From purple-teaming
Plan and execute purple team exercises for detection validation. Collaborative offensive/defensive testing using atomic or scenario-based methodologies. Triggers on "purple team", "detection validation", "atomic test", "adversary emulation", or requests for ATT&CK technique test cases, Splunk/Sigma queries, detection coverage gaps, or Kill Chain/Diamond Model/Pyramid of Pain analysis. Methodologies: ATOMIC (isolated techniques), SCENARIO (attack chains).
How this skill is triggered — by the user, by Claude, or both
Slash command
/purple-teaming:purple-teamingThe summary Claude sees in its skill listing — used to decide when to auto-load this skill
Plan, execute, and track collaborative offensive/defensive exercises that validate detection capabilities against adversary techniques.
Plan, execute, and track collaborative offensive/defensive exercises that validate detection capabilities against adversary techniques.
Organizations deploy detection rules and security controls but have no systematic way to validate whether those detections actually fire against real adversary techniques. Without collaborative offensive/defensive exercises, detection coverage gaps remain invisible until a real breach exposes them, and defenders cannot distinguish between "no attacks seen" and "attacks not detected."
Purple teaming sacrifices attack realism for faster feedback loops and broader technique coverage.
| Aspect | Red Team | Purple Team |
|---|---|---|
| Transparency | Covert | Full collaboration |
| Feedback loop | End of engagement | Real-time |
| Coverage | Narrow (attack path) | Broad (technique catalog) |
| Realism | Highest | Medium-High |
| Detection validation | Binary (caught/missed) | Granular (logged/alerted/blocked) |
Execute individual techniques in isolation, dechained from full attack sequences.
Best For: Detection benchmarking, environmental comparison, tooling evaluation, regression testing, automation pipelines
Limitations: Loses attack realism, threshold-based detections may not fire, doesn't test investigation processes
Execute end-to-end attack chains honoring chronological sequence.
Best For: Process/response testing, detection engineering, attack familiarization, SOC training
Limitations: Resource intensive, requires offensive expertise, harder to repeat consistently
| Item | Notes |
|---|---|
| Authorization documented | Rules of engagement signed |
| Infrastructure selected | Lab vs. production |
| Technique scope defined | ATT&CK IDs listed |
| Detection baseline captured | Current alert/log state |
| Communication channel established | Out-of-band coordination |
| Rollback procedures documented | How to undo changes |
exercise:
name: "Q1 2026 Detection Validation"
methodology: atomic
techniques:
- T1087.002 # Domain Account Discovery
- T1069.002 # Domain Groups
- T1018 # Remote System Discovery
- T1003.001 # LSASS Memory
- T1003.006 # DCSync
- T1021.002 # SMB/Admin Shares
test_case:
id: PT-2026-001
technique: T1087.002
name: Domain Account Discovery via net.exe
execution:
platform: windows
executor: command_prompt
command: |
net group "Domain Admins" /domain
expected_telemetry:
- source: Sysmon
event_id: 1
fields:
Image: "*\\net.exe"
CommandLine: "*group*/domain*"
expected_detection:
- name: "Domain Group Enumeration"
type: correlation
threshold: "3+ net group commands in 60 seconds"
outcome:
telemetry: [logged | not_logged]
alert: [fired | not_fired]
prevention: [blocked | not_blocked]
| Parent | Suspicious Child | Technique |
|---|---|---|
msbuild.exe | powershell.exe, cmd.exe | T1127.001 |
wmiprvse.exe | Any unexpected child | T1047 |
rundll32.exe | Network connection | C2 indicator |
excel.exe | powershell.exe | Macro execution |
index=sysmon EventCode=1
Image IN ("*\\net.exe", "*\\nltest.exe", "*\\dsquery.exe")
| bin _time span=60s
| stats count by _time, user, ComputerName
| where count > 5
| Source | Key Events | Covers |
|---|---|---|
| Windows Security | 4624, 4625, 4688, 4720, 4732 | Auth, process, account changes |
| PowerShell | 4104 (Script Block) | Encoded/obfuscated commands |
| Sysmon | 1, 3, 7, 8, 10, 11, 22 | Process, network, injection, files, DNS |
| Network (Zeek) | conn, dns, http, ssl | Lateral movement, C2, exfil |
| Outcome | Definition |
|---|---|
| Logged | Telemetry exists in SIEM |
| Alerted | Detection rule fired |
| Blocked | Prevention control stopped execution |
| Missed | No telemetry or detection |
techniques_detected / techniques_testedtrue_positives / total_alerts| Tool | Best For | Complexity |
|---|---|---|
| Atomic Red Team | Atomic tests, regression, automation | Low |
| MITRE Caldera | Autonomous operations, fact-based chains | Medium |
| Mythic | Full C2, realistic scenario ops | High |
# Install
IEX (IWR 'https://raw.githubusercontent.com/redcanaryco/invoke-atomicredteam/master/install-atomicredteam.ps1' -UseBasicParsing)
# Execute technique
Invoke-AtomicTest T1087.002 -TestNumbers 1,2,3
# Execute with logging (for VECTR)
Invoke-AtomicTest T1087.002 -LoggingModule "Attire-ExecutionLogger"
1. SCOPE → Define techniques, select methodology, document authorization
2. PREPARE → Capture baseline, prepare tools, establish comms
3. EXECUTE → Run techniques, blue team monitors, document outcomes
4. ANALYZE → Classify results, identify root cause for misses
5. IMPROVE → Build/tune detections, update telemetry collection
6. TRACK → Record in tracking system, update coverage metrics
| Pitfall | Solution |
|---|---|
| Testing only known-bad | Include suspected blind spots |
| Atomic tests without context | Run atomic first, then scenario for realism |
| No baseline comparison | Capture detection state before exercise |
| Skipping cleanup | Always run cleanup, validate no persistence |
| Production without safeguards | Lab first; if prod required: off-hours, rollback ready |
See resources/ directory:
frameworks.md - ATT&CK, Kill Chain, Diamond Model, Pyramid of Pain referencetest-cases/atomic-templates.md - Ready-to-use atomic test casesdetection-queries/queries.md - Splunk SPL and Sigma rulestracking-templates/templates.md - Exercise planning and tracking templatesProvides UI/UX resources: 50+ styles, color palettes, font pairings, guidelines, charts for web/mobile across React, Next.js, Vue, Svelte, Tailwind, React Native, Flutter. Aids planning, building, reviewing interfaces.
Fetches up-to-date documentation from Context7 for libraries and frameworks like React, Next.js, Prisma. Use for setup questions, API references, and code examples.
npx claudepluginhub dmaynor/dmaynor-skills-marketplace --plugin purple-teaming