Security teams routinely assume that known techniques are covered. This workshop interrogates that assumption through a structured purple team exercise conducted in an active lab environment. Participants will systematically execute the same adversarial techniques across multiple implementation variants, observing how subtle changes in execution method produce dramatically different telemetry, alter detection fidelity, and expose blind spots in EDR and SIEM tooling.

The workshop emphasizes stealthy execution tradecraft as a variable rather than a constant, treating each implementation as a testable hypothesis about defender visibility. Attendees will build detections, hunt across collected telemetry, and leave with guidance for evaluating detection coverage against technique variance in their own environments.

1. Introductions
2. Looking at existing detection rules
- Out-of-the-box EDR detections
- Public SIGMA rules
- Custom rules seen in client environments
3. Discussion of execution variants
- What is a "technique"
- How we can perform a technique while reducing potential indicators of attack
4. Hands-On Workshop
- Participants will see several execution variants across common TTPs in a lab environment
- Participants will observe the difference in response and perform basic threat hunts to identify the attacks
- Participants will tune existing rules to cover missed variants
5. Take-aways / Questions