## Purple Team Exercises

A structured Purple Team exercise follows a script.

### Phase 1: Planning
*   **Objective**: "Verify detection of Credential Dumping (T1003)."
*   **Tool**: Mimikatz.
*   **Target**: Test Workstation A.

### Phase 2: Execution (Round 1)
*   Red: Runs `mimikatz.exe privilege::debug`.
*   Blue: Checks SIEM. "No Alert."
*   Red: "Okay, running `sekurlsa::logonpasswords`."
*   Blue: "No Alert."

### Phase 3: Tuning
*   Blue: "Why did we miss it?"
    *   Investigation: "We don't ingest Sysmon Event ID 10 (Process Access)."
*   **Fix**: Enable Sysmon config. Forward logs to Splunk. Write Search.

### Phase 4: Execution (Round 2)
*   Red: Runs `mimikatz.exe`.
*   Blue: "ALERT! Critical Severity - Credential Dumping detected."
*   **Verdict**: Success.

### Phase 5: Reporting
*   "We improved detection coverage for T1003 from 0% to 100%."