Purple team

Blue-team mirror

A full simulated campaign, replayed from the defender's chair. Each attacker move is paired with the log lines it would leave, the rule that would fire, and how long the SOC would take to notice. The moves with nothing beside them are the findings worth writing.

Defender side read from

892 log lines · 41 rules fired · WKSTN-FIN-04, srv-web-01

netflowdnswindows:sysmonproxywindows:securitylinux:authlinux:auditfirewallllmidentitylinux:syslogwindows:firewalllinux:firewallheartbeatmailboxwindows:systemwindows:powershellhelpdesk

Campaign at a glance

Technique coverage

53%

7 clean · 2 partial · 6 dark

Moves replayed

10 ATT&CK tactics touched

Mean alert latency

209 min

Across the moves that alerted at all

Detection gaps

Distinct techniques to write up

Coverage by tactic

Credential Access1/4

3 moves with no telemetry at all

Initial Access1/3

1 move with no telemetry at all

Discovery1/1

Reconnaissance0/1

Execution1/1

Command and Control1/1

Lateral Movement1/1

Privilege Escalation0/1

1 move with no telemetry at all

Exfiltration1/1

Defense Evasion0/1

1 move with no telemetry at all

Write these up

Each of these is a detection-engineering finding: the technique ran and the console did not hand anyone a usable signal.

T1595.003Wordlist scanningReconnaissance
2 lines showing this move reached the index from proxy, but no rule in the pack fired on them — the telemetry is there and the detection is not.
T1190Exploit public-facing applicationInitial Access
1 line showing this move reached the index from proxy, but no rule in the pack fired on them — the telemetry is there and the detection is not.
T1190Exploit public-facing applicationInitial Access
proxy is onboarded, but nothing in the index shows this move and no rule covers T1190. Either it never reached a collector, or the field that would give it away is not being kept.
T1558.003KerberoastingCredential Access
windows:security is onboarded, but nothing in the index shows this move and no rule covers T1558.003. Either it never reached a collector, or the field that would give it away is not being kept.
T1003.006DCSyncCredential Access
windows:security is onboarded, but nothing in the index shows this move and no rule covers T1003.006. Either it never reached a collector, or the field that would give it away is not being kept.
T1078.004Cloud account abusePrivilege Escalation
identity is onboarded, but nothing in the index shows this move and no rule covers T1078.004. Either it never reached a collector, or the field that would give it away is not being kept.
T1040Network sniffingCredential Access
Nothing in the index covers this move and no rule claims T1040. To see it at all the estate needs wireless-controller and WIDS logs — no RF source is onboarded at all.
T1070.001Clear Windows event logsDefense Evasion
windows:security, linux:audit are onboarded, but nothing in the index shows this move and no rule covers T1070.001. Either it never reached a collector, or the field that would give it away is not being kept.