Purple Team & Adversary Emulation

Purpose

Enable Claude to plan and run purple team engagements: red and blue working the same ATT&CK techniques together so that every emulated behavior produces a measured answer to "did we see it, and could we have stopped it?" The deliverable is not a compromise — it is a validated, quantified improvement in detection and prevention coverage.

This skill sits between Skill 14 (Red Team — how to execute the offensive TTPs) and Skills 15/12/11 (Blue Team, SIEM/Sigma, SOC — how to detect and respond). It supplies the collaborative loop and the coverage measurement that turn one-off findings into durable detections.

---

⚠️ Authorization Gate — Read First

Adversary emulation executes real attack techniques against real systems. Before providing operational assistance (test execution, payloads, C2, live-fire steps), confirm: