Purple Team Exercises
Collaborative exercises where offense and defense work side by side: we run real attack techniques, your team watches what fires and what does not, and detections are built and tested in the same session.
Service 09
Red team & adversary emulation
A penetration test finds as many weaknesses as it can. A red team engagement asks a harder question: if a capable adversary targeted you for weeks, would anyone notice, and would they be able to stop it in time?
Overview
The problem we are solving
Red team engagements are objective-driven and covert. We agree on a small set of goals that would matter to your business (access to a crown-jewel system, a payment workflow, an executive's mailbox) and then pursue them the way a real threat actor would: quietly, patiently, and using whatever path your environment offers.
Adversary emulation takes this a step further by modeling the campaign on the documented tactics, techniques, and procedures of a specific threat group relevant to your industry, mapped to MITRE ATT&CK. Your defenders are measured against the behavior they are most likely to face, not a generic checklist.
The value is in the detection story as much as the access. Every action is logged and timestamped, so after the engagement your security operations team can see exactly what they caught, what they missed, and where the gaps between alert and response sit.
Coverage
What an engagement can include
Scope is agreed up front; these are the areas an engagement typically covers.
- Initial access
- Phishing and pretexting, exposed services, credential attacks against external identity providers, or a starting foothold you supply when initial access is not the point.
- Command & control
- Covert C2 infrastructure designed to blend with normal traffic, testing egress controls, proxy inspection, and network detection.
- Evasion & persistence
- Operating under EDR and logging the way real intruders do, and establishing persistence that survives reboots and routine IT activity.
- Privilege escalation & lateral movement
- Moving through on-premises and cloud identity toward the agreed objectives, choosing quiet paths over fast ones.
- Objective completion
- Safely demonstrating access to each goal (data, systems, or business processes) without exfiltrating real data or disrupting operations.
- Detection & response measurement
- Which stages were detected, how quickly, by which control, and whether the response would have contained a real attacker.
Methodology
How the engagement runs
-
01
Objectives & threat profile
Agree the goals, the threat actor or behaviors to emulate, the rules of engagement, and the small group on your side who knows the engagement is happening.
-
02
Reconnaissance & planning
Open-source intelligence on your organization, people, and technology, and a campaign plan built around the agreed threat profile.
-
03
Campaign execution
Initial access, establishment, escalation, and movement toward objectives, with every action logged and timestamped and a trusted contact kept informed throughout.
-
04
Objective verification
Access to each objective is demonstrated and documented safely, then the campaign is wound down and any implants or artifacts are removed.
-
05
Reporting
Campaign narrative, ATT&CK-mapped activity timeline, ranked findings, and a detection gap analysis your defenders can act on.
-
06
Debrief & replay
A walkthrough with leadership and security operations, with the option to replay key techniques together so detections can be built and confirmed on the spot.
Deliverables
What you receive
- Campaign narrative from initial access to each objective
- MITRE ATT&CK-mapped, timestamped activity log for comparison against your telemetry
- Detection and response gap analysis by attack stage
- Ranked findings with evidence and remediation guidance
- Validation steps for every finding, so your team can confirm and close out each fix on its own
- Executive debrief and a technical session with your defenders
Aligned to
- MITRE ATT&CK
- Threat actor TTPs from public threat intelligence reporting
- Penetration Testing Execution Standard (PTES)
Questions
Frequently asked
Are we ready for a red team engagement?
Red teaming pays off once you have basic hygiene and a monitoring capability to measure. If you have never had a penetration test, or have no one watching alerts, a penetration test or assumed breach assessment will usually give you more for the same budget. We will tell you honestly during scoping.
How long does an engagement run?
Longer than a typical penetration test, because stealth takes time. Duration depends on objectives and whether initial access is in scope, and is agreed during scoping.
How do you avoid disrupting the business?
Rules of engagement define what is off limits, a trusted contact on your side can pause the engagement at any time, and techniques that risk availability are avoided or agreed in advance.
How is this different from a purple team exercise?
A red team engagement is covert and measures how your defenses perform unaided. A purple team exercise is collaborative, with offense and defense working side by side to build detections. Many clients follow one with the other.
Related
Often scoped together
Assumed Breach Assessment
Testing that starts from the inside: a compromised user or workstation, and the question of how far an attacker can get from there before anyone notices.
Get started
Ready to scope red team?
Scoping conversations are free and usually take twenty minutes. You will speak directly with the consultant who would do the work.
Request an assessment
or reach out directly, (608) 520-0719 sales@infocus-security.com