PURPLE TEAM EXERCISE IDEA QUEUE🎡 - Link
📽️🍿PURPLE TEAM YOUTUBE PLAYLIST🍫🍬 - Link
📻SPOTIFY PLAYLIST🎶🎶🎶 - Link
Data breaches and cybersecurity incidents continue to impact businesses despite the proliferation of cybersecurity solutions and increased cybersecurity spending over the past decade. The continually evolving threat landscape requires the inclusion of proactive cybersecurity strategies to decrease attacker dwell time on organizations’ networks and improve the cybersecurity posture. A strategy gaining popularity is purple teaming, which refers to multiple cybersecurity teams working together to improve an organization’s security posture from a high-level perspective. This study revealed that the high-level enterprise purple teaming definition is cyber threat intelligence-led offensive operations that improve an organization’s security posture, foster collaboration between multiple teams, provide skill building and learning opportunities, and produce detections or additional knowledge about an organization's defensive posture. Many cybersecurity leaders are beginning to implement purple teaming in their security operations centers to prepare their cybersecurity teams, foster collaboration within the organization, test its people, process, and technology (PPT) framework, and progressively track its defenses in attempts to improve its security posture.
- Atomic Purple Team by Defensive Origins - Link
- TALK: Atomic Purple Team Framework and Life Cycle with Kent Ickler & Jordan Drysdale - Link
- Purple Team Exercise Framework (PTEF) by SCYTHE - Link
- WORKSHOP: Purple Team Exercise Framework (PTEF) Workshop with Jorge Orchilles - Link
- Adversary Emulation Plan Library by SCYTHE - Link
- Adversary Emulation Repo by CyberSecurityUP - Link
- APT & Cybercriminal Campaign Threat Report Collection by CyberMonitor - Link
- ATT&CK Procedures by Prelude - Link
- ATT&CK Security Stack Mappings - Azure (AWS in progress) by The Center for Threat-Informed Defense - Link
- ATT&CK Workbench by The Center for Threat-Informed Defense - Link
- BLOG: ATT&CK Workbench: A Tool for Extending ATT&CK by Jon Baker and Isabel Tuson - Link
- DEMO: ATT&CK Workbench - Link
- C2 Matrix by Jorge Orchilles, Bryson Bort & Adam Mashinchi - Link
- CTI Resources Repo - Link
- DeTT&CT by Marcus Bakker @bakk3rm and Ruben Bouman @rubinatorz - Link
- MITRE ATT&CK - Link
- MITRE CAR - Cyber Analytics Repository - Link
- MITRE D3FEND - Link
- MITRE ENGENUITY - ATT&CK Evaluations - Link
- MITRE SHIELD - Link
- MITRE ATT&CK Navigator - Link
- NIST Cybersecurity Framework, MITRE ATT&CK v8.2, & CIS Controls v8 CSV (Mappings Compliments of CIS - Center for Internet Security) - Link
- NIST 800-53 Mapping to MITRE ATT&CK by The Center for Threat-Informed Defense - Link
- Purple Team Docs by Ben Goerz - Link
- TALK: Purple Team Summit 2020 - The 1-Hour Purple Team Exercise - Ben Goerz - Link
- Purple Teaming on Reddit r/purpleteamsec - Link
- RE&CT - Link
- TWEET: Atomic Threat Coverage @atc_project - Link
- Red Team Resources Repo. Contributors: @bigb0ss, @T145, @threat-punter - Link
- Sigma Rules Repository - Link
- SpecterOps Blog - Link
- The DFIR Report - Link
- Threat Thursday Blog by SCYTHE - Link
- YARA Rules Resource - Link
- Antisyphon InfoSec Training - Some Purple Team related offerings - Cost: "Pay What You Can" 💲 - Link
- Applied Purple Teaming - Infrastructure, Threat Optics, and Continuous Improvement by Defensive Origins - Cost: FREE & 💲 - Link
- TRAINING: Applied Purple Teaming - How to Build a Purple Team Lab with Kent Ickler & Jordan Drysdale by Defensive Origins - Link
- Blue Team Training Toolkit - Cost: FREE & 💲 - Link
- BOSS of the SOC v3 by Splunk - Ryan Kovar, David Herrald, James Brodsky, John Stoner, Jim Apger, David Veuve, Lily Lee, and Matt Valites - Cost: FREE - Link
- DarkSide Ops 1 & 2 Training - Malware Dev & Adversary Simulation by Netspi - Cost: 💲 - Link
- Dark Vortex Training - Cost: 💲 - Link
- Hands-On Purple Team Workshop with Tim Schulz by SCYTHE - Cost: FREE - Link
- MITRE ATT&CK Training on Cybrary - Cost: FREE - Link
- Pink Badge Training Program by Prelude - Cost: FREE - Link
- Purple Academy by Picus Security - Cost: FREE - Link
- Purple Teaming: The Big Picture by Cristian Pascariu on Pluralsight - Cost: 💲 - Link
- Purple Teaming Training by AttackIQ - Cost: FREE - Link
- Red Team Operator Malware Development Courses by Sektor7 Institute- Cost: 💲 - Link
- SEC564: Red Team Exercises and Adversary Emulation by SANS Institute - Cost: 💲 - Link
- SEC599: Defeating Advanced Adversaries - Purple Team Tactics & Kill Chain Defenses by SANS Institute - Cost: 💲 - Link
- SEC699: Purple Team Tactics - Adversary Emulaiton for Breach Prevention & Detection by SANS Institute - Cost: 💲 - Link
- SpecterOps Training - Cost: 💲 - Link
- Weaponising C# - Fundamentals Training by Faith Ozavci @fozavci - Cost: FREE - Link
- Zero Point Security Training - Cost: 💲 - Link
- Applied Purple Teaming Threat Optics Lab - Azure TerraForm by Defensive Origins - Link
- APT-Hunter by Ahmed Khlief - Link
- APTSimulator by Nextron Systems GmbH - Link
- Atomic Operator by Josh Rickard @MSAdministrator of Swimlane - Link
- Atomic Red Team by Red Canary - Link
- Atomic Red Team wrapper script by Phage-nz - Link
- ATTACK Datamap by Olaf Hartong - GitHub Link & Article Link
- Attack Range by Splunk - Link
- TALK: Purple Team Summit 2020 - Adversarial Emulation using Splunk Attack Range Local by Rod Soto and d1vious (Jose Hernandez) - Link
- Attack Simulator - Office 365 by Microsoft - Link
- Attack Surface Analyzer by Microsoft - Link
- Attack2Jira by Mauricio Velazco and Olindo Verrillo - Link
- AutoTTP by Jym Cheong - Link
- BeaconHunter by Andrew Oliveau @AndrewOliveau - Link
- BlueCloud by iknowjason - Link
- Caldera by MITRE - Link
- Detection Lab by Chris Long - Link
- DumpsterFire by TryCatchHCF - Link
- Empire by BC Security - Link
- BLOG: Overview of Empire 4.0 and C# by BC Security - Link
- Emulate.GO by Haydn Johnson - Link
- TALK: DEF CON Red Team Village - Indicators of Emulation: Extra Spicy Adversary Emulation - Ch33r10 (Xena Olsen) and haydnjohnson (Haydn Johnson) - Link
- Infection Monkey by Guardicore - Link
- Invoke-Adversary by CyberMonitor - Link
- MAL-CL by 3CORESec, Nasreddine Bencherchali @nas_bench and Tiago Faria @0xtf - Malicious Command-Line collection - Link
- Meerkat by Tony Phipps - Link
- Metasploit by Rapid7 - Link
- Metta Adversarial Simulation by Uber - Link
- Operator by Prelude - Link
- BLOG: Purple is the New Red by David Hunt - Link
- PlumHound - BloodHoundAD Report Engine for Blue and Purple Teams - Link
- Pneuma by Prelude - A cross-platform GoLang agent that connects to Operator and executes attacks - Link
- Purple AD - Active Directory Purple Team Playbook by Mauricio Velazco - Link
- Purple Power by Jean-Francois Maes - An experimental defense evasion tool - Link
- Venkman by Randy Pargman - An experimental .Net Windows application that helps defenders detect when an attacker might be muting or blocking event logs on an endpoint - Link
- TALK: Texas Cyber Summit 2021 - Busting the Ghost in the Logs by Randy Pargman and Jean-Francois Maes - Link
- Purple Sharp by Mauricio Velazco - Link
- BLOG: Sharpen Your Simulation Game by Mauricio Velazco - Link
- TALK: BlackHat USA Arsenal 2020 - PurpleSharp: Adversary Simulation for the Blue Team by Mauricio Velazco - Link
- TALK: DEF CON Blue Team Village - Purple On My Mind with Olaf Hartong & Mauricio Velazco - Link
- Purple Team ATT&CK Automation by Praetorian - Link
- DEMO: Getting Started with Purple Team ATT&CK Automation - Link
- pyattack by Josh Rickard @MSAdministrator of Swimlane - Link
- Racketeer Project - Ransomware Simulation Toolkit by dsnezhkov & gitter-badger - Link
- Red Team Attack Lab by Marshall-Hallenbeck - Link
- Red Team Automation (RTA) by Olaf Hartong and Nihlander - Link
- RE:TERNAL by d3vzer0 (Joey Dreijer), Olaf Hartong, and Yaleesa - Link
- Slingshot C2 Matrix Edition VM with C2s Pre-Installed + VECTR by SANS Institute - Link
- DEMO: C2 Matrix VM Walkthru with Jorge Orchilles - Link
- Unfetter by NSA - Link
- VECTR by Security Risk Advisors - Link
- TALK: Red Team Exercise Closure and Showing Value with VECTR with Jorge Orchilles - Link
- TALK RESOURCES: Adversarial Threat Modeling - A Practical Approach to Purple Teaming in the Enterprise by Sajid Nawaz Khan @snkhan - Link
- ATTACKIQ - Link
- BlindSpot - Link
- Cymulate - Link
- Pentera - Link
- PlexTrac - Link
- RELIAQUEST - Link
- SafeBreach - Link
- SCYTHE - Link
- SNAPATTACK by Booz Allen Hamilton - Link
- Verodin by Mandiant - Link
- XM CYBER - Link
-
Thank you to the participants that made this research possible! <3
Credit belongs to the original authors and publishers.