Purple Is the New Red - Providing the Most Value from Offensive Security
summary
Releases the Purple Team Exercise Framework v3 on GitHub and shows an operationalized flow: plan, CTI, emulate TTPs, build detections, deploy, retest, and push to breach‑and‑attack simulation. Uses MITRE ATT&CK mapping, DFIR Report cases, Atomic Red Team tests and common C2 DLLs/ProcDump; cites a real case where detection latency is 17 hours. Tracks improvements with VECTR or commercial PlexTrac and demonstrates an IcedID ISO initial access scenario that is built, detected, tuned, and rerun.
AI-written summary · about
chapters (20)
- 0:00RSAConference 2023
- 1:50T1033 - User Discovery: Jorge Orchilles
- 3:47What is a Purple Team?
- 6:32Offensive Security Maturity Model
- 10:01Start with a Purple Team Exercise (PTX)
- 11:01PTX: CTI for Adversary Emulation
- 12:32TTP Pyramid
- 15:05PTX: Preparation
- 17:56Purple Team Exercise Flow
- 20:15PTX: Lessons Learned and Action Plan
- 21:13Success! What next?
- 23:14Operationalized Purple Team Process
- 28:11New Adversary Behavior/TTP
- 29:18Analyze & Organize the TTPs
- 31:59Emulate TTPs
- 33:24Blue Team Results
- 34:49Detection Engineering
- 36:11Continuous Process
- 36:41Purple Team Maturity Model
- 37:18"Apply" Slide
related talks
39mColorful AppSec - Red, Blue, or Purple?
43mShades of Purple: Getting Started and Making Purple Teaming Possible
52mBuilding the Always-On Purple Team
01mThank you, Chris Peacock, for telling us about his Purple Team 101 training session
49mTraining for Incident Response: The Red, the Blue, and the Ugly
40mFantastic Red-Team Attacks and How to Find Them
38mAdversary Detection Pipelines: Finally Making Your Threat Intel Useful
45mThis is application purple teaming