Purple Team Exercise Run-Book: Detection Capacity Development via Adversary Emulation
A purple team run-book guiding a CTI-driven adversary emulation exercise end-to-end; covers all phases from threat actor selection through TTP execution, detection measurement, and detection engineering feedback loop.
Prepare
10 steps- Define exercise trigger
Exercise is initiated when one of the following conditions is met: new threat intelligence, periodic program (at least two cycles per year), post-real-incident retest, or significant infrastructure change (new SIEM/EDR/log source).
- Select threat actor and prepare CTI summary
Actors matching the sector/geography/infrastructure profile are ranked from MITRE ATT&CK Groups, ISAC reports, CISA advisories, and commercial CTI sources; the selected actor's motivation, known campaigns, tools, and typical TTP sequence in the ATT&CK kill chain are documented.
- Prioritize TTP set
Covering all TTPs in a single exercise is practically infeasible; a priority order is established using a high impact × low current coverage score and mapped to ATT&CK IDs (T1059.001, T1003.001, T1021.002, etc.).
- Download CTID emulation plan (if available)
11 complete plans including APT29, FIN7, Sandworm, Wizard Spider, OilRig are available at `ctid.mitre.org/resources/adversary-emulation-library`; for the APT3 plan, use `attack.mitre.org/docs/APT3_Adversary_Emulation_Plan.pdf`.
- Create emulation plan document
For each TTP, document the red team procedure (tool/command), blue team expectation (log source, expected signal), and prevention control (EDR rule, AppLocker, WDAC) side by side.