The purple-team glossary

Reproducing a specific threat actor's known TTPs (from ATT&CK) end to end, rather than firing isolated tests, to see how your defenses hold against a realistic chain.

A layer viewer for the ATT&CK matrix. Tyrian exports each engagement as a scored Navigator layer so you can visualize detected / partial / missed coverage.

The periodic call-back an implant makes to its C2 server. Jitter and sleep make beacons look like normal web traffic.

The defensive side, building and tuning detections, triaging alerts, and responding to intrusions using telemetry from endpoints and the network.

The channel a compromised host uses to talk to the attacker, often HTTPS beacons through a redirector. Detecting C2 catches an intrusion early.

Stealing account names and secrets, dumped from memory, extracted from disk, or requested from the domain, to move deeper.

A containment policy where a lab has no outbound internet by default; only explicit allowlisted routes work. It keeps offensive tooling safely inside the range.

Avoiding detection, disabling logging, obfuscating code, injecting into trusted processes, or clearing event logs.

The discipline of building, testing, and tuning detections against real telemetry, measured by coverage and fidelity, not rule count.

Endpoint Detection and Response, agent software that records process, file, and network activity on hosts and raises alerts on suspicious behavior.

Running adversary-controlled code on a target, e.g. via PowerShell, WMI, or scheduled tasks.

Stealing data out of the environment, often over the C2 channel or an encrypted tunnel to a cloud service.

The adversary's end goal that harms the business, for ransomware, mass file encryption and a ransom note. High-volume file modification is a detection trigger.

How an adversary first gets into an environment, phishing, exploiting a public app, valid accounts, or supply chain.

Requesting Kerberos service tickets for accounts with SPNs, then cracking them offline to recover service-account passwords.

The ordered sequence of stages an intrusion moves through, from initial access to impact. ATT&CK tactics give a modern, technique-level kill chain.

Moving from one host to another inside the network using stolen credentials, the stage where a single foothold becomes a domain compromise.

Using legitimate, signed system binaries (PowerShell, rundll32, certutil) to blend in with normal activity and evade allowlists.

Reading the memory of the Windows LSASS process to harvest credentials and tickets. Handle-access to lsass.exe is a high-fidelity detection.

A public knowledge base of adversary tactics (the 'why') and techniques (the 'how'), observed in real intrusions. Tyrian maps every attack action and detection to an ATT&CK id so results are comparable across runs.

Mean Time To Detect, how long from an attacker action to a firing detection. Tyrian reports MTTD per technique, not just one aggregate number.

Maintaining access across reboots and credential changes via run keys, services, scheduled tasks, or new accounts.

A built-in scripting host attackers abuse to download and run payloads in memory ('living off the land'), which makes it high-signal to monitor.

Gaining higher permissions than initially obtained, from a standard user to local admin, or from admin to SYSTEM/domain.

Running malicious code inside the memory space of a legitimate process (e.g. explorer.exe) to hide and inherit trust. Sysmon EID 8 is a key telemetry source.

Running offense (red) and defense (blue) together so every attack technique is immediately measured against your detections. The output is a coverage map, not a pass/fail.

The offensive side, emulating a real adversary to test whether an environment can be compromised and whether that compromise is seen.

Security Information and Event Management, a platform that centralizes logs and runs correlation rules to turn raw telemetry into alerts.

A vendor-neutral, YAML-based detection rule format that compiles to many SIEM query languages, making detections portable.

Using administrative SMB shares (ADMIN$, C$) to run code on a remote host, the technique behind PsExec-style lateral movement that many SOCs miss.

A targeted email carrying a malicious file (often a macro-enabled document) that executes code when opened, a classic first move in the ransomware chain.

A free Windows system monitor that logs rich process, network, and image-load events (e.g. EID 1, 8, 10), the backbone of many endpoint detections.

The adversary's objective for a step, e.g. Initial Access or Impact. ATT&CK groups techniques under 14 enterprise tactics (TA-codes).

A specific way an adversary achieves a tactic, e.g. Spearphishing Attachment. Identified by a T-code, sometimes with a sub-technique (T1566.001).

Abusing an auto-elevating Windows binary (e.g. fodhelper) to run code as administrator without a consent prompt.