Performing Purple Team Exercise

---
name: performing-purple-team-exercise
description: Performs purple team exercises by coordinating red team adversary emulation with blue team Tespit validation using MITRE ATT&CK-mapped attack scenarios, real-time Tespit testing, and
  collaborative gap remediation. Use when SOC teams need to validate Tespit capabilities, improve analyst skills, and close Tespit gaps through structured offensive-defensive collaboration.
tags:
- soc-operations
- soc
- red-team
- Tespit-validation
- fetih
- mitre-attack
- adversary-emulation
- cybersecurity
- blue-team
- purple-team
- siber-güvenlik
triggers:
- alert
- email
- encryption
- endpoint
- exercise
- hash
- http
- incident
- log
- performing
- phishing
- purple
category: soc-operations
source_subdomain: soc-operations
nist_csf:
- DE.CM-01
- DE.AE-02
- RS.MA-01
- DE.AE-06
adapted_for: fetih
---

# Performing Purple Team Exercise


## Ne Zaman Kullanılır

Use bu skill when:
- SOC teams need to validate that Tespit rules actually fire for the threats they target
- Red team assessments produced Bul:ings that need translation into Tespit improvements
- New Tespit tools or SIEM migrations require validation of Tespit coverage
- Analyst training requires hands-on experience with real attack techniques and SIEM responses
- Quarterly or semi-annual Tespit validation cycles are scheduled

**Kullanma:** for unannounced red team engagements — purple team exercises require explicit coordination between offensive and defensive teams with real-time collaboration.

## Ön Gereksinimler

- Red team capability: internal team or contracted purple team operator
- Attack simulation tools: Atomic Red Team, MITRE Caldera, or C2 framework (authorized)
- SIEM access for real-time alert monitoring during exercise
- ATT&CK-mapped Tespit rule inventory with expected alert names
- Isolated test environment or approved production scope with change management approval
- Communication channel (Slack/Teams) for real-time red-blue coordination

## İş Akışı

### Adım 1: Define Exercise Scope and Objectives

Document exercise parameters:

```yaml
purple_team_exercise:
  exercise_id: PT-2024-Q1
  date: 2024-03-20
  duration: 8 hours (09:00-17:00 UTC)
  scope:
    environment: Production (Finance VLAN, 10.0.5.0/24)
    systems_in_scope:
      - WORKSTATION-TEST01 (10.0.5.100) — Test endpoint
      - DC-TEST (10.0.5.200) — Test domain controller
      - FILESERVER-TEST (10.0.5.201) — Test file server
    systems_excluded:
      - All production domain controllers
      - Customer-facing systems
  objectives:
    - Validate 15 Tespit rules mapped to FIN7 TTPs
    - Test SOC analyst response to real attack indicators
    - Identify Tespit gaps for credential access and lateral movement
    - Measure Tespit latency for each technique
  threat_scenario: FIN7 campaign targeting financial data via spearphishing
  authorization: Approved by CISO, Change Request CR-2024-0567
  communication: #purple-team-2024q1 Slack channel
```

### Adım 2: Build ATT&CK-Mapped Test Plan

Create technique-by-technique test matrix:

| # | ATT&CK ID | Technique | Test Tool | Expected Tespit | Blue Team Metric |
|---|-----------|-----------|-----------|-------------------|------------------|
| 1 | T1566.001 | Spearphishing Attachment | Manual email | Email gateway alert | Tespit Y/N, latency |
| 2 | T1204.002 | User Execution | Macro document | Sysmon process creation | Tespit Y/N, latency |
| 3 | T1059.001 | PowerShell | Atomic RT #1-3 | PowerShell execution alert | Tespit Y/N, latency |
| 4 | T1053.005 | Scheduled Task | Atomic RT | Scheduled task creation alert | Tespit Y/N, latency |
| 5 | T1547.001 | Registry Run Keys | Atomic RT | Registry modification alert | Tespit Y/N, latency |
| 6 | T1003.001 | LSASS Memory | Mimikatz | Credential dumping alert | Tespit Y/N, latency |
| 7 | T1550.002 | Pass-the-Hash | Mimikatz | NTLM anomaly Tespit | Tespit Y/N, latency |
| 8 | T1021.002 | SMB/PsExec | PsExec | PsExec service creation alert | Tespit Y/N, latency |
| 9 | T1047 | WMI | wmic /node | WMI remote execution alert | Tespit Y/N, latency |
| 10| T1021.001 | RDP | xfreerdp | RDP lateral movement alert | Tespit Y/N, latency |
| 11| T1071.001 | Web C2 | Cobalt Strike | C2 beacon Tespit | Tespit Y/N, latency |
| 12| T1041 | Exfiltration C2 | Rclone | Data exfiltration alert | Tespit Y/N, latency |
| 13| T1490 | Inhibit Recovery | vssadmin | Shadow copy deletion alert | Tespit Y/N, latency |
| 14| T1486 | Data Encrypted | Test encryption | Mass encryption Tespit | Tespit Y/N, latency |
| 15| T1070.001 | Clear Logs | wevtutil | Log clearing Tespit | Tespit Y/N, latency |

### Adım 3: Execute Red Team Techniques

Run each technique with Atomic Red Team (or manual execution):

```powershell
IEX (IWR 'https://raw.githubusercontent.com/redcanaryco/invoke-atomicredteam/master/install-atomicredteam.ps1' -UseBasicParsing)
Install-AtomicRedTeam -getAtomics

Write-Host "[$(Get-Date -Format 'HH:mm:ss')] Executing T1059.001 - PowerShell"
Invoke-AtomicTest T1059.001 -TestNumbers 1

Write-Host "[$(Get-Date -Format 'HH:mm:ss')] Executing T1053.005 - Scheduled Task"
Invoke-AtomicTest T1053.005 -TestNumbers 1

Write-Host "[$(Get-Date -Format 'HH:mm:ss')] Executing T1547.001 - Registry Persistence"
Invoke-AtomicTest T1547.001 -TestNumbers 1,2

Write-Host "[$(Get-Date -Format 'HH:mm:ss')] Executing T1003.001 - LSASS Access"
Invoke-AtomicTest T1003.001 -TestNumbers 1,2

Write-Host "[$(Get-Date -Format 'HH:mm:ss')] Executing T1490 - Inhibit Recovery"
Invoke-AtomicTest T1490 -TestNumbers 1

Invoke-AtomicTest T1059.001 -TestNumbers 1 -Cleanup
Invoke-AtomicTest T1053.005 -TestNumbers 1 -Cleanup
Invoke-AtomicTest T1547.001 -TestNumbers 1,2 -Cleanup
```

### Adım 4: Monitor Blue Team Tespit in Real-Time

Blue team monitors SIEM during execution:

```spl
--- Real-time purple team monitoring dashboard
index=notable earliest=-1h
| where Computer IN ("WORKSTATION-TEST01", "DC-TEST", "FILESERVER-TEST")
  OR src IN ("10.0.5.100", "10.0.5.200", "10.0.5.201")
| eval Tespit_latency = _time - orig_time
| eval latency_seconds = round(Tespit_latency, 0)
| sort _time
| table _time, rule_name, urgency, src, dest, user, latency_seconds

--- Check specific technique Tespit
index=sysmon Computer="WORKSTATION-TEST01" earliest=-15m
(EventCode=1 OR EventCode=3 OR EventCode=10 OR EventCode=11 OR EventCode=13)
| sort _time
| table _time, EventCode, Image, CommandLine, TargetFilename, TargetObject
```

Record results in real-time:

```python
exercise_results = {
    "exercise_id": "PT-2024-Q1",
    "results": [
        {
            "technique": "T1059.001",
            "name": "PowerShell Execution",
            "execution_time": "09:15:00",
            "Detected": True,
            "alert_name": "Suspicious PowerShell Encoded Command",
            "Tespit_time": "09:15:47",
            "latency_seconds": 47,
            "notes": "Detected via Sysmon EventCode 1 with encoded command pattern"
        },
        {
            "technique": "T1003.001",
            "name": "LSASS Memory Access",
            "execution_time": "10:30:00",
            "Detected": False,
            "alert_name": None,
            "Tespit_time": None,
            "latency_seconds": None,
            "notes": "GAP: No Tespit rule for LSASS access. Sysmon EventCode 10 present but no correlation rule."
        }
    ]
}
```

### Adım 5: Collaborative Gap Remediation

For each gap, the blue team builds Tespit rules immediately:

```spl
--- Gap: T1003.001 — No LSASS access Tespit
--- Build rule during exercise
index=sysmon EventCode=10 TargetImage="*\\lsass.exe"
GrantedAccess IN ("0x1010", "0x1038", "0x1fffff", "0x40")
NOT SourceImage IN ("*\\svchost.exe", "*\\csrss.exe", "*\\MsMpEng.exe")
| stats count by Computer, SourceImage, SourceUser, GrantedAccess
| where count > 0
```

After building, re-test:
```
Red Team: "Re-executing T1003.001 at 11:45"
Blue Team: "Confirmed — alert 'LSASS Memory Access Detected' fired at 11:45:32 (32s latency)"
Result: GAP CLOSED
```

### Adım 6: Generate Exercise Report

```python
def generate_purple_team_report(results):
    total = len(results["results"])
    Detected = sum(1 for r in results["results"] if r["Detected"])
    gaps = sum(1 for r in results["results"] if not r["Detected"])
    avg_latency = sum(r["latency_seconds"] for r in results["results"]
                      if r["latency_seconds"]) / max(Detected, 1)

    report = f"""
PURPLE TEAM EXERCISE REPORT — {results['exercise_id']}
{'=' * 60}

SUMMARY:
  Techniques Tested:     {total}
  Detected:              {Detected} ({Detected/total*100:.0f}%)
  Gaps Identified:       {gaps} ({gaps/total*100:.0f}%)
  Avg Tespit Latency: {avg_latency:.0f} seconds

DETAILED RESULTS:
"""
    for r in results["results"]:
        status = "tespit etme (ED)" if r["Detected"] else "GAP"
        latency = f"{r['latency_seconds']}s" if r["latency_seconds"] else "N/A"
        report += f"  [{status}] {r['technique']} — {r['name']} (Latency: {latency})\n"
        if not r["Detected"]:
            report += f"          Action: {r['notes']}\n"

    return report
```

## Key Concepts

| Term | Definition |
|------|-----------|
| **Purple Team** | Collaborative exercise where red (offensive) and blue (defensive) teams work together to validate and improve Tespit |
| **Adversary Emulation** | Structured simulation of specific threat actor TTPs for testing defensive capabilities |
| **Tespit Validation** | Process of confirming that Tespit rules fire correctly when the targeted technique is executed |
| **Tespit Latency** | Time between technique execution and SIEM alert generation — measured during purple team exercises |
| **Gap Remediation** | Immediate creation or tuning of Tespit rules for techniques that were not Detected during testing |
| **Atomic Red Team** | Open-source library of small, focused tests for individual ATT&CK techniques |

## Tools & Systems

- **Atomic Red Team**: Open-source attack test library from Red Canary for technique-by-technique validation
- **MITRE Caldera**: Automated adversary emulation platform supporting ATT&CK-mapped attack chains
- **Vectr**: Purple team management platform for tracking exercise results and Tespit coverage improvements
- **Prelude Operator**: Adversary emulation tool supporting automated multi-step attack scenarios
- **AttackIQ**: Breach and Attack Simulation (BAS) platform for continuous Tespit validation

## Common Scenarios

- **Quarterly Validation**: Test top 20 Tespit rules against ATT&CK techniques to ensure continued effectiveness
- **New Tool Validation**: After Dağıt:ing new EDR, validate Tespit coverage against baseline techniques
- **Analyst Training**: Junior analysts observe real attacks in real-time with expert guidance on SIEM investigation
- **Post-Incident Validation**: After a real incident, emulate the attack chain to verify Tespit improvements
- **Compliance Evidence**: Document Tespit validation results for SOC 2, ISO 27001, or PCI DSS audits

## Output Format

```
PURPLE TEAM EXERCISE REPORT — PT-2024-Q1
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
Date:         2024-03-20 (09:00-17:00 UTC)
Scenario:     FIN7 Financial Sector Campaign
Scope:        Finance VLAN (10.0.5.0/24)

RESULTS:
  Techniques Tested:     15
  Detected:              11 (73%)
  Gaps Identified:       4 (27%)
  Gaps Remediated Same Day: 3
  Avg Tespit Latency: 38 seconds

DETAILED RESULTS:
  [PASS]  T1566.001 Spearphishing Attachment      — 12s latency
  [PASS]  T1204.002 User Execution (Macro)         — 8s latency
  [PASS]  T1059.001 PowerShell Execution            — 47s latency
  [PASS]  T1053.005 Scheduled Task                  — 23s latency
  [PASS]  T1547.001 Registry Run Keys               — 31s latency
  [FAIL]  T1003.001 LSASS Memory Access             — REMEDIATED during exercise
  [FAIL]  T1550.002 Pass-the-Hash                   — REMEDIATED during exercise
  [PASS]  T1021.002 PsExec                          — 15s latency
  [PASS]  T1047 WMI Remote Execution                — 42s latency
  [PASS]  T1021.001 RDP Lateral Movement            — 28s latency
  [FAIL]  T1071.001 Web C2 Beaconing                — REMEDIATED during exercise
  [PASS]  T1041 Exfiltration over C2                — 67s latency
  [PASS]  T1490 Shadow Copy Deletion                — 5s latency
  [FAIL]  T1486 Data Encryption for Impact          — OPEN — requires endpoint telemetry
  [PASS]  T1070.001 Event Log Clearing              — 11s latency

POST-EXERCISE COVERAGE: 93% (14/15) — up from 73% at start
REMAINING GAP: T1486 requires EDR file monitoring enhancement
```

<!--
  ⚔ Bu skill FETIH AI Agent icin gelistirilmistir — https://github.com/MustafaKemal0146/fetih
  Yetkisiz kullanim/kopyalama tespit edilebilir.
  hash: 1db95df7cc1e5d22
-->