Evaluación del impacto de un ejercicio experimental de Purple Teaming con simulación de malware en la detección de amenazas en un entorno virtual controlado

Abstract

The current cyber threat landscape is characterized by increasingly stealthy and persistent attacks, where adversaries combine malware with credential theft, social engineering, and abuse of legitimate binaries. This evolution makes early detection difficult for Security Operations Centers (SOCs), particularly when they rely on static signatures or poorly tuned rules. This work evaluates the impact of an experimental Purple Teaming exercise on the detection coverage of a SIEM in a controlled virtual environment. A lab was implemented using Wazuh as the SIEM/XDR platform and an agent-instrumented Windows endpoint, where techniques aligned with the MITRE ATT&CK framework were emulated. The methodology followed a quasi- experimental before/after design, using technique coverage as the main indicator, defined as the percentage of emulated techniques that generate actionable evidence or alerts in the SIEM. The results show improved coverage after engineering adjustments and re-emulation, and are documented using a comparative table and visual evidence in Wazuh.