This is a follow-up to What Is Purple Teaming? A Practical Guide for Security Teams. Read that first if you want the why; this post is the how.
The first post made the case for running offense and defense together. This one gets concrete: which adversary techniques to emulate in a first engagement, what each one should generate in your telemetry, and the detection you validate against it.
Everything here is written for a defender building coverage. Techniques are described at the MITRE ATT&CK level and paired with the data source and detection logic that catch them, not as a how-to for the offensive side. The goal is a scorecard of what your tooling sees, technique by technique.
Choosing what to emulate
Don’t start from a tool’s full technique catalog. Start from the adversaries that actually target your sector and work backward to a short, ordered list.
- Pick a threat profile. Use CISA advisories, an ISAC feed, or the ATT&CK Groups pages for your industry. A ransomware affiliate and a state-aligned espionage actor exercise very different parts of your stack.
- Map to ATT&CK, across the kill chain. Choose techniques spanning several tactics (initial access through impact), not ten variations of one. Coverage gaps hide between tactics, not within them.
- Prefer procedures you can run safely. Every technique below has a benign emulation: a known test binary, a canary account, a non-destructive command. Atomic Red Team and the CALDERA framework package most of these so execution is consistent and logged.
- Write the expected signal before you run. For each technique, state the data source (EDR process events, Windows Security log, identity provider, DNS) and the field you expect to light up. If you can’t name the data source, that’s your first finding, logging comes before detection.
Keep the first run to 10–15 techniques. A tight set that each team understands end to end beats a sprint through a hundred you can’t act on.
A starter technique set
A cross-tactic set for a first engagement. Each row is a technique to emulate benignly, the telemetry it should produce, and the detection you confirm fires. ATT&CK IDs let you track coverage in your own matrix.
| Tactic | Technique (ATT&CK ID) | Safe emulation | Primary data source | Detection to validate |
|---|---|---|---|---|
| Execution | Command & scripting interpreter – PowerShell (T1059.001) | Run a benign script with Script Block Logging on | PowerShell operational log (4104), EDR | Alert on obfuscated / encoded blocks and suspicious cmdlets |
| Defense evasion | Impair defenses (T1562.001) | Toggle a test exclusion or stop a non-prod sensor | EDR config events, Security log (4719, 5001) | Alert on tampering with AV/EDR config or logging |
| Credential access | OS credential dumping – LSASS (T1003.001) | Open a handle to LSASS with a test tool in a lab VM | EDR process-access events, Sysmon (10) | Alert on non-system processes reading LSASS memory |
| Credential access | Kerberoasting (T1558.003) | Request service tickets for a canary SPN account | Security log (4769) | Flag high volumes of RC4 ticket requests per account |
| Discovery | Account & domain discovery (T1087, T1482) | Run standard enumeration from a managed workstation | EDR command line, Security log | Baseline recon tooling run from non-admin hosts |
| Lateral movement | Remote services – SMB / admin shares (T1021.002) | Authenticate to a canary host’s admin share | Security log (4624 type 3, 5140) | Detect lateral auth patterns and new admin-share access |
| Persistence | Scheduled task / service (T1053.005) | Create and remove a named benign task | Security log (4698), Sysmon (1) | Alert on task creation outside change windows |
| Command & control | Application-layer protocol / DNS (T1071.004) | Beacon to a controlled canary domain | DNS / proxy logs, EDR network events | Detect beaconing cadence and rare-domain lookups |
| Exfiltration | Exfil over C2 channel (T1041) | Transfer a tagged canary file to the test endpoint | Proxy / DLP, network flow | Alert on canary-file egress and anomalous upload volume |
Start with credential access and lateral movement if you only have time for two tactics, that pair is where real intrusions do the most damage and where detection gaps are most common.
From technique to detection
[Diagram in the live doc: technique-to-detection trace — Emulate → Telemetry → Detection → Outcome, worked through Kerberoasting (T1558.003).]
Each row of the table above is really this chain. The exercise walks it left to right and records where it breaks: a technique with no emulation, no telemetry, or no rule is a gap, and the gap’s position tells you whether to fix logging or write a detection.
Running it safely
The exercise only produces useful data if execution is controlled and logged on both sides.
- Isolate destructive techniques. Credential dumping, defense tampering, and anything touching LSASS run in a lab VM or a tightly scoped, snapshotted host, never a production domain controller.
- Use canaries, not real assets. A canary SPN, a canary domain, and tagged canary files give you clean signal without exposing anything real.
- Log both sides with synchronized clocks. The red operator records each technique, its ATT&CK ID, the host, and the exact timestamp. The blue team correlates against that ground truth. NTP drift is the quiet killer of a good exercise.
- Clean up as you go. Remove scheduled tasks, exclusions, and test accounts at the end of each technique so the next one starts from a known state.
- Capture the outcome per technique. Record one of: prevented, detected (telemetry present), alerted (rule fired), or missed. That four-way result is the whole point of the exercise.
Scoring coverage
Tally every technique into the four outcomes and you get a coverage scorecard against the threat profile you chose. The shape of that tally is the deliverable, not a narrative.
- Prevented – the control blocked it outright. Still confirm an alert fired; silent blocks hide repeat attempts.
- Alerted – telemetry present and a rule fired. This is the target state.
- Detected, not alerted – the data is in your SIEM but nothing flagged it. The highest-value fix: the signal exists, you just need the rule.
- Missed – no telemetry at all. A logging or sensor-coverage gap, address before writing detections.
A mature program tracks that scorecard over time and watches the “missed” and “detected, not alerted” columns shrink after each cycle. Re-run a technique the same day you tune it, a detection isn’t real until the technique runs again and the alert fires.
Where to go next
Run the set above once and you’ll have something most organizations never get: a technique-by-technique map of what your defenses actually see, tied to the adversaries you care about.
From there, widen the threat profile, add techniques a tier at a time, and keep the scorecard honest by re-testing after every tuning change.
For the bigger picture on how red and blue work the exercise together, see the intro: What Is Purple Teaming? A Practical Guide for Security Teams.
If you’d rather run a first engagement with a team that does this every week, get in touch – we’ll bring the emulation plan and work your detections alongside your analysts.