Purple Teaming

Attack and Defence, Working Together

Purple teaming bridges the gap between offensive testing and defensive operations. We work shoulder-to-shoulder with your Blue Team, running real attack simulations while your defenders learn to detect and respond in real time. The result: measurable improvement in your detection and response capabilities, mapped directly to MITRE ATT&CK.

Unlike a red team engagement where stealth is the priority, purple teaming is collaborative by design. We execute attack techniques openly, pause to assess detection coverage, tune rules together, and re-run attacks until your defences reliably catch them. Your Blue Team walks away with new detection rules, refined playbooks, and hands-on experience against real attack tradecraft.

How a Purple Team Engagement Works

• Threat Profile Selection: We start by identifying which threat actors are most relevant to your organisation – based on your industry, geography, and asset profile. We select specific MITRE ATT&CK techniques associated with those threat groups (e.g., APT29 for government/defence, FIN7 for financial services, Scattered Spider for SaaS/tech). This ensures every test is relevant to your actual threat landscape.

• Baseline Assessment: Before executing attacks, we review your current detection stack – SIEM (Splunk, Sentinel, Elastic), EDR (CrowdStrike, SentinelOne, Defender for Endpoint), NDR, and any custom detection rules. We identify existing coverage gaps against the selected ATT&CK techniques and prioritise the exercise accordingly.

• Execute & Assess Cycles: We run each technique step by step. Our Red Team executes the attack (e.g., Kerberoasting, DCSync, LSASS credential dumping) while your Blue Team monitors their tools in real time. After each technique, we pause to assess: Did your SIEM fire an alert? Did your EDR block or detect the activity? If not, we work together to build a detection rule on the spot.

• Detection Engineering: For every gap identified, we collaborate with your team to create or refine detection rules – Sigma rules for SIEM, KQL queries for Sentinel, SPL for Splunk, or EDR custom detection policies. We test each rule against the live attack to confirm it triggers reliably with minimal false positives.

• Coverage Scoring & Reporting: We deliver a detailed ATT&CK coverage heatmap showing which techniques you can detect, which you can prevent, and which remain blind spots. Each technique is scored: Prevented / Detected / Logged-but-not-alerted / Not Detected – giving your leadership a clear, visual measure of defensive maturity.

Techniques We Typically Cover

We select techniques from across the MITRE ATT&CK kill chain, tailored to your threat profile. Common areas include:

• Initial Access & Execution: Phishing payload delivery (macro documents, HTML smuggling, ISO/LNK chains), PowerShell and scripting engine abuse, WMI/DCOM remote execution, exploitation of public-facing applications.

• Credential Access: LSASS memory dumping (Mimikatz, nanodump, direct syscall variants), Kerberoasting, AS-REP roasting, NTLM relay and coercion (PetitPotam, PrinterBug), credential harvesting from browsers and password managers.

• Lateral Movement: Pass-the-Hash, Pass-the-Ticket, WinRM/PSRemoting, SMB lateral movement, RDP hijacking, DCOM-based movement, and remote service exploitation.

• Persistence: Scheduled tasks, registry run keys, WMI event subscriptions, DLL side-loading, service creation, Golden/Silver Ticket attacks, and ADCS certificate-based persistence.

• Defence Evasion: AMSI bypass, ETW patching, process injection (process hollowing, thread hijacking), timestomping, log evasion, and EDR unhooking via direct syscalls.

• Exfiltration & Impact: Data staging and compression, DNS/HTTPS exfiltration channels, cloud storage abuse, and ransomware simulation (file encryption simulation without actual damage).

What Your Blue Team Gains

• New Detection Rules: Production-ready Sigma, KQL, or SPL detection rules built and tested during the engagement – not theoretical recommendations, but rules validated against real attacks in your environment.

• Refined Alert Tuning: We help reduce alert fatigue by tuning existing rules to decrease false positives while increasing true positive detection rates.

• Incident Response Practice: Your SOC analysts gain hands-on experience triaging and responding to live attack techniques – far more effective than tabletop exercises alone.

• Threat Hunting Playbooks: We provide hunt hypotheses and queries your team can use for proactive threat hunting based on the techniques tested.

• ATT&CK Coverage Heatmap: A visual report showing your detection and prevention coverage across tested techniques – ideal for communicating defensive maturity to leadership and tracking improvement over time.

Example Outcomes From Recent Engagements

Representative outcomes from recent purple team exercises (anonymised):

• Kerberoasting Detection Gap Closed in 30 Minutes: The client’s SIEM had no rule for Kerberoasting despite using Active Directory extensively. We executed the technique live, showed the Blue Team the relevant Event ID 4769 patterns (RC4 encryption type requests), and built a Sigma rule together that was deployed to production within the session.

• EDR Bypass Identified and Remediated: During credential dumping tests, we demonstrated that the client’s EDR detected Mimikatz but missed a direct-syscall-based variant. We worked with the vendor’s support team during the engagement to create a custom detection policy, then re-ran the attack to confirm the fix.

• SIEM Coverage Increased from 23% to 68%: During an engagement testing 40 ATT&CK techniques, we identified that only 9 had functional SIEM detections. By the end of the exercise, the Blue Team had deployed 18 new detection rules and refined 7 existing ones – nearly tripling their ATT&CK coverage.

Why Choose FORTBRIDGE?

• Red Team Expertise: Our purple team exercises are led by the same consultants who conduct our red team engagements – OSCP, CRTO, and CRTL-certified operators with real-world experience in AV/EDR evasion, custom malware development, and Active Directory exploitation.

• Detection Engineering Skills: We don’t just break things – we know how to build detections. Our team has experience writing Sigma rules, KQL, SPL, and EDR custom policies across major SIEM and EDR platforms.

• Adapted to Your Maturity: Whether your Blue Team is newly formed or highly mature, we adjust the exercise complexity, technique selection, and knowledge-transfer approach to deliver maximum value at your current level.

• CREST & DESC Accredited: We hold respected industry accreditations, ensuring our services meet international standards for quality and effectiveness.

Turn Your Security Teams Into a Unified Force

With FORTBRIDGE’s Purple Teaming services, you gain more than just a test – you gain a partnership focused on continuous improvement and measurable defensive uplift.

Book a Discovery Call to discuss your requirements and get a scoping estimate.