Purple team exercise plans

Detects purple-team and adversary-emulation exercise plans that name ATT&CK techniques, targets, test windows, C2 infrastructure and expected detections. Exercise wording alone is discovery-only; tabletop exercises are out of scope.

Type: regex
Engine: boost_regex
Confidence: medium
Confidence justification: Medium confidence: the topic phrase alone is discovery-only; enforcement needs populated structure (a MITRE ATT&CK technique ID (T1xxx / T1xxx.xxx) or a populated exercise field (target host/scope, test window, detection owner, white cell, emulated actor, C2 infrastructure, expected detection)), and 85 needs two distinct structures plus independent detection-engineering (SIEM/EDR, telemetry, rules of engagement, tooling) evidence, so policies, blank forms and training text stay below 75.
Detection quality: Topic verified
Jurisdictions: global
Regulations: Security of Critical Infrastructure Act 2018 (Cth)
Frameworks: ISO 27001, NIST CSF
Data categories: security
Scope: wide
Risk rating: 8
Platform compatibility: Purview: Compatible, GCP DLP: Compatible, Macie: Compatible, Zscaler: Compatible, Palo Alto: Degraded, Netskope: Unsupported

Pattern

(?i)\b(?:purple[\s-]team(?:ing)?\s+(?:exercise|engagement|plan|test|scenario|schedule)s?|adversary\s+emulation\s+(?:plan|exercise|scenario)|attack\s+simulation\s+plan)\b

Corroborative evidence keywords

detection gap, SIEM, EDR, telemetry, rules of engagement, deconfliction, blue team, Atomic Red Team, Caldera, Cobalt Strike

Proximity: 300 characters

Should match

The next purple team exercise is planned for the finance network in November. — Discovery probe (65)
Purple team exercise plan - wave 2 Target host: fin-app02.harbour.internal Test window: 14/11/2026 20:00-23:00 — Medium-tier probe (75) - populated exercise fields
Adversary emulation plan - FIN7 profile Target host: fin-app02.harbour.internal Test window: 14/11/2026 20:00-23:00 Steps: T1566.001 spearphishing attachment, T1059.001 PowerShell, T1003.001 LSASS memory C2 server: 203.0.113.44 (Cobalt Strike) Expected detection: EDR alert and SIEM correlation rule; record every detection gap for the blue team. — High-tier probe (85) - technique IDs, exercise fields and detection context

Should not match

unrelated generic text — No relevant phrase context
placeholder value 12345 — Random text should not match
Policy statement: purple team exercises are run twice a year with written rules of engagement. — Policy text
Purple team exercise plan template Target host: ________ Test window: [insert] — Blank template
Course module 2: adversary emulation plan basics - T1059.001 PowerShell and T1566.001 phishing explained. — Training framing with technique IDs

Known false positives

ATT&CK training decks cite technique IDs. Mitigation: Training/course framing is excluded; 85 also needs populated target or window fields.