Purple Team Strategies

Chapter 10: Purple Teaming the ATT&CK Tactics

The MITRE ATT&CK framework has become the de facto standard knowledge base regarding adversary tactics and techniques. This repository is continuously evolving and offers classified tactics and techniques that could be used by both red and blue teams for security assessments. An interesting part of this framework is that these technical references can be used directly in security devices such as Security Information and Event Management (SIEM), Endpoint Detection and Response (EDR), Breach Attack Simulation (BAS), Sigma rules (where most of the detection rules contain MITRE ATT&CK tags), and so on. Security professionals can now build a full coverage mapping of all techniques to get an overall view ...