purple-teaming

What problem does it solve?

This Skill helps security teams proactively test and improve their detection capabilities against real-world adversary techniques, ensuring their defenses are effective.

Core Features & Use Cases

• Plan and Execute Exercises: Design and run purple team exercises using atomic or scenario-based methodologies.
• Detection Validation: Test if security tools and processes correctly identify and alert on specific adversary actions.
• Coverage Analysis: Map existing detections against the MITRE ATT&CK framework and identify gaps.
• Use Case: A security team wants to ensure their SIEM can detect attempts to dump LSASS memory. They use this Skill to run an atomic test for T1003.001, observe the telemetry, and verify if their detection rule fires.

Quick Start

Use the purple-teaming skill to plan an exercise to test T1087.002 and T1003.001.