A purple-team exercise: attack, detect, improve

#Brief

This project is for authorised, defensive learning only. Use the practice target provided, which is built to be tested, and never test systems you do not own or have written permission to test. A purple team runs attackers and defenders together to improve detection, on a lab you own. It is the most effective way to find and close detection gaps.

#What to build

1. Build a small lab you own (a few VMs and a SIEM) and choose a set of ATT&CK techniques relevant to it

2. Write a test plan: for each technique, the expected detection and the success criterion

3. Execute the techniques safely with a framework such as Atomic Red Team, recording what fired, what was missed and what was blocked

4. For each gap, write or tune a detection and add it to your tested detection library

5. Retest and produce a before-and-after coverage report, plus recommendations for the wider environment

#Deliverables

• Repository with plan.md, results/, detections/, tests/ and REPORT.md

#How it is graded

Reviewers pick one technique you closed and rerun it to confirm the detection now fires.

#Stretch

Automate the exercise so it can be rerun after major changes as a regression test for detections.