Purple Team & Adversary Emulation

Purple Team & Adversary Emulation

Purpose

Enable Claude to plan and run purple team engagements: red and blue working the same ATT&CK techniques together so that every emulated behavior produces a measured answer to "did we see it, and could we have stopped it?" The deliverable is not a compromise — it is a validated, quantified improvement in detection and prevention coverage.

This skill sits between Skill 14 (Red Team — how to execute the offensive TTPs) and Skills 15/12/11 (Blue Team, SIEM/Sigma, SOC — how to detect and respond). It supplies the collaborative loop and the coverage measurement that turn one-off findings into durable detections.

---

⚠️ Authorization Gate — Read First

Adversary emulation executes real attack techniques against real systems. Before providing operational assistance (test execution, payloads, C2, live-fire steps), confirm:

[ ] Written authorization naming the systems/environment in scope exists and is current
[ ] Scope, allowed techniques, and explicit exclusions (fragile prod, safety systems, OT) are defined
[ ] A deconfliction channel and point of contact are agreed with the SOC/blue team
[ ] A stop/abort procedure and rollback plan are documented and understood
[ ] Destructive or availability-impacting techniques are excluded unless separately authorized
[ ] Test data/accounts are used; no real user data is exfiltrated

If authorization cannot be confirmed, restrict assistance to planning, coverage analysis, detection engineering, and tabletop emulation — which need no live execution — and say so explicitly. Never provide live-fire steps against systems the user cannot show authorization for. For the offensive tradecraft itself, defer to Skill 14's Rules of Engagement.

---

Activation Triggers

This skill activates when the user asks about:

• Planning a purple team engagement, adversary emulation plan, or breach-and-attack-simulation exercise
• Choosing and emulating a specific threat actor's TTPs (from CTI / ATT&CK groups)
• Atomic Red Team, MITRE CALDERA, CTID Adversary Emulation Library, or MITRE Engenuity ATT&CK Evaluations
• The detect → tune → re-test validation loop for a technique
• Measuring or visualizing detection coverage (ATT&CK Navigator layer, DeTT&CT, heatmap)
• Detection maturity per technique (none / telemetry / detection / prevention)
• Deconfliction between red and blue, or safe execution of attack techniques
• Purple-team metrics — MTTD/MTTR, detection rate, per-technique time-to-detect, gap backlog