Purple Team Exercises

Runs red and blue side by side, technique by technique, so every gap turns into a shipped detection the same week.

What I deliver

⟩ real-world projects

Sanitized highlights from real client work — approach, the bug we found, and the fix shipped. Names redacted under NDA.

Quarterly purple team program for a MENA bank — ATT&CK technique coverage went from 34% to 71% in two cycles

Post-incident purple exercise replaying the exact ransomware TTPs — closed 6 detection gaps within a week

Cross-team purple sprint for a SaaS scale-up — every red finding shipped as a Sigma rule before the retro

⟩ common vulnerabilities & how I find them

The recurring weaknesses I see in this domain, with the repeatable workflow I run from discovery to fix.

High

STEP 1Pick a specific ATT&CK sub-technique and execute it live, one at a time
STEP 2Blue narrates what alerted — and what didn't — in real time, no gatekeeping on red's exact commands
STEP 3Log every miss as a ticket with an owner and a due date the same session
STEP 4Fix: ship the new Sigma rule / log source / tuning change before the next round begins

Medium

STEP 1Re-run Atomic Red Team against existing 'covered' techniques on a schedule
STEP 2Flag detections that silently broke after a SIEM migration, parser change or agent update
STEP 3Re-tune or retire rules with 0% true-positive rate over the validation window
STEP 4Fix: treat detections as code — version, test and review them the same way

Medium

STEP 1Track SIEM migrations, agent upgrades and parser changes as events that can silently break rules
STEP 2Re-run the relevant Atomic Red Team tests immediately after any infrastructure change
STEP 3Diff detection fire-rate before/after the change to catch silent breakage fast
STEP 4Fix: gate infrastructure changes on a smoke-test suite of critical detections

⟩ arsenal