Purple Teaming & Detection Engineering

Purple Teaming & Detection Engineering — The Feedback Loop of Cyber Mastery

---

Purple Teaming is the fusion of Red Team attack simulation and Blue Team defense validation. It’s not about competition — it’s about collaboration. The mission: continuously test, measure, and strengthen an organization’s visibility, detections, and response capabilities.

Detection Engineering is the science of turning TTPs into telemetry — crafting queries, signatures, and alerts that detect malicious behavior while minimizing noise.

---

I. 🧩 Core Concepts

Concept	Description
Purple Team	Collaboration model where attackers and defenders work together.
Detection Engineering	Creating, validating, and maintaining threat detections.
Telemetry	Security-relevant data from logs, sensors, EDR, or network tools.
ATT&CK Alignment	Mapping adversary actions to MITRE ATT&CK techniques.
Detection Validation	Testing whether controls and alerts actually trigger.
Feedback Loop	Red → Detect → Tune → Re-test → Harden.

---

II. ⚙️ Purple Team Lifecycle

Phase	Goal	Example Output
Plan	Define scenarios & scope	“Simulate ransomware initial access”
Emulate	Execute red team attack	PowerShell payload, lateral move
Detect	Blue monitors telemetry	Sysmon, EDR, SIEM
Analyze	Compare logs vs actions	Identify gaps
Refine	Tune rules / add detections	Sigma, YARA, KQL
Validate	Re-run attack chain	Confirm alert triggers

---

III. ⚙️ Frameworks & Methodologies

Framework	Purpose
MITRE ATT&CK	Universal language for attacker behaviors
MITRE D3FEND	Defensive technique catalog (counter to ATT&CK)
NIST 800-61	Computer Security Incident Handling Guide
Purple Team Exercise Framework (PTEF)	Collaborative testing model
Atomic Red Team	Lightweight ATT&CK simulations for validation

---

IV. ⚙️ Planning the Exercise

🧠 1. Define the Threat Model

• What actor or campaign are we emulating?

  • e.g., APT29 (Russia) or FIN7 (Financial)

• What’s the goal?

  • Credential theft? Data exfiltration? PrivEsc?

⚙️ 2. Map to MITRE ATT&CK

Initial Access  → T1566 (Phishing)
Execution       → T1059 (Command Line)
Persistence     → T1053 (Scheduled Task)
Exfiltration    → T1048 (Network)

💣 3. Identify Detection Objectives

• Can we see the PowerShell execution?

• Is the beacon detected by EDR?

• Does lateral movement trigger logs?

---

V. ⚙️ Red + Blue Collaboration Workflow

Step	Red Team	Blue Team
1️⃣	Executes Atomic Test	Monitors telemetry
2️⃣	Documents artifacts	Captures events
3️⃣	Provides observables (hash, domain, PID)	Correlates with SIEM
4️⃣	Debriefs after each phase	Builds new detections
5️⃣	Validates rule effectiveness	Logs success/failure

---

VI. ⚙️ Detection Engineering Core Workflow

🧠 1. Understand the Behavior

Translate attacker TTP into observable system changes.

Example:

Technique: PowerShell Execution (T1059.001)
Behavior: Encoded command runs PowerShell script
Telemetry: Event ID 4104, CommandLine logs, Sysmon 1

⚙️ 2. Write the Detection Logic

Sigma Rule Example:

title: Encoded PowerShell Command
id: 8b7e-ps-enc
status: experimental
logsource:
  product: windows
  category: process_creation
detection:
  selection:
    CommandLine|contains: '-enc'
  condition: selection
level: high

KQL (Sentinel / Elastic)

process where command_line contains "-enc" or command_line contains "IEX("

💣 3. Test Detection

Run Atomic Red Team:

Invoke-AtomicTest T1059.001

→ Validate the alert.

---

VII. ⚙️ Data Sources for Detection

Source	Description	Example Events
Sysmon	Deep Windows process & network telemetry	Event IDs 1,3,7,11,13
EDR Telemetry	Behavior analytics & memory monitoring	Process lineage, injection
Windows Event Logs	Built-in OS logs	4624 (login), 4688 (process)
Zeek / Suricata	Network visibility	DNS, HTTP, TLS
Cloud Logs	Azure, AWS, GCP activity	CloudTrail, AzureActivity
Auditd / OSQuery	Linux telemetry	Execve, file access

---

VIII. ⚙️ Advanced Detection Patterns

Behavior	Indicators	Possible Rule Logic
Credential Dumping	LSASS memory access	process = “procdump.exe” AND target = “lsass.exe”
Lateral Movement	PsExec or WMI exec	ParentImage = “winlogon.exe” AND CommandLine contains “psexec”
Persistence via Registry	Autorun keys	RegistryKeyPath endswith “Run” AND contains “.exe”
Obfuscated Scripts	Encoded PowerShell	CommandLine contains “-enc”
C2 Communication	Repeated outbound traffic	dest_port = 443 AND interval ≈ 60s

---

IX. ⚙️ Detection Validation Tools

Tool	Purpose
Atomic Red Team	Execute atomic ATT&CK techniques
CALDERA	Automated red/blue testing platform
Prelude Operator	Continuous adversary emulation
DetectionLab / WazuhLab	Prebuilt lab for testing detections
Sigma + ElastAlert / Sentinel	Rule deployment & validation
Velociraptor	Endpoint artifact collection

---

X. ⚙️ Detection Pipeline Design

🧩 Architecture Overview

[Endpoints/Network/Cloud Logs]
         ↓
[Log Collectors (Winlogbeat, Sysmon)]
         ↓
[SIEM / ELK / Sentinel]
         ↓
[Detection Rules & Correlation]
         ↓
[Alerting & Case Management]
         ↓
[IR Workflow Automation (TheHive / SOAR)]

⚙️ Rule Maturity Levels

Level	Description
0	No detection
1	IOC-based
2	Behavior-based
3	Contextual (correlation)
4	ML / anomaly assisted

---

XI. ⚙️ Purple Team Playbook Examples

🧠 1. PowerShell Execution Hunt

Red:

powershell -nop -w hidden -enc <payload>

Blue: Detect -enc, FromBase64String, or IEX.

---

⚙️ 2. Credential Dumping Validation

Red:

procdump.exe -ma lsass.exe lsass.dmp

Blue: Alert on process access to lsass.exe.

---

💣 3. Scheduled Task Persistence

Red:

schtasks /create /sc minute /mo 30 /tn backdoor /tr "payload.exe"

Blue: Monitor Event ID 4698 (Task Creation).

---

⚙️ 4. C2 Communication Validation

Red: Deploy Sliver beacon with 60-sec interval. Blue: Detect repeated outbound HTTPs to rare domain every 60 seconds.

---

XII. ⚙️ Continuous Feedback Loop

1️⃣ Execute test (Atomic / manual). 2️⃣ Observe detection response. 3️⃣ Tune rule thresholds. 4️⃣ Re-run until consistent detection. 5️⃣ Document gap closure.

Each cycle refines the defensive posture and increases detection confidence.

---

XIII. ⚙️ Automation & Reporting

🧩 SOAR Integration

Platforms:

• TheHive + Cortex

• Shuffle

• Splunk Phantom Automate: alert triage → IOC enrichment → response action.

⚙️ Reporting Template

Field	Example
Exercise ID	PT-2025-002
ATT&CK Techniques	T1059.001, T1071.001
Detection Owner	Blue Team Lead
Gaps Identified	No alert on encoded PowerShell
Action Taken	Sigma rule created
Retest Result	Success
Confidence Level	High

---

XIV. ⚔️ Pro Tips & Engineering Practices

✅ Red Should Teach, Not Destroy — The goal is knowledge transfer, not chaos. ✅ Blue Should Document, Not Guess — Evidence-based improvements only. ✅ Log Everything — Especially failed detections. ✅ Version Control Rules — Track detection evolution (Git). ✅ Emulate, Don’t Simulate — Execute real commands in isolated labs. ✅ Tag Everything with MITRE IDs — Helps map coverage visually. ✅ Measure Mean Time to Detect (MTTD) — Quantify improvement. ✅ Create “Detection Scorecards” — Track coverage by technique.

---

XV. ⚙️ Quick Reference Table

Goal	Tool / Command	Description
Simulate Attack	Invoke-AtomicTest	Execute specific ATT&CK behavior
Write Detection	sigma-convert	Convert Sigma → KQL/Splunk
Validate Rule	CALDERA	Run technique & observe
Correlate Logs	ELK / Sentinel	Build detection dashboards
Automate Response	TheHive / SOAR	Trigger containment
Measure Coverage	ATT&CK Navigator	Visualize TTP gaps
Collect Endpoint Data	Velociraptor / Sysmon	Artifact gathering

---