skills.rest
defconxt
defconxtCOMMUNITY
Explore all skills by this author →
GitHub

Purple Team / Adversary Emulation

Orchestrate CALDERA, Atomic Red Team, and CloudGoat for ATT&CK-mapped adversary emulation.

Updated Aug 23, 2026
Search Tags:#risk management#cybersecurity#threat hunting#detection engineering#adversary emulation#attack chain#purple team
One-click install
npx skills add https://github.com/defconxt/CIPHER --skill purple-team-adversary-emulation
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: Purple Team / Adversary Emulation
Source: https://github.com/defconxt/CIPHER/tree/main/skills/purple-team
Command: npx skills add https://github.com/defconxt/CIPHER --skill purple-team-adversary-emulation

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) and references (resource) components.

What problem does it solve?

This Skill bridges the gap between offensive and defensive security teams by providing a structured framework for simulating real-world adversary tactics, techniques, and procedures (TTPs) to rigorously test and improve an organization's detection and response capabilities.

Core Features & Use Cases

  • Adversary Emulation: Execute realistic attack scenarios using tools like CALDERA and Atomic Red Team.
  • Detection Gap Analysis: Map existing detections against ATT&CK, identify blind spots, and prioritize remediation.
  • Emulation Planning: Translate threat intelligence into actionable test plans.
  • Cloud Security Testing: Utilize tools like CloudGoat for cloud-specific adversary emulation.
  • Use Case: A security team wants to validate their SIEM rules against common credential access techniques. They use this Skill to emulate LSASS dumping (T1003.001) with CALDERA, observe if their SIEM alerts, and if not, use the provided Sigma rule template to create a new detection.

Quick Start

Use the purple-team skill to emulate the LSASS dump technique using CALDERA and validate detection coverage.

Frequently Asked Questions about Purple Team / Adversary Emulation

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I validate SIEM alerts using adversary emulation?▼

Adversary emulation validates SIEM alerts by orchestrating attack scenarios with tools like CALDERA to trigger existing security controls. It maps execution activities to ATT&CK techniques to identify detection gaps and guide new rule creation.

What is purple teaming in cybersecurity?▼

Purple teaming is a structured framework bridging offensive and defensive teams to simulate real-world adversary tactics, techniques, and procedures, rigorously testing and improving an organization's detection and response capabilities.

How do I map threat intelligence to ATT&CK techniques for detection engineering?▼

Map threat intelligence to ATT&CK techniques for detection engineering by translating threat data into actionable emulation plans. Executing these plans identifies blind spots in coverage, allowing you to prioritize remediation and create targeted detection rules.

Can I use Atomic Red Team and CloudGoat for cloud security testing?▼

Yes, you can use CloudGoat for cloud-specific adversary emulation and security control validation. The framework supports both on-premises and cloud environments for comprehensive testing against realistic attack scenarios.

How do I perform detection gap analysis against the ATT&CK framework?▼

Perform detection gap analysis by mapping existing security detections against the ATT&CK framework during adversary emulation. This identifies blind spots where attacks succeed without alerts, enabling prioritized remediation and creation of new Sigma rules.

Related Skills

Explore More Software Engineering Skills→
BeastAyyGBeastAyyG
1

red-team-tactics

Simulate MITRE ATT&CK-aligned attacker techniques against target environments.

Community
Advanced
coreymaypraycoreymaypray
1

threat-detection-engineer

Author Sigma detection rules with MITRE ATT&CK mapping for SIEM deployment.

Community
Advanced
bomberoxenviosdosruedasbomberoxenviosdosruedas

agency-threat-detection-engineer

Develop and deploy SIEM detection rules mapped to MITRE ATT&CK.

Community
Advanced
MisonLMisonL
8

red-team-tactics

Outline MITRE ATT&CK-based red-team tactics for adversary emulation.

Community
Advanced