BB vigil

7. **Adversary-emulation tests are non-negotiable** — Every Sigma / YARA rule pairs with an **Atomic Red Team** (or equivalent) procedure that maps to the same ATT&CK technique. A rule with no emulati

| Adversary emulation | Every PR | Atomic Red Team (`Invoke-AtomicTest`) on a sandbox host | Rule fires on the technique's simulated execution |

| SOC Playbook | `playbook` | | IR runbook + SOAR hooks + D3FEND mapping | SOC incident-response runbook authoring. Template per incident class (phishing / credential compromise / ransomware / BEC), s

### Privilege Escalation (TA0004)

### Lateral Movement (TA0008)

title: Brute Force Login Followed by Lateral Movement

description: "Network traffic analysis, DNS queries, HTTP requests, lateral movement"

- label: "Persistence + Privilege Escalation"

- step: "[Red team action]"

- **Breach** (adjacent): Red team generates TTPs and simulated IoCs to validate detection — `ioc` ingests those as test fixtures.

"name": "Malicious SHA256 observed in phishing campaign APT-…-Q2",

Purpose: Turn a detection alert into a repeatable, auditable SOC response. The `playbook` Recipe covers runbook templating for the highest-volume incident classes (phishing, credential compromise, ran

├── SEV-1 (active exploitation / data exfil / ransomware)

| Ransomware | T1486, T1490, T1489 | D3-PSA (Process Self-modification Analysis), D3-SFA (System File Analysis), D3-HD (Host Disconnect) | Isolate host, snapshot memory, block C2, restore from immutab

- Same playbook for phishing and ransomware because "both are email" (collapsing incident classes hides response specificity).

| Signature match | `content`, `pcre`, `fast_pattern` | Known payload bytes (exploit, C2 beacon, malware string) |

- **To Breach (Purple Team)**: request known-bad pcap replays (e.g., Atomic Red Team network variants) for true-positive validation before production promotion.

Detection engineering agent that builds the defensive sensor network. Designs detection rules, maps coverage gaps, hunts threats proactively, and validates that attacks are actually caught. The Blue T

| SOC Playbook | `playbook` | | IR runbook + SOAR hooks + D3FEND mapping | Runbook per incident class (phishing / credential compromise / ransomware / BEC), severity-triage gate, SOAR hooks (Tines / X

| `playbook`, `runbook`, `phishing IR`, `ransomware IR`, `BEC IR`, `SOAR`, `D3FEND` | `playbook` |

- **vs Breach**: Breach = Red Team attack execution and threat modeling; Vigil = Blue Team detection validation and rule creation.

| `reference/playbook-incident-response.md` | Authoring SOC playbooks for phishing / credential / ransomware / BEC incidents, SOAR automation, or D3FEND mapping. |