Purple teaming and adversary emulation
Lesson 3 of 5
3Purple teaming and adversary emulation
The big picturePicture a defence team that has built five hundred detection rules and nobody has tried one against a real attack. Do they work? Nobody knows. Meanwhile a red team breaks into the company every year and hands over a report that is read and forgotten. The purple team breaks this: the attacker runs one technique, and the defender looks at their screen at once: did they see it? If not, they fix the rule now, and the attacker runs it again. In one day many techniques move from "we hope we would see it" to "we see it, and we have proof".
What the picture shows: The loop repeats for every technique: red runs it, blue checks, and together they fix the detection until it works, then move on to the next technique.
Map of this part
The concepts in order, click any one to jump to it:
Two ways into the same idea
Think of a civil defence drill. A pen test is an inspector walking the building writing: this door does not close, that extinguisher has expired. A red team is a surprise fire drill the guards do not know about: did they notice? Did they evacuate? A purple team is a joint drill: the trainer makes smoke in one room and stands with the guards: did the alarm ring? No? Let us fix the sensor now and try again.
Pen test: as many flaws as possible in a set scope and short time. Red team: a set goal (such as reaching the payments system) with stealth over a longer time, to test detection and response; the defenders usually do not know. Adversary emulation: imitating a specific group with the techniques documented in threat reports, ordered in an emulation plan (the CTID library publishes ready plans such as FIN6 and APT29). Purple team: red and blue together, openly; for each technique: run, check the log and alert, fix, rerun. Tools: Atomic Red Team (from Red Canary, small tests for each ATT&CK technique), MITRE Caldera (an automated emulation platform), and ATT&CK Navigator to draw coverage. Outcome per technique: blocked, alerted, logged only, or not seen. In finance: TIBER-EU in Europe and SAMA's ethical red teaming framework in Saudi Arabia set intelligence-led exercises overseen by the regulator.
Before You Start
🔎Detection engineering
You write and test Sigma rules.
🎯The pen testing method
Permission and rules of engagement.
The Core Idea
1Three kinds of "good attacker"
The names get mixed up in the job market, but the goal differs. Pick the kind by the question you want answered:
| Pen test | Red team | Purple team | |
|---|---|---|---|
| The question | What flaws exist? | Would we detect and stop a real attack? | How do we make detection work for each technique? |
| Do defenders know? | Usually yes | Usually not | Yes, they work together |
| Length | Days to weeks | Weeks to months | Focused, repeated days |
| Result | A list of flaws and fixes | The attack story and where detection failed | Proven detections and a coverage map |
2From intelligence to an emulation plan
Do not emulate "any attacker". Pick the adversaries who really target your sector and region (from threat reports and sector sharing centres), pull their techniques from ATT&CK, and order them the way they do it in reality. That is the emulation plan. Then run it safely in a permitted environment.
A purple day: four techniques from an emulation plan
The adversary is a financial crime group that starts with phishing, then harvests credentials, then moves, then encrypts. The exercise runs on test machines in production, with written permission.
The idea: every technique ends in one of four outcomes: blocked, alerted, logged only, or not seen. The goal is for every technique to move towards "alerted" or "blocked" by the end of the day.
1 · Initial run
Red runs a Base64-encoded PowerShell command as the adversary does after the attachment opens. Outcome: logged, but no alert. Fix: a Sigma rule for -EncodedCommand from an Office process.
2 · Rerun
Red reruns the same technique with a small variation. Outcome: alerted within a minute. The technique turns green and joins the automatic tests rerun every week.
3 · Credential theft
An attempt to read LSASS memory. Outcome: EDR blocked it and alerted. Excellent, but blue checks that the alert actually reached the on-call analyst and not an abandoned mailbox.
4 · Lateral movement
A connection to the ADMIN$ share on another server. Outcome: not seen, because server logon logs do not reach the SIEM. Fix: not a rule but a missing log source, logged as a task for the team.
5 · Encryption
Deleting shadow copies with vssadmin before encryption, as the adversary does. Outcome: alerted. In the report: two techniques fixed today, one needs a log source, one was already working.
3Measuring coverage
After every exercise, update the coverage map: for each technique in the adversary's plan, what is the best outcome reached? That number, not the rule count, is what you show management. Run the calculation:
"Logged only" is not success: the log exists but nobody looks at it. These techniques are next quarter's work.
SCORE = {"blocked": 3, "alerted": 2, "logged": 1, "none": 0}
results = { # technique -> outcome after this quarter's purple exercises
"T1566.001 Spearphishing attachment": "blocked",
"T1059.001 PowerShell": "alerted",
"T1003.001 LSASS memory": "blocked",
"T1021.002 SMB admin shares": "none",
"T1078 Valid accounts": "logged",
"T1486 Data encrypted for impact": "alerted",
"T1490 Inhibit system recovery": "alerted",
"T1567 Exfiltration to web service": "logged",
}
for tech, outcome in results.items():
print(f"{'#' * SCORE[outcome]:<4}{outcome:<8} {tech}")
detected = sum(1 for o in results.values() if SCORE[o] >= 2)
print(f"\ndetected or blocked: {detected}/{len(results)} = {detected / len(results):.0%}")
gaps = [t for t, o in results.items() if SCORE[o] < 2]
print("next quarter's work:", "; ".join(g.split(" ", 1)[1] for g in gaps))ATT&CK Navigator draws this table as a coloured map over the ATT&CK matrix, one of the clearest pictures you can show a board: where we see, where we are blind, and what we will fix.
Worked example
The task: a bank wants a red team exercise because the regulator asked for one, but its SOC is only six months old with few rules. How do you order things?
The answer: propose three steps. First (two months): monthly purple days on the adversaries targeting banks in the region, with an emulation plan from threat reports and the CTID library, until coverage of the most important techniques reaches an acceptable level. Second: automate Atomic Red Team tests for what was fixed so it does not slip back. Third: the intelligence-led red team exercise within the regulator's framework, with a clear goal such as reaching the transfer system, and a small white team that knows and manages the risk. That way the red team measures a real defence, and its result says something new.
Myth vs Reality
| Myth | Reality |
|---|---|
| Red and purple teams are just names for a pen test. | The goal differs: a test finds flaws, red measures detection and response, purple builds detection. |
| More detection rules means more security. | A rule never tested against a real attack may not work. Proven coverage is the measure. |
| If the red team was not detected, the whole defence failed. | The result is a map: where we saw and where we did not. That is what makes fixing possible. |
Where you meet it at work
🏦Finance
Intelligence-led red team exercises under regulatory oversight.
🛡️The SOC
Monthly purple days turn theoretical rules into proven detection.
📊The board
An ATT&CK coverage map explains the position in one picture.
Test your understanding
What is the main goal of a red team?
Red imitates a real attack with stealth to learn whether the defence sees and stops it.
What sets a purple team apart?
Openness allows fixing detection at once and trying again.
A technique's outcome is "logged only". What does that mean?
Nobody looks at the log in time, so the attacker gets through.
What is Atomic Red Team?
From Red Canary, used in purple exercises and automated detection testing.
How do you pick which adversaries to emulate?
Useful emulation imitates who is most likely to attack you.
Quick review cards
Check Your Understanding
Why not start with a red team if your detection is weak?
Because they will walk in and tell you what you already know; purple builds detection first.
What are the four possible outcomes for a technique in an exercise?
Blocked, alerted, logged only, or not seen.
What do you do with a technique whose detection you fixed in the exercise?
Add it to automatic tests rerun regularly so detection does not slip back.
Resources for this lesson
Grouped by type. Start with the official docs for precision, or an article or video for the explanation.
Tools2
Done with this lesson?
Sign in to save your progress.