<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: performing-purple-team-assessment
description: >-
  Collaborative offense-defense engagement where red and blue teams work together to test, tune, and validate detection capabilities against specific ATT&CK techniques. Produces detection coverage maps and gap analysis.
domain: cybersecurity
subdomain: security-testing
tags:
  - purple-team
  - detection-engineering
  - mitre-attack
  - sigma
  - coverage-map
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["T1059", "T1078", "T1021", "T1053", "T1003", "T1048"]
  tools: ["atomic-red-team", "caldera", "vectr", "sigma", "elastic-siem", "splunk"]
---

# Performing Purple Team Assessment

## Overview

Purple team assessments combine red team attack execution with blue team detection validation in a collaborative feedback loop. Each technique is executed, detection is evaluated, gaps are identified, and rules are tuned in real-time.

## Prerequisites

| Tool / Requirement | Details |
|---|---|
| `atomic-red-team` | Security tooling |
| `caldera` | Security tooling |
| `vectr` | Security tooling |
| `sigma` | Security tooling |
| `elastic-siem` | Security tooling |
| `splunk` | Security tooling |
| Written authorization and rules of engagement | Environment requirement |
| Defined scope with in-scope targets and exclusions | Environment requirement |

## Workflow

### Step 1: Coverage Mapping

```bash
# ATT&CK coverage assessment
cat <<'EOF'
DETECTION COVERAGE MATRIX
===========================
Technique          | Log Source       | Rule Exists | Validated | Gap
T1059.001 PowerShell | Win PowerShell   | Yes         | No        | —
T1078 Valid Accounts | Win Security     | Yes         | No        | —
T1021.002 SMB       | Win Security     | No          | N/A       | RULE NEEDED
T1053.005 Sched Task| Win Security     | Yes         | No        | —
T1003.001 LSASS     | Sysmon          | Yes         | No        | —
T1048 Exfil over C2 | Network/Proxy    | No          | N/A       | VISIBILITY GAP
T1087.002 Domain Acct| Win Security    | No          | N/A       | RULE NEEDED
T1547.001 Registry  | Sysmon          | Yes         | No        | —
EOF
```

### Step 2: Technique Execution

```bash
# Execute techniques with Atomic Red Team
# T1059.001 — PowerShell
Invoke-AtomicTest T1059.001 -TestNumbers 1,2,3

# T1003.001 — LSASS Memory
Invoke-AtomicTest T1003.001 -TestNumbers 1

# T1053.005 — Scheduled Task
Invoke-AtomicTest T1053.005 -TestNumbers 1,2

# T1547.001 — Registry Run Keys
Invoke-AtomicTest T1547.001 -TestNumbers 1

# CALDERA automated execution
# Deploy agent → Create operation → Select abilities → Execute
# curl -X POST caldera/api/v2/operations -d '{"name":"purple_test"}'

# After each technique: validate detection, document result
```

### Step 3: Detection Validation

```bash
# Check SIEM for detection after each technique

# Splunk query for PowerShell execution
# index=windows sourcetype=WinEventLog:Microsoft-Windows-PowerShell/Operational
# EventCode=4104 | stats count by ScriptBlockText

# Elastic query for LSASS access
# process.name:"lsass.exe" AND event.action:"access"

# Sigma rule for scheduled task creation
cat <<'SIGMA'
title: Suspicious Scheduled Task Creation
id: a1b2c3d4-e5f6-7890-abcd-ef1234567890
status: experimental
description: Detects scheduled task creation via command line
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    CommandLine|contains:
      - 'schtasks /create'
      - 'Register-ScheduledTask'
  condition: selection
falsepositives:
  - Administrative task scheduling
  - Software deployment tools
level: medium
tags:
  - attack.persistence
  - attack.t1053.005
SIGMA
```

### Step 4: Gap Remediation

```bash
# Update coverage after validation
cat <<'EOF'
UPDATED COVERAGE MATRIX
=========================
Technique          | Detected | Alert Fired | Tuning Needed | Status
T1059.001 PowerShell | Yes      | Yes         | FP reduction  | VALIDATED
T1078 Valid Accounts | Yes      | No          | Threshold adj | TUNING
T1021.002 SMB       | No       | No          | New rule req  | GAP
T1053.005 Sched Task| Yes      | Yes         | None          | VALIDATED
T1003.001 LSASS     | Yes      | Yes         | None          | VALIDATED
T1048 Exfil over C2 | No       | No          | NDR needed    | VISIBILITY GAP
T1087.002 Domain Acct| No      | No          | New rule req  | GAP

ACTIONS REQUIRED:
1. Create Sigma rule for SMB lateral movement (T1021.002)
2. Adjust threshold for valid accounts detection (T1078)
3. Deploy NDR solution for exfiltration detection (T1048)
4. Create rule for domain account enumeration (T1087.002)
EOF
```

## Detection

```yaml
title: Purple Team Assessment Detection
id: abd719e4-382a-410d-aa98-a89a6c07eb9a
status: experimental
description: Detects suspicious activity related to performing purple team assessment techniques in security testing context
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    CommandLine: "*performing*purple*"
  condition: selection
level: medium
tags:
  - attack.t1059
  - attack.t1078
  - attack.t1021
  - attack.t1053
  - attack.t1003
  - attack.t1048
  - attack.discovery
falsepositives:
  - Authorized security testing tools during scheduled assessment windows
```


**Detection Opportunities**

| Indicator | Source | Detection Logic |
|---|---|---|
| Purple Team Assessment Detection | windows/process_creation | Sigma rule (medium) |
| ATT&CK Coverage | MITRE ATT&CK | T1059, T1078, T1021, T1053, T1003, T1048 |

## Verification

- [ ] Authorization documented and scope confirmed
- [ ] All planned test cases executed
- [ ] Evidence collected with timestamps and integrity hashes
- [ ] Findings documented with severity and remediation
- [ ] Report delivered to stakeholders

## References

- [MITRE ATT&CK Framework](https://attack.mitre.org/)
- [PTES — Penetration Testing Execution Standard](http://www.pentest-standard.org/)
- [NIST SP 800-115 — Technical Guide to Security Testing](https://csrc.nist.gov/publications/detail/sp/800-115/final)
