Atomic Bird Goes Purple #1

Threat Emulation Module Recap

The bottom line of the activities found in this room is to enhance the impact of the Purple Team, Threat Emulation and Detection Engineering exercises by going beyond the defaults and basics. In this room, you will work on real-life scenarios using the outcomes you gained during the threat emulation module. You will emulate and hunt adversarial tactics and experience purple teaming exercises.

Learning Objectivities

• Gain hands-on threat emulation experience.
• Familiarise yourself with artefacts created by adversary tactics and techniques.
• Experience emulation and detection to improve your overall security defences.

Room Prerequisites

• Windows Event Logs (Room)
• Sigma (Room)
• Sysmon (Room)
• Aurora EDR (Room)
• Hacking with PowerShell (Room)
• Windows Fundamentals (Module)
• Threat Emulation Module (Module)

Before proceeding to the next task, let’s start the Lab Machine by pressing the Start Lab Machine button at the top of this task. The machine will start in a split-screen view. In case the VM is not visible, use the blue Show Split View button at the top-right of the page.