A security team wants to validate that their EDR solution would detect a common lateral movement technique (pass-the-hash). Which testing methodology is most appropriate?
Select an answer to reveal the explanation.
Short Explanation
You want a purple team exercise because it uses real pass-the-hash techniques in a controlled environment, shows whether the EDR actually alerts, and gives you gaps to tune. Waiting for a real attack doesn't give you a safe, measurable test.
Full Explanation
The purple team exercise is correct because it directly validates EDR detection in the actual environment using real attack techniques, identifies gaps between what should be detected and what is, and produces tuning actions — all without waiting for a real attacker. In this approach, the red team performs pass-the-hash using mimikatz or impacket in a controlled lab or isolated production segment while the blue team monitors for EDR alerts, then both teams jointly analyze detection gaps and tune rules accordingly. Waiting for a real attack to occur is wrong because it provides no opportunity for controlled measurement or preparation. Disabling the EDR and running the technique is wrong because it provides no information about detection capability. Asking the EDR vendor if their product detects pass-the-hash is wrong because vendor claims about detection capability do not validate that the specific deployment, configuration, and log pipeline work correctly in the customer's environment.