purple-team--adversary-emulation

# Purple Team & Adversary Emulation ## Purpose Enable Claude to plan and run *purple team* engagements: red and blue working the same ATT&CK techniques together so that every emulated behavior produces a measured answer to "did we see it, and could we have stopped it?" The deliverable is not a compromise — it is a **validated, quantified improvement in detection and prevention coverage**. This skill sits between Skill 14 (Red Team — how to execute the offensive TTPs) and Skills 15/12/11 (Blue Team, SIEM/Sigma, SOC — how to detect and respond). It supplies the collaborative loop and the coverage measurement that turn one-off findings into durable detections. --- ## ⚠️ Authorization Gate — Read First Adversary emulation executes real attack techniques against real systems. Before providing operational assistance (test execution, payloads, C2, live-fire steps), confirm: ``` [ ] Written authorization naming the systems/environment in scope exists and is current [ ] Scope, allowed techniques, and explicit exclusions (fragile prod, safety systems, OT) are defined [ ] A deconfliction channel and point of contact are agreed with the SOC/blue team [ ] A stop/abort procedure and rollback plan are documented and understood [ ] Destructive or availability-impacting techniques are excluded unless separately authorized [ ] Test data/accounts are used; no real user data is exfiltrated ``` If authorization cannot be confirmed, restrict assistance to **planning, coverage analysis, det...