Active Defense Scenarios: A Quarterly Intelligence Driven Purple Team Exercise

The talk opens with a run of recent attacks and campaigns to make the case for "active defense": an intelligence-led, cross-team exercise that checks how ready an organization is to face a specific adversary. The presenters argue that a test should start from threats that matter to the business, its suppliers and its peers, and that a topic is only worth using if there is enough data to build a threat model and test against it.

The middle of the talk walks through the phases of a mission. Planning comes first, followed by threat hunting for the adversary's known indicators to confirm the environment is clean before testing begins. Control validation then replays the adversary's techniques, mapped to the MITRE ATT&CK framework, against endpoint, email, network and other controls. Hardening follows, with control owners writing new detections, often in the vendor-neutral Sigma format, and the same test is then run again under identical conditions. An example built around the Turla group shows before-and-after detection coverage by tactic.

The closing section covers reporting and lessons learned. The presenters recommend a one-page executive summary, a consistent style guide, reports tailored to each audience, credit for every contributing team, and a post-mission debrief. Their after-action approach separates observed facts from opinion. The practical takeaway is to run the cycle repeatedly, track how long each phase takes, and use the results to improve the next mission.