performing-purple-team-exercise

Performing Purple Team Exercise

When to Use

Use this skill when:

• SOC teams need to validate that detection rules actually fire for the threats they target
• Red team assessments produced findings that need translation into detection improvements
• New detection tools or SIEM migrations require validation of detection coverage
• Analyst training requires hands-on experience with real attack techniques and SIEM responses
• Quarterly or semi-annual detection validation cycles are scheduled

Do not use for unannounced red team engagements — purple team exercises require explicit coordination between offensive and defensive teams with real-time collaboration.

Prerequisites

• Red team capability: internal team or contracted purple team operator
• Attack simulation tools: Atomic Red Team, MITRE Caldera, or C2 framework (authorized)
• SIEM access for real-time alert monitoring during exercise
• ATT&CK-mapped detection rule inventory with expected alert names
• Isolated test environment or approved production scope with change management approval
• Communication channel (Slack/Teams) for real-time red-blue coordination

Workflow

Step 1: Define Exercise Scope and Objectives

Document exercise parameters:

purple_team_exercise:
  exercise_id: PT-2024-Q1
  date: 2024-03-20
  duration: 8 hours (09:00-17:00 UTC)
  scope:
    environment: Production (Finance VLAN, 10.0.5.0/24)
    systems_in_scope:
      - WORKSTATION-TEST01 (10.0.5.100) — Test endpoint
      - DC-TEST (10.0.5.200) — Test domain controller
      - FILESERVER-TEST (10.0.5.201) — Test file server
    systems_excluded:
      - All production domain controllers
      - Customer-facing systems
  objectives:
    - Validate 15 detection rules mapped to FIN7 TTPs
    - Test SOC analyst response to real attack indicators
    - Identify detection gaps for credential access and lateral movement
    - Measure detection latency for each technique
  threat_scenario: FIN7 campaign targeting financial data via spearphishing
  authorization: Approved by CISO, Change Request CR-2024-0567
  communication: #purple-team-2024q1 Slack channel

Step 2: Build ATT&CK-Mapped Test Plan

Create technique-by-technique test matrix:

#	ATT&CK ID	Technique	Test Tool	Expected Detection	Blue Team Metric
1	T1566.001	Spearphishing Attachment	Manual email	Email gateway alert	Detection Y/N, latency
2	T1204.002	User Execution	Macro document	Sysmon process creation	Detection Y/N, latency
3	T1059.001	PowerShell	Atomic RT #1-3	PowerShell execution alert	Detection Y/N, latency
4	T1053.005	Scheduled Task	Atomic RT	Scheduled task creation alert	Detection Y/N, latency
5	T1547.001	Registry Run Keys	Atomic RT	Registry modification alert	Detection Y/N, latency
6	T1003.001	LSASS Memory	Mimikatz	Credential dumping alert	Detection Y/N, latency
7	T1550.002	Pass-the-Hash	Mimikatz	NTLM anomaly detection	Detection Y/N, latency
8	T1021.002	SMB/PsExec	PsExec	PsExec service creation alert	Detection Y/N, latency
9	T1047	WMI	wmic /node	WMI remote execution alert	Detection Y/N, latency
10	T1021.001	RDP	xfreerdp	RDP lateral movement alert	Detection Y/N, latency
11	T1071.001	Web C2	Cobalt Strike	C2 beacon detection	Detection Y/N, latency
12	T1041	Exfiltration C2	Rclone	Data exfiltration alert	Detection Y/N, latency
13	T1490	Inhibit Recovery	vssadmin	Shadow copy deletion alert	Detection Y/N, latency
14	T1486	Data Encrypted	Test encryption	Mass encryption detection	Detection Y/N, latency
15	T1070.001	Clear Logs	wevtutil	Log clearing detection	Detection Y/N, latency

Step 3: Execute Red Team Techniques

Run each technique with Atomic Red Team (or manual execution):

# Install Atomic Red Team
IEX (IWR 'https://raw.githubusercontent.com/redcanaryco/invoke-atomicredteam/master/install-atomicredteam.ps1' -UseBasicParsing)
Install-AtomicRedTeam -getAtomics

# Test 1: T1059.001 — PowerShell Execution
Write-Host "[$(Get-Date -Format 'HH:mm:ss')] Executing T1059.001 - PowerShell"
Invoke-AtomicTest T1059.001 -TestNumbers 1
# Notify blue team: "T1059.001 executed at $(Get-Date)"

# Test 2: T1053.005 — Scheduled Task Creation
Write-Host "[$(Get-Date -Format 'HH:mm:ss')] Executing T1053.005 - Scheduled Task"
Invoke-AtomicTest T1053.005 -TestNumbers 1

# Test 3: T1547.001 — Registry Run Key
Write-Host "[$(Get-Date -Format 'HH:mm:ss')] Executing T1547.001 - Registry Persistence"
Invoke-AtomicTest T1547.001 -TestNumbers 1,2

# Test 4: T1003.001 — Credential Dumping
Write-Host "[$(Get-Date -Format 'HH:mm:ss')] Executing T1003.001 - LSASS Access"
Invoke-AtomicTest T1003.001 -TestNumbers 1,2

# Test 5: T1490 — Shadow Copy Deletion
Write-Host "[$(Get-Date -Format 'HH:mm:ss')] Executing T1490 - Inhibit Recovery"
Invoke-AtomicTest T1490 -TestNumbers 1

# Cleanup after each test
Invoke-AtomicTest T1059.001 -TestNumbers 1 -Cleanup
Invoke-AtomicTest T1053.005 -TestNumbers 1 -Cleanup
Invoke-AtomicTest T1547.001 -TestNumbers 1,2 -Cleanup

Step 4: Monitor Blue Team Detection in Real-Time

Blue team monitors SIEM during execution:

--- Real-time purple team monitoring dashboard
index=notable earliest=-1h
| where Computer IN ("WORKSTATION-TEST01", "DC-TEST", "FILESERVER-TEST")
  OR src IN ("10.0.5.100", "10.0.5.200", "10.0.5.201")
| eval detection_latency = _time - orig_time
| eval latency_seconds = round(detection_latency, 0)
| sort _time
| table _time, rule_name, urgency, src, dest, user, latency_seconds

--- Check specific technique detection
index=sysmon Computer="WORKSTATION-TEST01" earliest=-15m
(EventCode=1 OR EventCode=3 OR EventCode=10 OR EventCode=11 OR EventCode=13)
| sort _time
| table _time, EventCode, Image, CommandLine, TargetFilename, TargetObject

Record results in real-time:

exercise_results = {
    "exercise_id": "PT-2024-Q1",
    "results": [
        {
            "technique": "T1059.001",
            "name": "PowerShell Execution",
            "execution_time": "09:15:00",
            "detected": True,
            "alert_name": "Suspicious PowerShell Encoded Command",
            "detection_time": "09:15:47",
            "latency_seconds": 47,
            "notes": "Detected via Sysmon EventCode 1 with encoded command pattern"
        },
        {
            "technique": "T1003.001",
            "name": "LSASS Memory Access",
            "execution_time": "10:30:00",
            "detected": False,
            "alert_name": None,
            "detection_time": None,
            "latency_seconds": None,
            "notes": "GAP: No detection rule for LSASS access. Sysmon EventCode 10 present but no correlation rule."
        }
    ]
}

Step 5: Collaborative Gap Remediation

For each gap, the blue team builds detection rules immediately:

--- Gap: T1003.001 — No LSASS access detection
--- Build rule during exercise
index=sysmon EventCode=10 TargetImage="*\\lsass.exe"
GrantedAccess IN ("0x1010", "0x1038", "0x1fffff", "0x40")
NOT SourceImage IN ("*\\svchost.exe", "*\\csrss.exe", "*\\MsMpEng.exe")
| stats count by Computer, SourceImage, SourceUser, GrantedAccess
| where count > 0

After building, re-test:

Red Team: "Re-executing T1003.001 at 11:45"
Blue Team: "Confirmed — alert 'LSASS Memory Access Detected' fired at 11:45:32 (32s latency)"
Result: GAP CLOSED

Step 6: Generate Exercise Report

def generate_purple_team_report(results):
    total = len(results["results"])
    detected = sum(1 for r in results["results"] if r["detected"])
    gaps = sum(1 for r in results["results"] if not r["detected"])
    avg_latency = sum(r["latency_seconds"] for r in results["results"]
                      if r["latency_seconds"]) / max(detected, 1)

    report = f"""
PURPLE TEAM EXERCISE REPORT — {results['exercise_id']}
{'=' * 60}

SUMMARY:
  Techniques Tested:     {total}
  Detected:              {detected} ({detected/total*100:.0f}%)
  Gaps Identified:       {gaps} ({gaps/total*100:.0f}%)
  Avg Detection Latency: {avg_latency:.0f} seconds

DETAILED RESULTS:
"""
    for r in results["results"]:
        status = "DETECTED" if r["detected"] else "GAP"
        latency = f"{r['latency_seconds']}s" if r["latency_seconds"] else "N/A"
        report += f"  [{status}] {r['technique']} — {r['name']} (Latency: {latency})\n"
        if not r["detected"]:
            report += f"          Action: {r['notes']}\n"

    return report

Key Concepts

Term	Definition
Purple Team	Collaborative exercise where red (offensive) and blue (defensive) teams work together to validate and improve detection
Adversary Emulation	Structured simulation of specific threat actor TTPs for testing defensive capabilities
Detection Validation	Process of confirming that detection rules fire correctly when the targeted technique is executed
Detection Latency	Time between technique execution and SIEM alert generation — measured during purple team exercises
Gap Remediation	Immediate creation or tuning of detection rules for techniques that were not detected during testing
Atomic Red Team	Open-source library of small, focused tests for individual ATT&CK techniques

Tools & Systems

• Atomic Red Team: Open-source attack test library from Red Canary for technique-by-technique validation
• MITRE Caldera: Automated adversary emulation platform supporting ATT&CK-mapped attack chains
• Vectr: Purple team management platform for tracking exercise results and detection coverage improvements
• Prelude Operator: Adversary emulation tool supporting automated multi-step attack scenarios
• AttackIQ: Breach and Attack Simulation (BAS) platform for continuous detection validation

Common Scenarios

• Quarterly Validation: Test top 20 detection rules against ATT&CK techniques to ensure continued effectiveness
• New Tool Validation: After deploying new EDR, validate detection coverage against baseline techniques
• Analyst Training: Junior analysts observe real attacks in real-time with expert guidance on SIEM investigation
• Post-Incident Validation: After a real incident, emulate the attack chain to verify detection improvements
• Compliance Evidence: Document detection validation results for SOC 2, ISO 27001, or PCI DSS audits

Output Format

PURPLE TEAM EXERCISE REPORT — PT-2024-Q1
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
Date:         2024-03-20 (09:00-17:00 UTC)
Scenario:     FIN7 Financial Sector Campaign
Scope:        Finance VLAN (10.0.5.0/24)

RESULTS:
  Techniques Tested:     15
  Detected:              11 (73%)
  Gaps Identified:       4 (27%)
  Gaps Remediated Same Day: 3
  Avg Detection Latency: 38 seconds

DETAILED RESULTS:
  [PASS]  T1566.001 Spearphishing Attachment      — 12s latency
  [PASS]  T1204.002 User Execution (Macro)         — 8s latency
  [PASS]  T1059.001 PowerShell Execution            — 47s latency
  [PASS]  T1053.005 Scheduled Task                  — 23s latency
  [PASS]  T1547.001 Registry Run Keys               — 31s latency
  [FAIL]  T1003.001 LSASS Memory Access             — REMEDIATED during exercise
  [FAIL]  T1550.002 Pass-the-Hash                   — REMEDIATED during exercise
  [PASS]  T1021.002 PsExec                          — 15s latency
  [PASS]  T1047 WMI Remote Execution                — 42s latency
  [PASS]  T1021.001 RDP Lateral Movement            — 28s latency
  [FAIL]  T1071.001 Web C2 Beaconing                — REMEDIATED during exercise
  [PASS]  T1041 Exfiltration over C2                — 67s latency
  [PASS]  T1490 Shadow Copy Deletion                — 5s latency
  [FAIL]  T1486 Data Encryption for Impact          — OPEN — requires endpoint telemetry
  [PASS]  T1070.001 Event Log Clearing              — 11s latency

POST-EXERCISE COVERAGE: 93% (14/15) — up from 73% at start
REMAINING GAP: T1486 requires EDR file monitoring enhancement