Purple Teaming

Collaboration

Purple teaming is a collaborative cybersecurity exercise where red and blue teams work together to improve detection and response capabilities. Unlike traditional red team engagements where the blue team is unaware, purple teams share knowledge in real-time to maximize learning.

Authorized environments only

Every technique on this page — LSASS memory access included — is executed under the same written authorization as any other red team action, and in a lab or explicitly scoped environment. Purple teaming removes the surprise, not the permission: agree the technique list, the target hosts, and the stop authority in advance, and never run credential dumping against production accounts or production endpoints.

Purple Team Philosophy

Purple teaming is not a separate team—it's a mindset and methodology. The "purple" represents the blending of red (offensive) and blue (defensive) to create a unified security improvement process.

Goal: Maximize organizational learning by removing adversarial dynamics and focusing on measurable security improvements.

Purple Team vs Red Team

Aspect	Red Team	Purple Team
Blue Team Awareness	Unaware (blind test)	Fully aware (collaborative)
Communication	Post-engagement debrief	Real-time collaboration
Objective	Test detection capabilities	Improve detection capabilities
Duration	Weeks to months	Hours to days (per technique)
Outcome	Report of findings	Validated detection rules

Purple Team Exercise Workflow

Phase 1: Technique Selection

Red and blue teams jointly select an ATT&CK technique to test (e.g., T1003.001 - LSASS Memory Dump).

Phase 2: Red Team Execution

Red team executes the technique in a controlled environment while blue team monitors detection tools.

That environment has to be yours and disposable — the Purple Team Lab setup wraps the AD lab in a Wazuh or Elastic stack with Sysmon coverage, which is the environment these exercises assume.

Phase 3: Detection Analysis

Blue team analyzes logs, alerts, and telemetry. Did the SIEM trigger? Did EDR catch it? What was missed?

Phase 4: Improvement

Blue team creates new detection rules, tunes existing alerts, and adjusts EDR policies based on findings.

Phase 5: Validation

Red team re-executes the technique to confirm the new detection rule works. Iterate until detection is reliable.

Start with High-Impact Techniques

Focus on techniques your threat model indicates are most likely (e.g., if ransomware is a concern, test T1486 - Data Encrypted for Impact). Do not try to work through the whole ATT&CK matrix; pick the techniques your own CTI says are aimed at you.

Example: Detecting Mimikatz

Scenario

Red team will dump LSASS memory using Mimikatz (T1003.001) on a lab host with test credentials, under the authorization described at the top of this page. Blue team will attempt to detect it.

Iteration 1: Baseline

Red Action: Run mimikatz.exe "sekurlsa::logonpasswords"

Blue Result: EDR blocks execution (signature detection)

Finding: Known malware signatures work, but what about custom variants?

Iteration 2: Evasion

Red Action: Use Invoke-Mimikatz with obfuscation

Blue Result: No alert. SIEM shows PowerShell execution but no LSASS access logged.

Finding: Need behavioral detection for LSASS memory access, not just file signatures.

Iteration 3: Behavioral Detection

Blue Action: Enable Sysmon Event ID 10 (ProcessAccess) for LSASS.exe

Red Re-test: Run Invoke-Mimikatz again

Result: Alert triggered! SIEM shows "PowerShell.exe accessed LSASS.exe memory"

Outcome

Blue team successfully implemented behavioral detection for credential dumping. Detection rule validated and pushed to production.

Purple Team Metrics

Measure purple team effectiveness with these KPIs:

Detection Coverage: % of tested ATT&CK techniques with working detection rules
Mean Time to Detect (MTTD): How quickly alerts fire after technique execution
False Positive Rate: How often detection rules trigger on benign activity
Response Effectiveness: Can blue team contain the threat before objective is achieved?

Document Everything

Create a "Purple Team Playbook" documenting:

• Techniques tested
• Detection rules created
• Evasion variants attempted
• Remaining detection gaps

This becomes a living document showing security maturity over time.

Adversary Simulation

Choosing an adversary profile and mapping it to ATT&CK before the exercise begins.

Threat Intelligence Integration

The CTI that decides which techniques are worth a purple team iteration.

Threat Intelligence

Sector and actor reporting to prioritise the detection backlog against.

Purple Team Lab

The disposable AD lab with Sysmon, Wazuh, or Elastic coverage these exercises assume.