: application/json" \

-d '{"adversary_group_id": "G1017", "platforms": ["windows"]}'

Run it on Windows

Download the agent from the sidebar (the W/M/L logo buttons), unzip on your test endpoint, then:

Import-Module .\MagicAtomics\MagicAtomics.psm1

Invoke-MagicAtomics -Playbook .\playbook-volt-typhoon.json -ServerUrl http://localhost:8000

The agent runs each test, watches Start-Process exit codes and stderr for block-indicator patterns (Access Denied, AMSI, code integrity, signature failures, etc.), reports a verdict per test, and POSTs the results back to the server.

Run it on macOS or Linux

Same playbook, single-file Python agent (Python 3.8+, zero dependencies):

python3 magic_atomics_runner.py --playbook ./playbook.json --server http://localhost:8000

The Python runner detects platform-specific block patterns: Gatekeeper / TCC / XProtect / SIP on macOS; AppArmor / SELinux / seccomp on Linux. So when GTFOBins tries python -c 'os.system("/bin/sh")' on a hardened Linux box and AppArmor refuses, you get a green BLOCKED verdict - not a crashed test.

See it on the dashboard

Results are streamed back, the MITRE matrix lights up: green for techniques that were fully blocked across all tests, red for any technique where even one test was allowed. Click a red cell, see exactly which test slipped through, and ship a hardening change.

Continuous prevention validation

One run is interesting. Continuous runs are operational.

Magic-Atomics is built around the idea that prevention is a state, not an event. Your stack drifts. Vendors push agent updates that quietly disable an ASR rule. Someone adds an AppLocker exclusion for a vendor installer and forgets it. A Windows feature update resets WDAC policy.

The way you catch that drift is by re-running the same playbook on the same hosts every night and watching the prevention score curve. That's the same loop detection engineers run for their detections - Magic-Atomics is just the prevention-side equivalent.

Scheduling-wise, today the simplest path is:

• Drop the agent on a small fleet of representative test endpoints
• Run a nightly scheduled task / cron / launchd job invoking the agent against your golden playbook
• Submit results to the same backend
• Watch the trendline

Built-in API documentation

Every endpoint that powers the UI is documented and live-testable inside the app at /docs. Click the "Try it" button on any GET endpoint, see the actual response from your running instance.

This is intentional - prevention engineers tend to be the same people who write Python wrappers, integrate with their ticketing system, and pipe results into Splunk/Sentinel/Elastic. The full FastAPI OpenAPI spec is also at /docs (Swagger) and /redoc if you prefer those.

A quick taste of the API:

# Find every adversary group that uses LOLDrivers techniques

curl 'http://localhost:8000/api/techniques?source=loldrivers' | jq

# Generate a playbook on the fly

curl -X POST http://localhost:8000/api/playbooks/generate \

-d '{"technique_ids": ["T1218.011", "T1059.001"], "platforms": ["windows"]}'

# Pull verdicts straight into your dashboard

curl http://localhost:8000/api/results/verdicts | jq

Get it

• GitHub: https://github.com/magicsword-io/Magic-Atomics
• Docs: http://localhost:3000/docs (after you spin up the container)

git clone https://github.com/magicsword-io/Magic-Atomics

cd Magic-Atomics

docker compose up -d

open http://localhost:3000

Magic-Atomics is part of the MagicSword ecosystem. Brought to you by the team that thinks prevention should be measured, not assumed.

Sign up free - Free up to 100 endpoints
Book a demo - Try Enterprise free for 14 days