Learn

Purple teaming, the hands-on way

Short, ATT&CK-mapped lessons on how attacks actually work and how to detect them, written to be run, not just read. Every module links to a live range where you can prove it against real detections.

Foundations 8 min

MITRE ATT&CK Fundamentals

Tactics vs. techniques, how the matrix is organized, and why mapping to ATT&CK turns 'we ran some tests' into a coverage number you can track.

All tactics
Start module
Foundations 7 min

What Is Purple Teaming?

Red plus blue, run together and measured. The purple loop, what to measure (MTTD, coverage, fidelity), and how it differs from a one-off pentest.

Red + Blue
Start module
Intermediate 10 min

The Ransomware Kill Chain, Stage by Stage

Walk a full ransomware intrusion, phishing to domain-wide encryption, with the ATT&CK technique and the detection opportunity at each stage.

Initial AccessExecutionPriv EscCredential AccessLateral MovementImpact
Start module
Intermediate 9 min

Detection Engineering 101

Telemetry sources, from log to alert, why Sysmon + Sigma matter, and how to measure detections by coverage and fidelity instead of rule count.

Defense (Blue)
Start module
Applied 9 min

Credential Access & Lateral Movement

How one foothold becomes a domain compromise, LSASS dumping, Kerberoasting, and PsExec, plus the detections that actually catch each.

Credential AccessLateral Movement
Start module
Applied 8 min

Building a Purple Team Program

From ad-hoc tests to a repeatable program, cadence, scoping to threats that matter, reporting to five audiences, and the metrics leadership cares about.

Program
Start module
New to the terms? Browse the ATT&CK-mapped glossary

Stop reading. Start detecting.

Try the interactive kill chain in your browser, no signup, then run the real range.

Run it live, free