[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M73EWAP86VDD8GPBVJT7J2R6":3,"skill-same:01M73EWAP86VDD8GPBVJT7J2R6":97},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":16,"sourceHtmlUrl":17,"categories":18,"keywords":19,"publishedAt":20,"linkOnly":21,"markdownContent":22,"markdownBody":23,"frontMatter":24,"refName":57,"commitSha":58,"skillDirectory":59,"forksCount":60,"repositoryHtmlUrl":61,"repositoryHomepageUrl":62,"ownerHtmlUrl":63,"ownerBlogUrl":64,"ownerDescription":65,"updatedAt":66,"install":67,"resources":80},"01M73EWAP86VDD8GPBVJT7J2R6","performing-purple-team-exercise",null,"Performs purple team exercises by coordinating red team adversary emulation with blue team detection validation using MITRE ATT&CK-mapped attack scenarios, real-time detection testing, and collaborative gap remediation. Use when SOC teams need to validate detection capabilities, improve analyst skills, and close detection gaps through structured offensive-defensive collaboration.","Horonomos-laps\u002FYana-AI","Horonomos-laps","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F355299122?v=4","01M76B3QPXE88ET2SQPDPVATZT"," Horonomos-laps","01M72ZQRJPCYPSSWT4D00VJR2A",13,"Apache-2.0","https:\u002F\u002Fgithub.com\u002Fyanacuti1121\u002FYana-AI\u002Fblob\u002Fmain\u002Fcore\u002Fskills\u002Fperforming-purple-team-exercise\u002FLICENSE","https:\u002F\u002Fgithub.com\u002FHoronomos-laps\u002FYana-AI\u002Fblob\u002Fmain\u002Fcore\u002Fskills\u002Fperforming-purple-team-exercise\u002FSKILL.md",[],[],"2026-11-11 15:11:14",false,"---\nname: performing-purple-team-exercise\ndescription: 'Performs purple team exercises by coordinating red team adversary emulation\n  with blue team detection validation using MITRE ATT&CK-mapped attack scenarios,\n  real-time detection testing, and collaborative gap remediation. Use when SOC teams\n  need to validate detection capabilities, improve analyst skills, and close detection\n  gaps through structured offensive-defensive collaboration.\n\n  '\ndomain: cybersecurity\nsubdomain: soc-operations\ntags:\n- soc\n- purple-team\n- red-team\n- blue-team\n- mitre-attack\n- adversary-emulation\n- detection-validation\nversion: '1.0'\nauthor: mahipal\nlicense: Apache-2.0\nd3fend_techniques:\n- File Metadata Consistency Validation\n- Application Protocol Command Analysis\n- Identifier Analysis\n- Content Format Conversion\n- Message Analysis\nnist_csf:\n- DE.CM-01\n- DE.AE-02\n- RS.MA-01\n- DE.AE-06\nmitre_attack:\n- T1078\n- T1685.002\n- T1685.005\n- T1566\nsource: https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\nsource_commit: 04450304b12645cb2b974ab96d28c0664758a88d\nnote: \"Vendored verbatim from an external Apache-2.0 security-skill library, pinned by commit. Exceeds the internal 300-line skill guideline (agent-code-constraints.md) -- kept as-is because this is vendored reference material (forensics\u002Fthreat-intel procedure), not Yana AI-authored content, and trimming would damage technical accuracy.\"\n---\n# Performing Purple Team Exercise\n\n## When to Use\n\nUse this skill when:\n- SOC teams need to validate that detection rules actually fire for the threats they target\n- Red team assessments produced findings that need translation into detection improvements\n- New detection tools or SIEM migrations require validation of detection coverage\n- Analyst training requires hands-on experience with real attack techniques and SIEM responses\n- Quarterly or semi-annual detection validation cycles are scheduled\n\n**Do not use** for unannounced red team engagements — purple team exercises require explicit coordination between offensive and defensive teams with real-time collaboration.\n\n## Prerequisites\n\n- Red team capability: internal team or contracted purple team operator\n- Attack simulation tools: Atomic Red Team, MITRE Caldera, or C2 framework (authorized)\n- SIEM access for real-time alert monitoring during exercise\n- ATT&CK-mapped detection rule inventory with expected alert names\n- Isolated test environment or approved production scope with change management approval\n- Communication channel (Slack\u002FTeams) for real-time red-blue coordination\n\n## Workflow\n\n### Step 1: Define Exercise Scope and Objectives\n\nDocument exercise parameters:\n\n```yaml\npurple_team_exercise:\n  exercise_id: PT-2024-Q1\n  date: 2024-03-20\n  duration: 8 hours (09:00-17:00 UTC)\n  scope:\n    environment: Production (Finance VLAN, 10.0.5.0\u002F24)\n    systems_in_scope:\n      - WORKSTATION-TEST01 (10.0.5.100) — Test endpoint\n      - DC-TEST (10.0.5.200) — Test domain controller\n      - FILESERVER-TEST (10.0.5.201) — Test file server\n    systems_excluded:\n      - All production domain controllers\n      - Customer-facing systems\n  objectives:\n    - Validate 15 detection rules mapped to FIN7 TTPs\n    - Test SOC analyst response to real attack indicators\n    - Identify detection gaps for credential access and lateral movement\n    - Measure detection latency for each technique\n  threat_scenario: FIN7 campaign targeting financial data via spearphishing\n  authorization: Approved by CISO, Change Request CR-2024-0567\n  communication: #purple-team-2024q1 Slack channel\n```\n\n### Step 2: Build ATT&CK-Mapped Test Plan\n\nCreate technique-by-technique test matrix:\n\n| # | ATT&CK ID | Technique | Test Tool | Expected Detection | Blue Team Metric |\n|---|-----------|-----------|-----------|-------------------|------------------|\n| 1 | T1566.001 | Spearphishing Attachment | Manual email | Email gateway alert | Detection Y\u002FN, latency |\n| 2 | T1204.002 | User Execution | Macro document | Sysmon process creation | Detection Y\u002FN, latency |\n| 3 | T1059.001 | PowerShell | Atomic RT #1-3 | PowerShell execution alert | Detection Y\u002FN, latency |\n| 4 | T1053.005 | Scheduled Task | Atomic RT | Scheduled task creation alert | Detection Y\u002FN, latency |\n| 5 | T1547.001 | Registry Run Keys | Atomic RT | Registry modification alert | Detection Y\u002FN, latency |\n| 6 | T1003.001 | LSASS Memory | Mimikatz | Credential dumping alert | Detection Y\u002FN, latency |\n| 7 | T1550.002 | Pass-the-Hash | Mimikatz | NTLM anomaly detection | Detection Y\u002FN, latency |\n| 8 | T1021.002 | SMB\u002FPsExec | PsExec | PsExec service creation alert | Detection Y\u002FN, latency |\n| 9 | T1047 | WMI | wmic \u002Fnode | WMI remote execution alert | Detection Y\u002FN, latency |\n| 10| T1021.001 | RDP | xfreerdp | RDP lateral movement alert | Detection Y\u002FN, latency |\n| 11| T1071.001 | Web C2 | Cobalt Strike | C2 beacon detection | Detection Y\u002FN, latency |\n| 12| T1041 | Exfiltration C2 | Rclone | Data exfiltration alert | Detection Y\u002FN, latency |\n| 13| T1490 | Inhibit Recovery | vssadmin | Shadow copy deletion alert | Detection Y\u002FN, latency |\n| 14| T1486 | Data Encrypted | Test encryption | Mass encryption detection | Detection Y\u002FN, latency |\n| 15| T1070.001 | Clear Logs | wevtutil | Log clearing detection | Detection Y\u002FN, latency |\n\n### Step 3: Execute Red Team Techniques\n\nRun each technique with Atomic Red Team (or manual execution):\n\n```powershell\n# Install Atomic Red Team\nIEX (IWR 'https:\u002F\u002Fraw.githubusercontent.com\u002Fredcanaryco\u002Finvoke-atomicredteam\u002Fmaster\u002Finstall-atomicredteam.ps1' -UseBasicParsing)\nInstall-AtomicRedTeam -getAtomics\n\n# Test 1: T1059.001 — PowerShell Execution\nWrite-Host \"[$(Get-Date -Format 'HH:mm:ss')] Executing T1059.001 - PowerShell\"\nInvoke-AtomicTest T1059.001 -TestNumbers 1\n# Notify blue team: \"T1059.001 executed at $(Get-Date)\"\n\n# Test 2: T1053.005 — Scheduled Task Creation\nWrite-Host \"[$(Get-Date -Format 'HH:mm:ss')] Executing T1053.005 - Scheduled Task\"\nInvoke-AtomicTest T1053.005 -TestNumbers 1\n\n# Test 3: T1547.001 — Registry Run Key\nWrite-Host \"[$(Get-Date -Format 'HH:mm:ss')] Executing T1547.001 - Registry Persistence\"\nInvoke-AtomicTest T1547.001 -TestNumbers 1,2\n\n# Test 4: T1003.001 — Credential Dumping\nWrite-Host \"[$(Get-Date -Format 'HH:mm:ss')] Executing T1003.001 - LSASS Access\"\nInvoke-AtomicTest T1003.001 -TestNumbers 1,2\n\n# Test 5: T1490 — Shadow Copy Deletion\nWrite-Host \"[$(Get-Date -Format 'HH:mm:ss')] Executing T1490 - Inhibit Recovery\"\nInvoke-AtomicTest T1490 -TestNumbers 1\n\n# Cleanup after each test\nInvoke-AtomicTest T1059.001 -TestNumbers 1 -Cleanup\nInvoke-AtomicTest T1053.005 -TestNumbers 1 -Cleanup\nInvoke-AtomicTest T1547.001 -TestNumbers 1,2 -Cleanup\n```\n\n### Step 4: Monitor Blue Team Detection in Real-Time\n\nBlue team monitors SIEM during execution:\n\n```spl\n--- Real-time purple team monitoring dashboard\nindex=notable earliest=-1h\n| where Computer IN (\"WORKSTATION-TEST01\", \"DC-TEST\", \"FILESERVER-TEST\")\n  OR src IN (\"10.0.5.100\", \"10.0.5.200\", \"10.0.5.201\")\n| eval detection_latency = _time - orig_time\n| eval latency_seconds = round(detection_latency, 0)\n| sort _time\n| table _time, rule_name, urgency, src, dest, user, latency_seconds\n\n--- Check specific technique detection\nindex=sysmon Computer=\"WORKSTATION-TEST01\" earliest=-15m\n(EventCode=1 OR EventCode=3 OR EventCode=10 OR EventCode=11 OR EventCode=13)\n| sort _time\n| table _time, EventCode, Image, CommandLine, TargetFilename, TargetObject\n```\n\nRecord results in real-time:\n\n```python\nexercise_results = {\n    \"exercise_id\": \"PT-2024-Q1\",\n    \"results\": [\n        {\n            \"technique\": \"T1059.001\",\n            \"name\": \"PowerShell Execution\",\n            \"execution_time\": \"09:15:00\",\n            \"detected\": True,\n            \"alert_name\": \"Suspicious PowerShell Encoded Command\",\n            \"detection_time\": \"09:15:47\",\n            \"latency_seconds\": 47,\n            \"notes\": \"Detected via Sysmon EventCode 1 with encoded command pattern\"\n        },\n        {\n            \"technique\": \"T1003.001\",\n            \"name\": \"LSASS Memory Access\",\n            \"execution_time\": \"10:30:00\",\n            \"detected\": False,\n            \"alert_name\": None,\n            \"detection_time\": None,\n            \"latency_seconds\": None,\n            \"notes\": \"GAP: No detection rule for LSASS access. Sysmon EventCode 10 present but no correlation rule.\"\n        }\n    ]\n}\n```\n\n### Step 5: Collaborative Gap Remediation\n\nFor each gap, the blue team builds detection rules immediately:\n\n```spl\n--- Gap: T1003.001 — No LSASS access detection\n--- Build rule during exercise\nindex=sysmon EventCode=10 TargetImage=\"*\\\\lsass.exe\"\nGrantedAccess IN (\"0x1010\", \"0x1038\", \"0x1fffff\", \"0x40\")\nNOT SourceImage IN (\"*\\\\svchost.exe\", \"*\\\\csrss.exe\", \"*\\\\MsMpEng.exe\")\n| stats count by Computer, SourceImage, SourceUser, GrantedAccess\n| where count > 0\n```\n\nAfter building, re-test:\n```\nRed Team: \"Re-executing T1003.001 at 11:45\"\nBlue Team: \"Confirmed — alert 'LSASS Memory Access Detected' fired at 11:45:32 (32s latency)\"\nResult: GAP CLOSED\n```\n\n### Step 6: Generate Exercise Report\n\n```python\ndef generate_purple_team_report(results):\n    total = len(results[\"results\"])\n    detected = sum(1 for r in results[\"results\"] if r[\"detected\"])\n    gaps = sum(1 for r in results[\"results\"] if not r[\"detected\"])\n    avg_latency = sum(r[\"latency_seconds\"] for r in results[\"results\"]\n                      if r[\"latency_seconds\"]) \u002F max(detected, 1)\n\n    report = f\"\"\"\nPURPLE TEAM EXERCISE REPORT — {results['exercise_id']}\n{'=' * 60}\n\nSUMMARY:\n  Techniques Tested:     {total}\n  Detected:              {detected} ({detected\u002Ftotal*100:.0f}%)\n  Gaps Identified:       {gaps} ({gaps\u002Ftotal*100:.0f}%)\n  Avg Detection Latency: {avg_latency:.0f} seconds\n\nDETAILED RESULTS:\n\"\"\"\n    for r in results[\"results\"]:\n        status = \"DETECTED\" if r[\"detected\"] else \"GAP\"\n        latency = f\"{r['latency_seconds']}s\" if r[\"latency_seconds\"] else \"N\u002FA\"\n        report += f\"  [{status}] {r['technique']} — {r['name']} (Latency: {latency})\\n\"\n        if not r[\"detected\"]:\n            report += f\"          Action: {r['notes']}\\n\"\n\n    return report\n```\n\n## Key Concepts\n\n| Term | Definition |\n|------|-----------|\n| **Purple Team** | Collaborative exercise where red (offensive) and blue (defensive) teams work together to validate and improve detection |\n| **Adversary Emulation** | Structured simulation of specific threat actor TTPs for testing defensive capabilities |\n| **Detection Validation** | Process of confirming that detection rules fire correctly when the targeted technique is executed |\n| **Detection Latency** | Time between technique execution and SIEM alert generation — measured during purple team exercises |\n| **Gap Remediation** | Immediate creation or tuning of detection rules for techniques that were not detected during testing |\n| **Atomic Red Team** | Open-source library of small, focused tests for individual ATT&CK techniques |\n\n## Tools & Systems\n\n- **Atomic Red Team**: Open-source attack test library from Red Canary for technique-by-technique validation\n- **MITRE Caldera**: Automated adversary emulation platform supporting ATT&CK-mapped attack chains\n- **Vectr**: Purple team management platform for tracking exercise results and detection coverage improvements\n- **Prelude Operator**: Adversary emulation tool supporting automated multi-step attack scenarios\n- **AttackIQ**: Breach and Attack Simulation (BAS) platform for continuous detection validation\n\n## Common Scenarios\n\n- **Quarterly Validation**: Test top 20 detection rules against ATT&CK techniques to ensure continued effectiveness\n- **New Tool Validation**: After deploying new EDR, validate detection coverage against baseline techniques\n- **Analyst Training**: Junior analysts observe real attacks in real-time with expert guidance on SIEM investigation\n- **Post-Incident Validation**: After a real incident, emulate the attack chain to verify detection improvements\n- **Compliance Evidence**: Document detection validation results for SOC 2, ISO 27001, or PCI DSS audits\n\n## Output Format\n\n```\nPURPLE TEAM EXERCISE REPORT — PT-2024-Q1\n━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━\nDate:         2024-03-20 (09:00-17:00 UTC)\nScenario:     FIN7 Financial Sector Campaign\nScope:        Finance VLAN (10.0.5.0\u002F24)\n\nRESULTS:\n  Techniques Tested:     15\n  Detected:              11 (73%)\n  Gaps Identified:       4 (27%)\n  Gaps Remediated Same Day: 3\n  Avg Detection Latency: 38 seconds\n\nDETAILED RESULTS:\n  [PASS]  T1566.001 Spearphishing Attachment      — 12s latency\n  [PASS]  T1204.002 User Execution (Macro)         — 8s latency\n  [PASS]  T1059.001 PowerShell Execution            — 47s latency\n  [PASS]  T1053.005 Scheduled Task                  — 23s latency\n  [PASS]  T1547.001 Registry Run Keys               — 31s latency\n  [FAIL]  T1003.001 LSASS Memory Access             — REMEDIATED during exercise\n  [FAIL]  T1550.002 Pass-the-Hash                   — REMEDIATED during exercise\n  [PASS]  T1021.002 PsExec                          — 15s latency\n  [PASS]  T1047 WMI Remote Execution                — 42s latency\n  [PASS]  T1021.001 RDP Lateral Movement            — 28s latency\n  [FAIL]  T1071.001 Web C2 Beaconing                — REMEDIATED during exercise\n  [PASS]  T1041 Exfiltration over C2                — 67s latency\n  [PASS]  T1490 Shadow Copy Deletion                — 5s latency\n  [FAIL]  T1486 Data Encryption for Impact          — OPEN — requires endpoint telemetry\n  [PASS]  T1070.001 Event Log Clearing              — 11s latency\n\nPOST-EXERCISE COVERAGE: 93% (14\u002F15) — up from 73% at start\nREMAINING GAP: T1486 requires EDR file monitoring enhancement\n```\n","# Performing Purple Team Exercise\n\n## When to Use\n\nUse this skill when:\n- SOC teams need to validate that detection rules actually fire for the threats they target\n- Red team assessments produced findings that need translation into detection improvements\n- New detection tools or SIEM migrations require validation of detection coverage\n- Analyst training requires hands-on experience with real attack techniques and SIEM responses\n- Quarterly or semi-annual detection validation cycles are scheduled\n\n**Do not use** for unannounced red team engagements — purple team exercises require explicit coordination between offensive and defensive teams with real-time collaboration.\n\n## Prerequisites\n\n- Red team capability: internal team or contracted purple team operator\n- Attack simulation tools: Atomic Red Team, MITRE Caldera, or C2 framework (authorized)\n- SIEM access for real-time alert monitoring during exercise\n- ATT&CK-mapped detection rule inventory with expected alert names\n- Isolated test environment or approved production scope with change management approval\n- Communication channel (Slack\u002FTeams) for real-time red-blue coordination\n\n## Workflow\n\n### Step 1: Define Exercise Scope and Objectives\n\nDocument exercise parameters:\n\n```yaml\npurple_team_exercise:\n  exercise_id: PT-2024-Q1\n  date: 2024-03-20\n  duration: 8 hours (09:00-17:00 UTC)\n  scope:\n    environment: Production (Finance VLAN, 10.0.5.0\u002F24)\n    systems_in_scope:\n      - WORKSTATION-TEST01 (10.0.5.100) — Test endpoint\n      - DC-TEST (10.0.5.200) — Test domain controller\n      - FILESERVER-TEST (10.0.5.201) — Test file server\n    systems_excluded:\n      - All production domain controllers\n      - Customer-facing systems\n  objectives:\n    - Validate 15 detection rules mapped to FIN7 TTPs\n    - Test SOC analyst response to real attack indicators\n    - Identify detection gaps for credential access and lateral movement\n    - Measure detection latency for each technique\n  threat_scenario: FIN7 campaign targeting financial data via spearphishing\n  authorization: Approved by CISO, Change Request CR-2024-0567\n  communication: #purple-team-2024q1 Slack channel\n```\n\n### Step 2: Build ATT&CK-Mapped Test Plan\n\nCreate technique-by-technique test matrix:\n\n| # | ATT&CK ID | Technique | Test Tool | Expected Detection | Blue Team Metric |\n|---|-----------|-----------|-----------|-------------------|------------------|\n| 1 | T1566.001 | Spearphishing Attachment | Manual email | Email gateway alert | Detection Y\u002FN, latency |\n| 2 | T1204.002 | User Execution | Macro document | Sysmon process creation | Detection Y\u002FN, latency |\n| 3 | T1059.001 | PowerShell | Atomic RT #1-3 | PowerShell execution alert | Detection Y\u002FN, latency |\n| 4 | T1053.005 | Scheduled Task | Atomic RT | Scheduled task creation alert | Detection Y\u002FN, latency |\n| 5 | T1547.001 | Registry Run Keys | Atomic RT | Registry modification alert | Detection Y\u002FN, latency |\n| 6 | T1003.001 | LSASS Memory | Mimikatz | Credential dumping alert | Detection Y\u002FN, latency |\n| 7 | T1550.002 | Pass-the-Hash | Mimikatz | NTLM anomaly detection | Detection Y\u002FN, latency |\n| 8 | T1021.002 | SMB\u002FPsExec | PsExec | PsExec service creation alert | Detection Y\u002FN, latency |\n| 9 | T1047 | WMI | wmic \u002Fnode | WMI remote execution alert | Detection Y\u002FN, latency |\n| 10| T1021.001 | RDP | xfreerdp | RDP lateral movement alert | Detection Y\u002FN, latency |\n| 11| T1071.001 | Web C2 | Cobalt Strike | C2 beacon detection | Detection Y\u002FN, latency |\n| 12| T1041 | Exfiltration C2 | Rclone | Data exfiltration alert | Detection Y\u002FN, latency |\n| 13| T1490 | Inhibit Recovery | vssadmin | Shadow copy deletion alert | Detection Y\u002FN, latency |\n| 14| T1486 | Data Encrypted | Test encryption | Mass encryption detection | Detection Y\u002FN, latency |\n| 15| T1070.001 | Clear Logs | wevtutil | Log clearing detection | Detection Y\u002FN, latency |\n\n### Step 3: Execute Red Team Techniques\n\nRun each technique with Atomic Red Team (or manual execution):\n\n```powershell\n# Install Atomic Red Team\nIEX (IWR 'https:\u002F\u002Fraw.githubusercontent.com\u002Fredcanaryco\u002Finvoke-atomicredteam\u002Fmaster\u002Finstall-atomicredteam.ps1' -UseBasicParsing)\nInstall-AtomicRedTeam -getAtomics\n\n# Test 1: T1059.001 — PowerShell Execution\nWrite-Host \"[$(Get-Date -Format 'HH:mm:ss')] Executing T1059.001 - PowerShell\"\nInvoke-AtomicTest T1059.001 -TestNumbers 1\n# Notify blue team: \"T1059.001 executed at $(Get-Date)\"\n\n# Test 2: T1053.005 — Scheduled Task Creation\nWrite-Host \"[$(Get-Date -Format 'HH:mm:ss')] Executing T1053.005 - Scheduled Task\"\nInvoke-AtomicTest T1053.005 -TestNumbers 1\n\n# Test 3: T1547.001 — Registry Run Key\nWrite-Host \"[$(Get-Date -Format 'HH:mm:ss')] Executing T1547.001 - Registry Persistence\"\nInvoke-AtomicTest T1547.001 -TestNumbers 1,2\n\n# Test 4: T1003.001 — Credential Dumping\nWrite-Host \"[$(Get-Date -Format 'HH:mm:ss')] Executing T1003.001 - LSASS Access\"\nInvoke-AtomicTest T1003.001 -TestNumbers 1,2\n\n# Test 5: T1490 — Shadow Copy Deletion\nWrite-Host \"[$(Get-Date -Format 'HH:mm:ss')] Executing T1490 - Inhibit Recovery\"\nInvoke-AtomicTest T1490 -TestNumbers 1\n\n# Cleanup after each test\nInvoke-AtomicTest T1059.001 -TestNumbers 1 -Cleanup\nInvoke-AtomicTest T1053.005 -TestNumbers 1 -Cleanup\nInvoke-AtomicTest T1547.001 -TestNumbers 1,2 -Cleanup\n```\n\n### Step 4: Monitor Blue Team Detection in Real-Time\n\nBlue team monitors SIEM during execution:\n\n```spl\n--- Real-time purple team monitoring dashboard\nindex=notable earliest=-1h\n| where Computer IN (\"WORKSTATION-TEST01\", \"DC-TEST\", \"FILESERVER-TEST\")\n  OR src IN (\"10.0.5.100\", \"10.0.5.200\", \"10.0.5.201\")\n| eval detection_latency = _time - orig_time\n| eval latency_seconds = round(detection_latency, 0)\n| sort _time\n| table _time, rule_name, urgency, src, dest, user, latency_seconds\n\n--- Check specific technique detection\nindex=sysmon Computer=\"WORKSTATION-TEST01\" earliest=-15m\n(EventCode=1 OR EventCode=3 OR EventCode=10 OR EventCode=11 OR EventCode=13)\n| sort _time\n| table _time, EventCode, Image, CommandLine, TargetFilename, TargetObject\n```\n\nRecord results in real-time:\n\n```python\nexercise_results = {\n    \"exercise_id\": \"PT-2024-Q1\",\n    \"results\": [\n        {\n            \"technique\": \"T1059.001\",\n            \"name\": \"PowerShell Execution\",\n            \"execution_time\": \"09:15:00\",\n            \"detected\": True,\n            \"alert_name\": \"Suspicious PowerShell Encoded Command\",\n            \"detection_time\": \"09:15:47\",\n            \"latency_seconds\": 47,\n            \"notes\": \"Detected via Sysmon EventCode 1 with encoded command pattern\"\n        },\n        {\n            \"technique\": \"T1003.001\",\n            \"name\": \"LSASS Memory Access\",\n            \"execution_time\": \"10:30:00\",\n            \"detected\": False,\n            \"alert_name\": None,\n            \"detection_time\": None,\n            \"latency_seconds\": None,\n            \"notes\": \"GAP: No detection rule for LSASS access. Sysmon EventCode 10 present but no correlation rule.\"\n        }\n    ]\n}\n```\n\n### Step 5: Collaborative Gap Remediation\n\nFor each gap, the blue team builds detection rules immediately:\n\n```spl\n--- Gap: T1003.001 — No LSASS access detection\n--- Build rule during exercise\nindex=sysmon EventCode=10 TargetImage=\"*\\\\lsass.exe\"\nGrantedAccess IN (\"0x1010\", \"0x1038\", \"0x1fffff\", \"0x40\")\nNOT SourceImage IN (\"*\\\\svchost.exe\", \"*\\\\csrss.exe\", \"*\\\\MsMpEng.exe\")\n| stats count by Computer, SourceImage, SourceUser, GrantedAccess\n| where count > 0\n```\n\nAfter building, re-test:\n```\nRed Team: \"Re-executing T1003.001 at 11:45\"\nBlue Team: \"Confirmed — alert 'LSASS Memory Access Detected' fired at 11:45:32 (32s latency)\"\nResult: GAP CLOSED\n```\n\n### Step 6: Generate Exercise Report\n\n```python\ndef generate_purple_team_report(results):\n    total = len(results[\"results\"])\n    detected = sum(1 for r in results[\"results\"] if r[\"detected\"])\n    gaps = sum(1 for r in results[\"results\"] if not r[\"detected\"])\n    avg_latency = sum(r[\"latency_seconds\"] for r in results[\"results\"]\n                      if r[\"latency_seconds\"]) \u002F max(detected, 1)\n\n    report = f\"\"\"\nPURPLE TEAM EXERCISE REPORT — {results['exercise_id']}\n{'=' * 60}\n\nSUMMARY:\n  Techniques Tested:     {total}\n  Detected:              {detected} ({detected\u002Ftotal*100:.0f}%)\n  Gaps Identified:       {gaps} ({gaps\u002Ftotal*100:.0f}%)\n  Avg Detection Latency: {avg_latency:.0f} seconds\n\nDETAILED RESULTS:\n\"\"\"\n    for r in results[\"results\"]:\n        status = \"DETECTED\" if r[\"detected\"] else \"GAP\"\n        latency = f\"{r['latency_seconds']}s\" if r[\"latency_seconds\"] else \"N\u002FA\"\n        report += f\"  [{status}] {r['technique']} — {r['name']} (Latency: {latency})\\n\"\n        if not r[\"detected\"]:\n            report += f\"          Action: {r['notes']}\\n\"\n\n    return report\n```\n\n## Key Concepts\n\n| Term | Definition |\n|------|-----------|\n| **Purple Team** | Collaborative exercise where red (offensive) and blue (defensive) teams work together to validate and improve detection |\n| **Adversary Emulation** | Structured simulation of specific threat actor TTPs for testing defensive capabilities |\n| **Detection Validation** | Process of confirming that detection rules fire correctly when the targeted technique is executed |\n| **Detection Latency** | Time between technique execution and SIEM alert generation — measured during purple team exercises |\n| **Gap Remediation** | Immediate creation or tuning of detection rules for techniques that were not detected during testing |\n| **Atomic Red Team** | Open-source library of small, focused tests for individual ATT&CK techniques |\n\n## Tools & Systems\n\n- **Atomic Red Team**: Open-source attack test library from Red Canary for technique-by-technique validation\n- **MITRE Caldera**: Automated adversary emulation platform supporting ATT&CK-mapped attack chains\n- **Vectr**: Purple team management platform for tracking exercise results and detection coverage improvements\n- **Prelude Operator**: Adversary emulation tool supporting automated multi-step attack scenarios\n- **AttackIQ**: Breach and Attack Simulation (BAS) platform for continuous detection validation\n\n## Common Scenarios\n\n- **Quarterly Validation**: Test top 20 detection rules against ATT&CK techniques to ensure continued effectiveness\n- **New Tool Validation**: After deploying new EDR, validate detection coverage against baseline techniques\n- **Analyst Training**: Junior analysts observe real attacks in real-time with expert guidance on SIEM investigation\n- **Post-Incident Validation**: After a real incident, emulate the attack chain to verify detection improvements\n- **Compliance Evidence**: Document detection validation results for SOC 2, ISO 27001, or PCI DSS audits\n\n## Output Format\n\n```\nPURPLE TEAM EXERCISE REPORT — PT-2024-Q1\n━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━\nDate:         2024-03-20 (09:00-17:00 UTC)\nScenario:     FIN7 Financial Sector Campaign\nScope:        Finance VLAN (10.0.5.0\u002F24)\n\nRESULTS:\n  Techniques Tested:     15\n  Detected:              11 (73%)\n  Gaps Identified:       4 (27%)\n  Gaps Remediated Same Day: 3\n  Avg Detection Latency: 38 seconds\n\nDETAILED RESULTS:\n  [PASS]  T1566.001 Spearphishing Attachment      — 12s latency\n  [PASS]  T1204.002 User Execution (Macro)         — 8s latency\n  [PASS]  T1059.001 PowerShell Execution            — 47s latency\n  [PASS]  T1053.005 Scheduled Task                  — 23s latency\n  [PASS]  T1547.001 Registry Run Keys               — 31s latency\n  [FAIL]  T1003.001 LSASS Memory Access             — REMEDIATED during exercise\n  [FAIL]  T1550.002 Pass-the-Hash                   — REMEDIATED during exercise\n  [PASS]  T1021.002 PsExec                          — 15s latency\n  [PASS]  T1047 WMI Remote Execution                — 42s latency\n  [PASS]  T1021.001 RDP Lateral Movement            — 28s latency\n  [FAIL]  T1071.001 Web C2 Beaconing                — REMEDIATED during exercise\n  [PASS]  T1041 Exfiltration over C2                — 67s latency\n  [PASS]  T1490 Shadow Copy Deletion                — 5s latency\n  [FAIL]  T1486 Data Encryption for Impact          — OPEN — requires endpoint telemetry\n  [PASS]  T1070.001 Event Log Clearing              — 11s latency\n\nPOST-EXERCISE COVERAGE: 93% (14\u002F15) — up from 73% at start\nREMAINING GAP: T1486 requires EDR file monitoring enhancement\n```\n",{"name":5,"note":25,"tags":26,"author":34,"domain":35,"source":36,"license":15,"version":37,"nist_csf":38,"subdomain":43,"description":44,"mitre_attack":45,"source_commit":50,"d3fend_techniques":51},"Vendored verbatim from an external Apache-2.0 security-skill library, pinned by commit. Exceeds the internal 300-line skill guideline (agent-code-constraints.md) -- kept as-is because this is vendored reference material (forensics\u002Fthreat-intel procedure), not Yana AI-authored content, and trimming would damage technical accuracy.",[27,28,29,30,31,32,33],"soc","purple-team","red-team","blue-team","mitre-attack","adversary-emulation","detection-validation","mahipal","cybersecurity","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills","1.0",[39,40,41,42],"DE.CM-01","DE.AE-02","RS.MA-01","DE.AE-06","soc-operations","Performs purple team exercises by coordinating red team adversary emulation with blue team detection validation using MITRE ATT&CK-mapped attack scenarios, real-time detection testing, and collaborative gap remediation. Use when SOC teams need to validate detection capabilities, improve analyst skills, and close detection gaps through structured offensive-defensive collaboration.\n",[46,47,48,49],"T1078","T1685.002","T1685.005","T1566","04450304b12645cb2b974ab96d28c0664758a88d",[52,53,54,55,56],"File Metadata Consistency Validation","Application Protocol Command Analysis","Identifier Analysis","Content Format Conversion","Message Analysis","main","481dcd7dd2e288b9d627a2bd017db70e64e6c6fa","core\u002Fskills\u002Fperforming-purple-team-exercise",1,"https:\u002F\u002Fgithub.com\u002FHoronomos-laps\u002FYana-AI","https:\u002F\u002Fyana.vutam.link\u002F","https:\u002F\u002Fgithub.com\u002FHoronomos-laps","https:\u002F\u002Fyana.vutam.link","An open-source governed runtime & execution environment for multi-agent AI systems.","2026-11-11 23:56:26",{"source":8,"skillName":5,"commands":68,"prompt":78,"zipAvailable":79},[69,72,75],{"tool":70,"command":71},"npx","npx skills add Horonomos-laps\u002FYana-AI --skill performing-purple-team-exercise",{"tool":73,"command":74},"bunx","bunx skills add Horonomos-laps\u002FYana-AI --skill performing-purple-team-exercise",{"tool":76,"command":77},"pnpm","pnpm dlx skills add Horonomos-laps\u002FYana-AI --skill performing-purple-team-exercise","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002FHoronomos-laps\u002FYana-AI\u002Fblob\u002Fmain\u002Fcore\u002Fskills\u002Fperforming-purple-team-exercise\u002FSKILL.md",true,[81,85,91],{"path":82,"resourceType":82,"resourceTypeDesc":83,"sizeBytes":84,"sourceHtmlUrl":16},"LICENSE","许可证",11255,{"path":86,"resourceType":87,"resourceTypeDesc":88,"sizeBytes":89,"sourceHtmlUrl":90},"references\u002Fapi-reference.md","REFERENCE","参考文档",1681,"https:\u002F\u002Fgithub.com\u002Fyanacuti1121\u002FYana-AI\u002Fblob\u002Fmain\u002Fcore\u002Fskills\u002Fperforming-purple-team-exercise\u002Freferences\u002Fapi-reference.md",{"path":92,"resourceType":93,"resourceTypeDesc":94,"sizeBytes":95,"sourceHtmlUrl":96},"scripts\u002Fagent.py","SCRIPT","脚本",7878,"https:\u002F\u002Fgithub.com\u002Fyanacuti1121\u002FYana-AI\u002Fblob\u002Fmain\u002Fcore\u002Fskills\u002Fperforming-purple-team-exercise\u002Fscripts\u002Fagent.py",[98,106,113,121,129,137],{"skillNo":99,"name":100,"nameZh":6,"description":101,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":102,"licenseFileUrl":6,"sourceHtmlUrl":103,"categories":104,"keywords":105,"publishedAt":20},"01M735GKET5YVYKAY62W2P5YXB","openai--sentry--sentry","Use when the user asks to inspect Sentry issues or events, summarize recent production errors, or pull basic Sentry health data via the Sentry API; perform read-only queries with the bundled script and require `SENTRY_AUTH_TOKEN`.","MIT","https:\u002F\u002Fgithub.com\u002FHoronomos-laps\u002FYana-AI\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fopenai--sentry--sentry\u002FSKILL.md",[],[],{"skillNo":107,"name":108,"nameZh":6,"description":109,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":110,"categories":111,"keywords":112,"publishedAt":20},"01M73DCAP83T17HY7SMGK7MGFE","ito-basket-compare","Compare Itô prediction-market baskets against a user's knowledge base, portfolio notes, financial context, watchlist, or research thesis. Use for read-only basket comparison and gap analysis without investment advice or live trading.","https:\u002F\u002Fgithub.com\u002FHoronomos-laps\u002FYana-AI\u002Fblob\u002Fmain\u002Fcore\u002Fskills\u002Fito-basket-compare\u002FSKILL.md",[],[],{"skillNo":114,"name":115,"nameZh":6,"description":116,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":117,"sourceHtmlUrl":118,"categories":119,"keywords":120,"publishedAt":20},"01M734CYEMZFDR3KH6SW0JP8TD","implementing-network-traffic-baselining","Build network traffic baselines from NetFlow\u002FIPFIX data using Python pandas for statistical analysis, z-score anomaly detection, and hourly\u002Fdaily traffic pattern profiling","https:\u002F\u002Fgithub.com\u002Fyanacuti1121\u002FYana-AI\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fimplementing-network-traffic-baselining\u002FLICENSE","https:\u002F\u002Fgithub.com\u002FHoronomos-laps\u002FYana-AI\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fimplementing-network-traffic-baselining\u002FSKILL.md",[],[],{"skillNo":122,"name":123,"nameZh":6,"description":124,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":125,"sourceHtmlUrl":126,"categories":127,"keywords":128,"publishedAt":20},"01M73ASZ6NJRJM44Z2P84NGQ3Q","detecting-evasion-techniques-in-endpoint-logs","Detects defense evasion techniques used by adversaries in endpoint logs including log tampering, timestomping, process injection, and security tool disabling. Use when investigating suspicious endpoint behavior, building detection rules for evasion tactics, or conducting threat hunting for stealthy adversary activity. Activates for requests involving evasion detection, defense evasion analysis, log tampering detection, or MITRE ATT&CK TA0005.","https:\u002F\u002Fgithub.com\u002Fyanacuti1121\u002FYana-AI\u002Fblob\u002Fmain\u002Fcore\u002Fskills\u002Fdetecting-evasion-techniques-in-endpoint-logs\u002FLICENSE","https:\u002F\u002Fgithub.com\u002FHoronomos-laps\u002FYana-AI\u002Fblob\u002Fmain\u002Fcore\u002Fskills\u002Fdetecting-evasion-techniques-in-endpoint-logs\u002FSKILL.md",[],[],{"skillNo":130,"name":131,"nameZh":6,"description":132,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":133,"sourceHtmlUrl":134,"categories":135,"keywords":136,"publishedAt":20},"01M734AFNXD06Z78QRK0VKGT7Q","implementing-microsegmentation-with-guardicore","Implementing microsegmentation using Akamai Guardicore Segmentation to map application dependencies, create granular network policies, visualize east-west traffic flows, and enforce least-privilege communication between workloads across data centers and cloud.","https:\u002F\u002Fgithub.com\u002Fyanacuti1121\u002FYana-AI\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fimplementing-microsegmentation-with-guardicore\u002FLICENSE","https:\u002F\u002Fgithub.com\u002FHoronomos-laps\u002FYana-AI\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fimplementing-microsegmentation-with-guardicore\u002FSKILL.md",[],[],{"skillNo":138,"name":139,"nameZh":6,"description":6,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":140,"categories":141,"keywords":142,"publishedAt":20},"01M736TK27QMCXK0DVCH25SJN5","ramdisk-tmpfs-patterns","https:\u002F\u002Fgithub.com\u002FHoronomos-laps\u002FYana-AI\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Framdisk-tmpfs-patterns\u002FSKILL.md",[],[]]