Purple Team Exercise Planner
A purple team exercise is red and blue working in the same room: red runs an announced attacker technique, blue checks whether it was detected, and both fix the gap before moving on. Pick a threat and the environments in scope, and this planner gives you 6 to 12 MITRE ATT&CK test cards, a coverage score as you mark results, a gap list, and an agenda with rules of engagement you can copy as a report. Everything runs in your browser.
You get 12 MITRE ATT&CK techniques as test cards. Run each one, then mark it Detected, Logged only, Missed or Not tested. Plan before the day; score during the hot wash.
- 1
- Red emulates:
- Send a benign test attachment (for example a document whose only action is to start a harmless process) to seeded test mailboxes. Use an open-source phishing framework such as Gophish for delivery and tracking.
- Blue should see:
- Email gateway verdicts and message trace, attachment sandbox results, then process creation on the endpoint (an Office app starting a script host or shell).
- Expected detection:
- Gateway or sandbox flags the attachment; EDR alerts on an Office application spawning a child process.
- Emulate with:
- Atomic Red Team has tests indexed under T1566.001. Read each test before running it. Gophish for test phishing delivery and click tracking. Atomic tests for T1566.001
- 2
- Red emulates:
- Sign in to the VPN or remote access gateway with a dedicated test account, from an unusual location or at an unusual time agreed in advance.
- Blue should see:
- VPN or remote access gateway authentication logs, identity provider sign-in logs, and the first internal connections from the assigned VPN address.
- Expected detection:
- An anomalous-sign-in alert (new country, impossible travel, first-time device) on remote access.
- Emulate with:
- Atomic Red Team has tests indexed under T1133. Read each test before running it. Apache Caldera (formerly MITRE Caldera) to chain techniques into one emulated operation. Atomic tests for T1133
- 3
- Red emulates:
- Run benign PowerShell that looks like attacker tradecraft (encoded command, download cradle to an internal test URL) on a test endpoint.
- Blue should see:
- PowerShell script block logging (event 4104), process creation (4688 with command line, or Sysmon event 1), AMSI and EDR telemetry.
- Expected detection:
- EDR or SIEM alert on an encoded or obfuscated PowerShell command line.
- Emulate with:
- Atomic Red Team has tests indexed under T1059.001. Read each test before running it. Apache Caldera (formerly MITRE Caldera) to chain techniques into one emulated operation. Atomic tests for T1059.001
- 4
- Red emulates:
- Create a clearly named test scheduled task that runs a harmless program, then remove it.
- Blue should see:
- Windows Security event 4698 (task created), the Task Scheduler operational log, process creation of schtasks.exe.
- Expected detection:
- An alert on a new scheduled task created from a script host or by a non-admin tool, or pointing to a user-writable path.
- Emulate with:
- Atomic Red Team has tests indexed under T1053.005. Read each test before running it. Apache Caldera (formerly MITRE Caldera) to chain techniques into one emulated operation. Atomic tests for T1053.005
- 5
- Red emulates:
- On a test host, try to stop or uninstall the EDR agent or another security tool with a test admin account. Tamper protection should block it.
- Blue should see:
- EDR tamper-protection events, service stop and change events, agent health or heartbeat loss in the console.
- Expected detection:
- A tamper alert, and an alert when an agent stops reporting.
- Emulate with:
- Atomic Red Team has tests indexed under T1685. Read each test before running it. Apache Caldera (formerly MITRE Caldera) to chain techniques into one emulated operation. Atomic tests for T1685
- 6
- Red emulates:
- On a disposable test host with only test credentials in memory, run an LSASS access test, then delete any output.
- Blue should see:
- EDR and Sysmon process access events (event 10) targeting lsass.exe, Credential Guard or protected-process blocks.
- Expected detection:
- A high-severity EDR alert or block on LSASS access or memory dumping.
- Emulate with:
- Atomic Red Team has tests indexed under T1003.001. Read each test before running it. Apache Caldera (formerly MITRE Caldera) to chain techniques into one emulated operation. Atomic tests for T1003.001
- 7
- Red emulates:
- Request service tickets for a set of test service accounts with SPNs, including one honey account. Do not crack real tickets.
- Blue should see:
- Kerberos service ticket events (4769) on domain controllers, especially many requests from one account or RC4 encryption type.
- Expected detection:
- An alert on many service ticket requests from one user, or any request for the honey SPN.
- Emulate with:
- Atomic Red Team has tests indexed under T1558.003. Read each test before running it. Apache Caldera (formerly MITRE Caldera) to chain techniques into one emulated operation. Atomic tests for T1558.003
- 8
- Red emulates:
- Enumerate domain users and admin groups from a test workstation with common built-in commands or an LDAP query.
- Blue should see:
- Process creation for net.exe and similar tools, LDAP query telemetry on domain controllers, identity threat detection.
- Expected detection:
- An alert on bulk directory enumeration from a workstation.
- Emulate with:
- Atomic Red Team has tests indexed under T1087.002. Read each test before running it. Apache Caldera (formerly MITRE Caldera) to chain techniques into one emulated operation. Atomic tests for T1087.002
- 9
- Red emulates:
- Copy a harmless file to a test host's admin share (C$ or ADMIN$) and start it remotely as a service.
- Blue should see:
- Share access (5140, 5145), service installation (System event 7045), logon type 3 on the target.
- Expected detection:
- An alert on remote service creation or admin-share writes from a workstation.
- Emulate with:
- Atomic Red Team has tests indexed under T1021.002. Read each test before running it. Apache Caldera (formerly MITRE Caldera) to chain techniques into one emulated operation. Atomic tests for T1021.002
- 10
- Red emulates:
- Upload the dummy archive to an exercise-controlled cloud storage account with a sync or command-line client.
- Blue should see:
- Proxy and firewall logs (volume to storage providers), EDR network events, DLP.
- Expected detection:
- An alert on unusual upload volume to cloud storage, or a sync client running on a server.
- Emulate with:
- Atomic Red Team has tests indexed under T1567.002. Read each test before running it. Apache Caldera (formerly MITRE Caldera) to chain techniques into one emulated operation. Atomic tests for T1567.002
- 11
- Red emulates:
- On a disposable, isolated test host or test cloud account only, delete shadow copies or test backups or snapshots.
- Blue should see:
- Process creation for vssadmin, wbadmin or bcdedit with delete arguments; cloud audit events for snapshot or backup deletion.
- Expected detection:
- A high-severity alert, ideally a block, on shadow-copy or backup deletion.
- Emulate with:
- Atomic Red Team has tests indexed under T1490. Read each test before running it. Stratus Red Team scenarios: Deregister an Amazon EC2 AMI (AWS). Apache Caldera (formerly MITRE Caldera) to chain techniques into one emulated operation. Atomic tests for T1490
- 12
- Red emulates:
- On an isolated test host or test bucket only, encrypt a folder of dummy files with a test tool, keeping the key.
- Blue should see:
- EDR file telemetry (mass rename and rewrite), ransomware protection or canary files, cloud storage write and delete events.
- Expected detection:
- A ransomware-behaviour alert or automatic block and host isolation.
- Emulate with:
- Atomic Red Team has tests indexed under T1486. Read each test before running it. Stratus Red Team scenarios: S3 Ransomware through client-side encryption (AWS); GCS Ransomware through client-side encryption; Azure ransomware via Storage Account Blob deletion. Apache Caldera (formerly MITRE Caldera) to chain techniques into one emulated operation. Atomic tests for T1486
More techniques for this threat
Held back to keep one session to a manageable size. Add any of them, or save them for the next exercise.
- T1078.004Valid Accounts: Cloud Accounts(other environment)
- T1110.003Brute Force: Password Spraying(other environment)
- T1621Multi-Factor Authentication Request Generation(other environment)
- T1059.004Command and Scripting Interpreter: Unix Shell(other environment)
- T1053.003Scheduled Task/Job: Cron(other environment)
- T1098.003Account Manipulation: Additional Cloud Roles(other environment)
- T1135Network Share Discovery
- T1580Cloud Infrastructure Discovery(other environment)
- T1021.001Remote Services: Remote Desktop Protocol
- T1021.004Remote Services: SSH(other environment)
- T1685.002Disable or Modify Tools: Disable or Modify Cloud Log(other environment)
- T1560.001Archive Collected Data: Archive via Utility
- T1537Transfer Data to Cloud Account(other environment)
- T1489Service Stop
- T1531Account Access Removal(other environment)
Exercise agenda
Timings are a planning assumption (about 40 minutes per technique to announce, run, observe, tune and re-run). Adjust to your team.
Timeline
- 4 weeks before: Agree the objective, threat and environments; sign off the 12 techniques on this page with the sponsor.
- 2 weeks before: Rules of engagement and approvals signed; test accounts, hosts and mailboxes created; log sources confirmed in the SIEM.
- 1 week before: Red dry-runs every technique in a lab; blue prepares the queries and dashboards they will watch; MDR or MSSP told the window.
- Exercise day: Kickoff (30 min), then 12 techniques at about 40 min each, then a hot wash (45 min). About 9 h 15 min in total, so split it over two days.
- 1 week after: Report out: coverage score, gap list, detection tickets with owners and dates, test artefacts confirmed removed.
- 30 to 90 days after: Re-test every missed and logged-only technique to prove the new detections fire, then pick the next threat.
Roles
- Exercise lead (facilitator): Owns scope, runs the clock, calls each technique, keeps the scoreboard and calls a stop if needed.
- Red operator(s): Runs each announced technique from test accounts and hosts, logs exact times and commands for the record.
- Blue analysts (SOC): Watch the SIEM, EDR and consoles live; say what they saw, when, and whether an alert fired.
- Detection engineer: Writes or tunes the detection on the spot for anything logged only, and asks red to re-run.
- Scribe: Records technique, time, result, evidence and follow-up owner for the report.
- Executive sponsor / approver: Signs the rules of engagement and accepts the residual risk of live testing.
- System owners / IT operations on call: Own the test hosts, can roll back changes and confirm nothing in production was touched.
What this tool is
- Purple teaming means the red team runs announced attacker techniques while the blue team watches, live, whether each one is detected, and both fix the gaps together.
- Pick a threat (ransomware operator, business email compromise, cloud credential theft, insider data theft or web app compromise) and the environments in scope (Windows and Active Directory, Linux, AWS, Azure or Google Cloud, SaaS and Microsoft 365).
- Get 6 to 12 MITRE ATT&CK test cards: what red emulates safely, what telemetry blue should see, the detection you expect, and open-source frameworks to emulate with (Atomic Red Team, Apache Caldera, Stratus Red Team).
- Mark each technique Detected, Logged only, Missed or Not tested to get a coverage score and a gap list ordered by what to fix first.
- Get the exercise agenda (timeline, roles, rules of engagement and safety checklist) and copy everything as a plain-text report. Runs in your browser; nothing is uploaded.
Purple team vs red team vs breach and attack simulation
Three ways to test whether your defences work. They answer different questions, and most mature programmes use all three.
| Purple team | Red team | BAS | |
|---|---|---|---|
| Question it answers | Can we see and stop these specific techniques, and can we fix it today? | Can a capable adversary reach an objective without being caught? | Do our controls still block or detect a library of known techniques, run again and again? |
| How it runs | Red and blue in the same room; every technique announced, then tuned and re-run. | Covert; most defenders are not told in advance. | Automated software runs simulations on a schedule against agents or test targets. |
| Output | A per-technique result, new or tuned detections, and a re-test date. | An attack narrative and findings report at the end. | Dashboards of prevented, detected and missed techniques over time. |
| Best for | Building detection coverage and training the SOC together. | Testing the whole programme, including people and response, under realistic pressure. | Catching drift between exercises after changes to tools, rules or infrastructure. |
| Weak spot | Only as good as the techniques you pick; needs both teams' time. | Findings arrive late, and blue learns little during the test. | Simulations can be narrower than a human operator; results need people to act on them. |
Purple: Can we see and stop these specific techniques, and can we fix it today?
Red: Can a capable adversary reach an objective without being caught?
BAS: Do our controls still block or detect a library of known techniques, run again and again?
Purple: Red and blue in the same room; every technique announced, then tuned and re-run.
Red: Covert; most defenders are not told in advance.
BAS: Automated software runs simulations on a schedule against agents or test targets.
Purple: A per-technique result, new or tuned detections, and a re-test date.
Red: An attack narrative and findings report at the end.
BAS: Dashboards of prevented, detected and missed techniques over time.
Purple: Building detection coverage and training the SOC together.
Red: Testing the whole programme, including people and response, under realistic pressure.
BAS: Catching drift between exercises after changes to tools, rules or infrastructure.
Purple: Only as good as the techniques you pick; needs both teams' time.
Red: Findings arrive late, and blue learns little during the test.
BAS: Simulations can be narrower than a human operator; results need people to act on them.
How to run a purple team exercise
- Pick one objective and one threat. For example: "Can we detect a ransomware operator between first access and encryption on our Windows estate?" One threat per session keeps the scope honest.
- Choose 6 to 12 techniques. Map the threat to MITRE ATT&CK techniques that run in your environment. Fewer than six tells you little; more than twelve rarely fits in a day with time to tune.
- Agree rules of engagement and approvals. Scope, window, test accounts, stop conditions, deconfliction with your SOC or MDR provider, and written sign-off from the system owners and a sponsor.
- Prepare both sides. Red dry-runs every technique in a lab. Blue confirms each log source is reaching the SIEM and prepares the queries they will watch.
- Run, watch, tune, re-run. Announce each technique, run it, let blue look, record Detected, Logged only or Missed, fix what you can on the spot and run it again.
- Report and re-test. A coverage score, a gap list with owners and dates, and a re-test of every gap 30 to 90 days later to prove the new detections fire.
Purple team exercise examples: techniques by threat
The 71 techniques the planner draws on, grouped by the threat they belong to. IDs and names follow the MITRE ATT&CK Enterprise matrix, version 20, which split the old Defense Evasion tactic into Stealth and Defense Impairment. The tool picks the ones that run in the environments you choose.
Ransomware operator
Hands-on-keyboard intrusion that ends in data theft and encryption.
- T1566.001 Phishing: Spearphishing Attachment (Initial Access)
- T1133 External Remote Services (Initial Access)
- T1078.004 Valid Accounts: Cloud Accounts (Initial Access)
- T1110.003 Brute Force: Password Spraying (Credential Access)
- T1621 Multi-Factor Authentication Request Generation (Credential Access)
- T1059.001 Command and Scripting Interpreter: PowerShell (Execution)
- T1059.004 Command and Scripting Interpreter: Unix Shell (Execution)
- T1053.005 Scheduled Task/Job: Scheduled Task (Persistence)
- T1053.003 Scheduled Task/Job: Cron (Persistence)
- T1098.003 Account Manipulation: Additional Cloud Roles (Persistence)
- T1003.001 OS Credential Dumping: LSASS Memory (Credential Access)
- T1558.003 Steal or Forge Kerberos Tickets: Kerberoasting (Credential Access)
- T1087.002 Account Discovery: Domain Account (Discovery)
- T1135 Network Share Discovery (Discovery)
- T1580 Cloud Infrastructure Discovery (Discovery)
- T1021.002 Remote Services: SMB/Windows Admin Shares (Lateral Movement)
- T1021.001 Remote Services: Remote Desktop Protocol (Lateral Movement)
- T1021.004 Remote Services: SSH (Lateral Movement)
- T1685 Disable or Modify Tools (Defense Impairment)
- T1685.002 Disable or Modify Tools: Disable or Modify Cloud Log (Defense Impairment)
- T1560.001 Archive Collected Data: Archive via Utility (Collection)
- T1567.002 Exfiltration Over Web Service: Exfiltration to Cloud Storage (Exfiltration)
- T1537 Transfer Data to Cloud Account (Exfiltration)
- T1490 Inhibit System Recovery (Impact)
- T1489 Service Stop (Impact)
- T1486 Data Encrypted for Impact (Impact)
- T1531 Account Access Removal (Impact)
Business email compromise
Mailbox takeover, hidden rules and a fraudulent payment request.
- T1566.002 Phishing: Spearphishing Link (Initial Access)
- T1110.003 Brute Force: Password Spraying (Credential Access)
- T1621 Multi-Factor Authentication Request Generation (Credential Access)
- T1539 Steal Web Session Cookie (Credential Access)
- T1078.004 Valid Accounts: Cloud Accounts (Initial Access)
- T1078.002 Valid Accounts: Domain Accounts (Initial Access)
- T1528 Steal Application Access Token (Credential Access)
- T1098.005 Account Manipulation: Device Registration (Persistence)
- T1098.002 Account Manipulation: Additional Email Delegate Permissions (Persistence)
- T1564.008 Hide Artifacts: Email Hiding Rules (Stealth)
- T1114.003 Email Collection: Email Forwarding Rule (Collection)
- T1114.002 Email Collection: Remote Email Collection (Collection)
- T1534 Internal Spearphishing (Lateral Movement)
- T1657 Financial Theft (Impact)
Cloud credential theft
A leaked key or stolen token used to persist, hide and take data.
- T1552.001 Unsecured Credentials: Credentials In Files (Credential Access)
- T1555.003 Credentials from Password Stores: Credentials from Web Browsers (Credential Access)
- T1552.004 Unsecured Credentials: Private Keys (Credential Access)
- T1190 Exploit Public-Facing Application (Initial Access)
- T1552.005 Unsecured Credentials: Cloud Instance Metadata API (Credential Access)
- T1539 Steal Web Session Cookie (Credential Access)
- T1078.004 Valid Accounts: Cloud Accounts (Initial Access)
- T1621 Multi-Factor Authentication Request Generation (Credential Access)
- T1528 Steal Application Access Token (Credential Access)
- T1087.004 Account Discovery: Cloud Account (Discovery)
- T1580 Cloud Infrastructure Discovery (Discovery)
- T1526 Cloud Service Discovery (Discovery)
- T1619 Cloud Storage Object Discovery (Discovery)
- T1098.001 Account Manipulation: Additional Cloud Credentials (Persistence)
- T1098.003 Account Manipulation: Additional Cloud Roles (Persistence)
- T1136.003 Create Account: Cloud Account (Persistence)
- T1685.002 Disable or Modify Tools: Disable or Modify Cloud Log (Defense Impairment)
- T1535 Unused/Unsupported Cloud Regions (Stealth)
- T1550.001 Use Alternate Authentication Material: Application Access Token (Lateral Movement)
- T1530 Data from Cloud Storage (Collection)
- T1537 Transfer Data to Cloud Account (Exfiltration)
Insider data theft
A trusted user collects and moves data out with their own access.
- T1078.002 Valid Accounts: Domain Accounts (Initial Access)
- T1078.004 Valid Accounts: Cloud Accounts (Initial Access)
- T1083 File and Directory Discovery (Discovery)
- T1135 Network Share Discovery (Discovery)
- T1619 Cloud Storage Object Discovery (Discovery)
- T1213.002 Data from Information Repositories: Sharepoint (Collection)
- T1530 Data from Cloud Storage (Collection)
- T1039 Data from Network Shared Drive (Collection)
- T1005 Data from Local System (Collection)
- T1114.003 Email Collection: Email Forwarding Rule (Collection)
- T1074.001 Data Staged: Local Data Staging (Collection)
- T1560.001 Archive Collected Data: Archive via Utility (Collection)
- T1685.005 Disable or Modify Tools: Clear Windows Event Logs (Defense Impairment)
- T1052.001 Exfiltration Over Physical Medium: Exfiltration over USB (Exfiltration)
- T1567 Exfiltration Over Web Service (Exfiltration)
- T1567.002 Exfiltration Over Web Service: Exfiltration to Cloud Storage (Exfiltration)
- T1048 Exfiltration Over Alternative Protocol (Exfiltration)
- T1537 Transfer Data to Cloud Account (Exfiltration)
Web app compromise
An internet-facing app is exploited and used as a foothold.
- T1595.002 Active Scanning: Vulnerability Scanning (Reconnaissance)
- T1110.004 Brute Force: Credential Stuffing (Credential Access)
- T1190 Exploit Public-Facing Application (Initial Access)
- T1539 Steal Web Session Cookie (Credential Access)
- T1078.004 Valid Accounts: Cloud Accounts (Initial Access)
- T1059.004 Command and Scripting Interpreter: Unix Shell (Execution)
- T1059.001 Command and Scripting Interpreter: PowerShell (Execution)
- T1505.003 Server Software Component: Web Shell (Persistence)
- T1105 Ingress Tool Transfer (Command and Control)
- T1548.003 Abuse Elevation Control Mechanism: Sudo and Sudo Caching (Privilege Escalation)
- T1552.001 Unsecured Credentials: Credentials In Files (Credential Access)
- T1552.005 Unsecured Credentials: Cloud Instance Metadata API (Credential Access)
- T1580 Cloud Infrastructure Discovery (Discovery)
- T1083 File and Directory Discovery (Discovery)
- T1071.001 Application Layer Protocol: Web Protocols (Command and Control)
- T1685.006 Disable or Modify Tools: Clear Linux or Mac System Logs (Defense Impairment)
- T1005 Data from Local System (Collection)
- T1530 Data from Cloud Storage (Collection)
- T1041 Exfiltration Over C2 Channel (Exfiltration)
Rules of engagement checklist
- Objective written in one sentence, and how success will be measured.
- In-scope hosts, accounts, tenants and cloud accounts listed by name; everything else out of scope.
- Exact test window (date, start and end time, time zone).
- Every technique announced before it runs: no surprise actions in a purple exercise.
- Dedicated test accounts only; no real user credentials, no real customer or personal data.
- Stop conditions and an abort word that anyone can call; one person with authority to stop.
- Deconfliction list shared with the SOC, MDR or MSSP and the help desk (test accounts, source IPs, window).
- One communication channel for the day, with red and blue in it.
- Red logs every action with a timestamp so blue can match it to telemetry.
- Cleanup list: every account, key, rule, task, file and resource created is removed and checked afterwards.
- Cloud techniques run in a separate test account, subscription or project with a budget alert.
- Phishing and mailbox techniques target test mailboxes or staff who have agreed to take part.
Safety and approval checklist
- Written approval from the executive sponsor and the owner of every in-scope system.
- Change ticket raised for the window.
- Exercise framework tests read and understood before running; nothing run from an unreviewed script.
- Security tools left in their normal mode (do not switch off EDR to "let the test through").
- Rollback plan for each persistence and configuration change.
- Destructive techniques (encryption, backup deletion, credential dumping, service stop) only on disposable, isolated test hosts or accounts, with backups confirmed first.
- Desk steps (payment requests, internal phishing) agreed with the people who will receive them; no money moves.
- HR and legal sign-off for the insider scenario and any monitoring of staff accounts.
- Phishing targets approved by HR; captured data limited to clicks, never real passwords.
- Post-exercise check that all test artefacts are gone and test accounts are disabled.
The red-team text on every card stays at the level of what to emulate and how to keep it safe. For the exact steps, read the technique’s page on attack.mitre.org and the framework’s own test, and run anything destructive only on disposable, isolated hosts.
Frequently asked questions
What is purple teaming?
Purple teaming is a way of running security testing in which the red team (offence) and the blue team (defence) work together in real time. Red announces and runs a specific attacker technique, usually mapped to MITRE ATT&CK; blue checks whether their logs, EDR and SIEM saw it and whether an alert fired; and if not, they build or tune the detection on the spot and red runs the technique again to prove it now fires. The aim is measurable improvement in detection and response, not a win or a loss.
How do you run a purple team exercise?
Choose one objective and one threat, pick 6 to 12 ATT&CK techniques that threat uses in your environment, and agree written rules of engagement and approvals. Create test accounts and hosts, confirm the log sources are in the SIEM, and have red dry-run every technique in a lab. On the day, run each technique in turn: announce it, execute it, let blue look, record Detected, Logged only or Missed, tune, re-run. Finish with a hot wash, a report with owners and dates for each gap, and a re-test 30 to 90 days later.
What are examples of purple team exercises?
A ransomware exercise runs phishing, PowerShell execution, LSASS credential access, lateral movement over admin shares, security-tool tampering, shadow-copy deletion and file encryption on isolated test hosts. A business email compromise exercise covers session-cookie theft, inbox hiding and forwarding rules, mailbox delegation and a desk test of the payment call-back control. Cloud exercises cover a leaked key, metadata credential theft, new access keys, disabled logging and data copied out of storage. This planner builds each of these from real ATT&CK technique IDs.
Purple team vs red team: what is the difference?
A red team engagement is adversarial and usually covert: the red team tries to reach an objective without being caught and reports afterwards. A purple team exercise is open and collaborative: every technique is announced, blue watches live, and gaps are fixed during the session. Red teaming tests whether you can be beaten; purple teaming measures and improves whether you can see and respond to specific techniques.
What is breach and attack simulation (BAS), and does it replace purple teaming?
Breach and attack simulation is software that runs libraries of simulated attack techniques automatically and on a schedule, then reports which were blocked, detected or missed. It is good at catching drift between exercises after changes to tools, rules or infrastructure. It does not replace a purple team exercise: simulations can be narrower than a human operator, and someone still has to investigate each miss and build the detection. Many teams use BAS to re-test what a purple exercise fixed.
What tools are used for purple team exercises?
Common open-source choices are Atomic Red Team (small tests indexed by ATT&CK technique ID), Apache Caldera (formerly MITRE Caldera, an adversary emulation platform that chains techniques into an operation), Stratus Red Team (cloud attack techniques for AWS, Azure, Google Cloud, Kubernetes and Entra ID) and Gophish (phishing simulation). Blue uses the tools it already has: SIEM, EDR, identity and cloud audit logs. Read every test before you run it, and run destructive ones only on disposable, isolated hosts.
More free security tools
The tools people use most on PlayCISO.
Catch injected instructions hiding in content your AI agent should only read.
Score your readiness against the first international standard for AI security threats.
Critical CVEs across 21 major vendors, month by month — and what the 2026 surge means.
Build an ordered ruleset, replay labelled packets and catch shadowed and any-to-any rules.
Self-assess all six Functions, from Govern to Recover, and see your weakest one.
Search 172 threat actors across Microsoft, CrowdStrike, Mandiant and community names.