Microsoft SentinelTechnique-level evidence of what you detect and what you do not
Operators / 03
Adversary Emulation
The attacks that matter, replayed with precision.
Detected4 of 7
Gaps3
Mean alert9 m
Techniques
MITRE ATT&CKMicrosoft Sentinel
| Technique | Tactic | Result | Alert |
|---|---|---|---|
| T1566.002Spearphishing link | Initial access | Detected | 4 m |
| T1133External remote services | Initial access | Missed | None |
| T1078Valid accounts | Persistence | Detected | 15 m |
| T1110.003Password spraying | Credential access | Detected | 11 m |
RS
Detected4 of 7
Gaps3
Mean alert9 m
Techniques
MITRE ATT&CKMicrosoft Sentinel
| Technique | Tactic | Result | Alert |
|---|---|---|---|
| T1566.002Spearphishing link | Initial access | Detected | 4 m |
| T1133External remote services | Initial access | Missed | None |
| T1078Valid accounts | Persistence | Detected | 15 m |
| T1110.003Password spraying | Credential access | Detected | 11 m |
| T1087.002Domain account discovery | Discovery | Missed | None |
Overview
We take the threat actors most likely to target you and reproduce their tradecraft step by step, mapped to MITRE ATT&CK, against your live defences, with Pursuit doing the running and operators doing the thinking. You learn exactly what they would see, what you would miss, and what to fix first.
What we do
- 01
Threat-actor profiling and scenario design
- 02
ATT&CK-mapped emulation plans
- 03
Detection engineering validation
- 04
Control and telemetry testing
- 05
Collaborative purple-team execution
How an engagement runs
PhaseLands inStateWhen
- 01IntelligenceActor techniques for your sectorDone29 Sep
- 02Scenario designPlan · 7 ATT&CK techniquesDone3 Oct
- 03ExecutionOP-191 · run by Pursuit with AKDone14 to 17 Oct
- 04MeasurementTechniques · 4 of 7 detectedDone17 Oct
- 05Hardening3 detection gaps routed · retestRunningThis week
What you get
01 02 A ranked list of detection gaps with the fixes
03 Confidence that your controls work against the adversaries that matter