Adversary Emulation & Detection Engineering: The Purple Team Index

Purpose: A master reference index covering Purple Team operations: The collaborative integration of Red (Offensive) and Blue (Defensive) teams. Details adversary emulation, threat-informed detection engineering (SIGMA, YARA-L), MITRE ATT&CK coverage mapping, continuous security validation, and telemetry pipeline optimization.

1. Purple Team Operational Methodology

Collaborative Feedback Loops — Joint offensive execution and defensive observation in real-time to replace traditional isolated penetration test reports.
The Purple Team Exercise Lifecycle — 1. Threat Intelligence Scoping → 2. Pre-Exercise Telemetry Audit → 3. Collaborative Attack Execution → 4. Detection Logic Tuning → 5. Post-Exercise Remediation Validation.
Exercise Formats — Micro-drills (single TTP focused), Atomic exercises, and Scenario-based adversary emulation campaigns.

2. Threat-Informed Detection Engineering

SIGMA Rule Authoring — Writing vendor-agnostic detection rules mapped to system event logs (Process Creation, File Modifications, Registry Edits).
YARA & YARA-L Rule Development — Crafting binary pattern-matching rules and SIEM correlation rules for threat detection.
Log & Query Logic Engineering — Authoring KQL (Microsoft Sentinel), SPL (Splunk), and EQL (Elastic) detection queries tailored to adversary TTPs.
False Positive Reduction & Suppression — Tuning detection logic to filter benign administrative activity while preserving high-fidelity alert alerts.

3. MITRE ATT&CK Mapping & Coverage Heatmaps

ATT&CK Navigator Integration — Mapping organizational detection coverage against the MITRE ATT&CK Enterprise matrix.
Telemetry Gaps vs. Detection Gaps — Distinguishing between missing log data (telemetry gap) vs. unmonitored log data (detection gap).
Attacker TTP Prioritization — Prioritizing detection rule creation based on relevant threat actor profiles and industry-specific CTI.

4. Automated Adversary Emulation & Breach Simulation

Atomic Red Team — Executing small, targeted open-source tests mapped directly to individual MITRE ATT&CK techniques.
Caldera & SCYTHE Frameworks — Deploying automated adversary emulation platforms to execute complex multi-stage attack chains.
Breach and Attack Simulation (BAS) — Continuous automated testing of security controls against synthetic attacks.

5. EDR & Telemetry Pipeline Optimization

Sysmon Configuration & Tuning — Maintaining optimized Sysmon configurations (e.g., SwiftOnSecurity / Olaf Hartong baselines) to capture process GUIDs, pipe creation, and raw disk access.
Linux Auditd & eBPF Telemetry — Tuning auditd rules and leveraging eBPF probes for kernel-level execution tracking.
Log Pipeline Optimization — Filtering noise at ingestion nodes (Logstash, Vector, Cribl) to maximize SIEM efficiency and reduce storage costs.

6. Continuous Security Validation & Regression Testing

CI/CD Detection Testing — Testing detection rules in automated pipelines before deploying them to production SIEM/EDR instances.
Automated Attack Replay — Replaying captured attack telemetry to verify that updated detection rules trigger correctly without regression.
Detection Drift Prevention — Auditing rules periodically to ensure environment changes have not broken existing alerts.