## Exercise Framework Setup

To run a Purple Team exercise in your lab or company, you don't need expensive tools.

### 1. The Target
A standard Windows 10/11 VM.
*   **Requirement**: It must have logging enabled (Sysmon) and forwarding to your SIEM.

### 2. The Attack Tool
**Atomic Red Team** is the gold standard for beginners.
*   It is a folder of YAML files.
*   Each file contains a command (PowerShell/CMD).
*   No C2 infrastructure needed. It runs locally.

### 3. The Execution
*   Install `Invoke-AtomicRedTeam` (PowerShell module).
*   Command: `Invoke-AtomicTest T1003 -CheckPrereqs`
*   Command: `Invoke-AtomicTest T1003` (Runs the attack).

### 4. The Tracker
Use a spreadsheet (VECTR is a good free tool, but Excel works).
*   Columns: Technique | Status | Detected? | Blocked? | Notes.
*   Fill it out as you go.