Offensive security · Cybersecurity
Red Team and Purple Team
Full adversarial assessment and collaborative work with your defensive team, mapped to MITRE ATT&CK, to strengthen the defences where they actually give way.
- Framework
- MITRE ATT&CK
- Duration
- 4 to 8 weeks
- Red Team
- Stealth exercise, no notice to the internal team
- Purple Team
- Collaborative exercise, attacker and defender together
The problem
The Red Team attacks without warning and measures real detection. The Purple Team does the same, but with the defensive team watching the screen: each technique is executed, you observe whether it raises an alert and the rule is tuned on the spot. One measures, the other teaches.
What it includes
Reconnaissance
Information is gathered about the target environment to identify assets, relationships and exploitable vulnerabilities.
Planning
Specific strategies and tactics are developed to achieve the objectives defined in the target environment.
Vulnerability analysis
Weaknesses in systems and applications that can be exploited to achieve those objectives are identified.
Exploitation
Techniques and tactics are actively applied to take advantage of the vulnerabilities identified during planning.
Post-exploitation
The aim is to maintain access and widen control over the compromised environment after the initial intrusion.
Exfiltration
Data is transferred from the compromised environment to controlled locations, to demonstrate the real impact of the breach.
Purple session
Run jointly with your defence team: each technique is launched, checked for whether it raised an alert, and the detection is tuned on the spot.
How we work
- 01DefinitionObjectives, limits, critical assets and rules of engagement.
- 02Red executionStealth operation mapped to MITRE ATT&CK.
- 03Purple sessionRepetition of the techniques alongside the defence team, tuning detections.
- 04ClosingReport, detection metrics and improvement plan.
Deliverables
| Document | Length |
|---|---|
| Operation report Full attack chain, mapped to ATT&CK. | included |
| Detection matrix Which techniques were detected and which were not. | included |
| Proposed rules New detections for your tooling. | included |
Scope of responsibility: in black box exercises it may not be possible to test every MITRE ATT&CK technique. If a device cannot be compromised, the client decides whether to provide additional access so the technique can still be evaluated. And if the objective is exfiltration, some techniques may not be necessary.