Lion Cipher Lab
Validate your detections with Atomic Red Team
- SOC Analyst / Blue Team
- Intermediate
- ~60 min
- Free · no account required
Why it matters
A detection you have never fired is a guess. You wrote a rule, or your SIEM shipped with one, and you are trusting that the right log event exists, that your sensor recorded it, and that the logic matches — three assumptions, none of them tested. Purple-teaming replaces that faith with evidence: you deliberately perform a known attack technique on a machine you control, then check whether your own logging and detection caught it. Atomic Red Team is the open-source library that makes this cheap and repeatable — small, single-technique tests mapped to MITRE ATT&CK, each one a specific action…
What you'll learn
- purple-teaming basics
- the emulate-detect-tune loop
- running Atomic Red Team tests safely
- checking whether a detection actually fired
- reading Sysmon process-creation events
- closing a detection gap
Steps in this lab
- Purple-teaming: emulate, detect, tune
- Authorization and isolation, before anything else
- Make sure you can actually see the attack
- Install Invoke-AtomicRedTeam
- Pick ONE low-risk atomic and read it first
- Check prerequisites, then run the atomic
- Did your detection fire? Tune, then clean up
- One atomic is one variation, not a checkmark