Running Your First Purple Team Exercise

What Makes Purple Team Different

Traditional pentests work in isolation, attackers find weaknesses, write a report, hand it off. Purple teaming brings offensive and defensive teams together in real-time. The goal isn't just to find gaps; it's to close them during the engagement.

A purple team exercise typically runs for 1-3 days. Attackers execute techniques while defenders watch, detect (or don't), and immediately tune their defences. By the end, you've not only identified gaps but fixed many of them.

Planning the Exercise

1. Select Threat Intelligence

Start with relevant threats. Who targets your industry? What techniques do they use? MITRE ATT&CK maps threat groups to TTPs.

2. Design Attack Chains

Individual techniques matter less than realistic chains. Attackers don't run one technique in isolation, they chain multiple stages together.

• Chain 1: Phishing → Macro execution → PowerShell download → Persistence via scheduled task
• Chain 2: Valid credentials → RDP → Kerberoasting → Domain admin
• Chain 3: Domain admin → DCSync → Golden ticket → Data exfiltration

3. Prepare Detection Baseline

Before the exercise, document what you expect to detect. This becomes your scorecard.

• Which data sources are required?
• What detection rules exist?
• What's the expected alert or indicator?

Running the Exercise

Everyone sits together: attackers and defenders in the same room. The attacker announces they're about to execute a technique, runs it, then pauses. Did the SOC see it? Did an alert fire? If not, why not?

Document Everything

Tune in Real-Time

When detection fails, fix it immediately if possible. Missing a log source? Enable it. Rule threshold too high? Lower it. Detection logic wrong? Update it. Then re-run the technique to verify the fix works.

The Debrief

The debrief is as important as the exercise itself. Structure it around key metrics:

• Detection Coverage: What percentage of techniques were detected? Which attack stages had gaps?
• Time to Detect: Detection that takes 4 hours isn't useful if attackers achieve objectives in 2 hours.
• False Positive Rate: Did the exercise trigger alerts on legitimate activity? Tune rules that generate noise.
• Actionable Improvements: Prioritised list with owners and deadlines. What can be fixed this week? This month?

Common Mistakes

• Too many techniques: Quality over quantity. Better to deeply test 15 techniques than superficially touch 50.
• No baseline: Without knowing what you expect to detect, you can't measure success.
• Skipping the debrief: The exercise identifies gaps; the debrief ensures they get fixed.
• One and done: Purple teaming should be regular. Quarterly exercises show improvement over time.

Purple Team Engagements

We facilitate purple team exercises that improve your detection capability measurably. Our team brings the attack expertise; your team learns to detect and respond.