Purple teaming
A live test of detection.
Offsecure runs the exercise with the security team on the line. The channel is set during scoping. Each technique is reported the moment it is executed, and the team answers with what the stack detected and how it responded.
Purple teaming at Offsecure is white-box work against the stack an organization already runs. The channel is agreed before the first technique and stays open for the engagement. Operators carry current offensive work: command and control, bypasses of endpoint detection, and social engineering. When the stack lives further out, the same engagement can move into the local network, a major cloud, a cluster, or a virtual network. Offsecure proposes the techniques. The client edits the list. Each one is tied to MITRE ATT&CK. The measure is how many techniques are in the list, and where they are taken.
What gets run
Operators carry the techniques. They are chosen for the products this organization runs, and each one is reported on the channel as it happens.
Command and control
A command channel, aimed at the controls this stack uses to see one.
EDR bypass
Bypasses built for the endpoint product in place.
Social engineering
Brought in when people are part of the path under test. The action and the reply share the channel.
How an engagement is sized
Once the list is edited, two things set the size: how many techniques remain, and where they will be taken. Ten, twenty, thirty, and forty are the usual counts. Every technique is mapped to MITRE ATT&CK.
10
A tight list. Enough to examine one control properly.
20
Enough techniques to see whether detection holds a pattern.
30
A larger cut of the stack.
40
The wide option. Still one technique at a time, still mapped.
Where it can go
From the endpoint work, the engagement can be extended into the environment the organization actually runs.
Local networks
The network behind the first foothold.
Cloud
AWS, Azure, or Google Cloud, when that is where the estate runs.
Clusters
Kubernetes, and what the cluster depends on.
Virtual networks
The virtual networks under those clouds and clusters.
The sequence
01
The brief
The stack and the ground to cover are reviewed. Offsecure proposes the techniques. The client changes what should change. The channel is named, and the list is mapped to ATT&CK.
02
The run
Operators execute. Each action is placed on the channel as it happens.
03
The reply
Detection and response come back from the security team while the work is still going.
04
The score
Every technique is marked for what was seen and how the response went, against ATT&CK.
Who attends
Offsecure fields a manager, an operator, and a project manager. The security team joins on the channel. A specialist is added only when a technique or an area calls for one.
How long
Time follows the technique count. Ten is a shorter engagement than forty. The work stops when the agreed list is finished.
The close
The engagement closes with a full score of detection and response for the techniques that ran, set against MITRE ATT&CK. With that score comes an analysis, guidance on how to act on the recommendations, and next steps written for an executive audience.