EnterprisePurpleTeaming - Purple Team Resources for Enterprise Purple Teamin

项目说明

![EnterprisePurpleTeaming header]()

<p align='center'>
<a href=" height="30" src="
<a href=" height="30" src="
</p>
<h3 align="center">ENTERPRISE PURPLE TEAMING: AN EXPLORATORY QUALITATI - <a href="
<p><h3 align="center"><b>ABSTRACT</b></h3></p>
<p align="left">Data breaches and cybersecurity incidents continue to impact businesses despite the proliferation of cybersecurity solutions and increased cybersecurity spending over the past decade. The continually e threat landscape requires proacti strategies to decrease attacker dwell time on organizations’ networks and improve the cybersecurity posture. A strategy gaining popularity is purple teaming, which refers to multiple cybersecurity teams working together to improve an organization’s security posture from a high-le. This study re that the high-le purple teaming definition is cyber threat intelligence-led offensi that improve an organization’s security posture, foster collaboration between multiple teams, provide skill building and learning opportunities, and produce detections or additional knowledge about an organization's defensi. Many cybersecurity leaders are beginning to implement purple teaming in their security operations centers to prepare their cybersecurity teams, foster collaboration within the organization, test its people, process, and technology (PPT) framework, and progressively track its defenses in attempts to improve its security posture.
</p>
<p><h1 align="left">🍉<b>DISSERTATION EXTRAS</b></h1></p>
<ul>
<li><b>Extra Interview📽️</li></b>
<ul><li>Purple Team Perspectives with Michael Raggi - <a href="
<b><li>Open Source Contribution🏖️</li></b>
<ul><li>Field Classifications Contribution for Attack2Jira by Mauricio and Olindo - <a href="
<b><li>Practitioner Summary🍹</li></b>
<ul><li>Enterprise Purple Teaming: An Exploratory Qualitati - Pracitioner Summary - <a href="
<b><li>Purple Team Exercise Idea Queue🌴</b> - <a href="
<b><li>Resource for NIST Cybersecurity Framework💋</li></b>
<ul><li>NIST Cybersecurity Framework, MITRE ATT&CK v8.2, & CIS Controls v8 CS Compliments of <a href=" - Center for Internet Security) - <a href="
<b><li>Spotify Playlist🎶</b> - <a href="
<b><li>YouTube Purple Team Playlist🍿</b> - <a href="
</ul>
<p><h1 align="left">✨<b>PURPLE TEAM FRAMEWORKS</b></h1></p>
<ul>
<li>Atomic Purple Team by Defensi - <a href="
<ul><li>TALK: Atomic Purple Team Framework and Life Cycle with Kent Ickler & Jordan Drysdale - <a href="
<li>Purple Team Exercise Framework (PTEF) by SCYTHE - <a href="
<ul><li>WORKSHOP: Purple Team Exercise Framework (PTEF) Workshop with Jorge Orchilles - <a href="
</ul>
<b></b>
<p><h1 align="left">🔖<b>PRACTITIONER RESOURCES</b></h1></p>
<ul>
<li>Ad Emulation Plan Library by SCYTHE - <a href="
<li>Ad Emulation Repo by CyberSecurityUP - <a href="
<li>APT & Cybercriminal Campaign Threat Report Collection by CyberMonitor - <a href="
<li>ATT&CK Flow by The Center for Threat-Informed Defense - <a href="
<ul><li>flow by DBIR Team (Includes an Attack Flow Schema in JSON and a python class to convert attack flow records between json-schema and json-Id attack flow) - <a href="
<li>ATT&CK Procedures by Prelude - <a href="
<li>ATT&CK Security Stack Mappings - Azure (AWS in progress) by The Center for Threat-Informed Defense - <a href="
<li>ATT&CK Workbench by The Center for Threat-Informed Defense - <a href="
<ul><li>BLOG: ATT&CK Workbench: A Tool for Extending ATT&CK by Jon Baker and Isabel Tuson - <a href="
<ul><li>DEMO: ATT&CK Workbench - <a href="
<li>C2 Matrix by Jorge Orchilles, Bryson Bort & Adam Mashinchi - <a href="
<li>Control Compass by - <a href="
<li>CTI Resources Repo - <a href="
<li>DeTT&CT by Marcus Bakker and Ruben Bouman - <a href="
<li>MITRE ATT&CK - <a href="
<li>MITRE CAR - Cyber Analytics Repository - <a href="
<li>MITRE D3FEND - <a href="
<li>MITRE ENGENUITY - ATT&CK E - <a href="
<li>MITRE SHIELD - <a href="
<li>MITRE ATT&CK Na - <a href="
<li>NIST 800-53 Mapping to MITRE ATT&CK by The Center for Threat-Informed Defense - <a href="
<li>Purple Team Docs by Ben Goerz - <a href="
<ul><li>TALK: Purple Team Summit 2020 - The 1-Hour Purple Team Exercise - Ben Goerz - <a href="
<li>Purple Teaming on Reddit r/purpleteamsec - <a href="
<li>RE&CT - <a href="
<ul><li>TWEET: Atomic Threat Co <a href=" - <a href="
<li>Red Team Resources Repo. Contributors: , , -punter - <a href="
<li>SANS Offensi Poster - Purple Concepts: Bridging the Gap - <a href="
<li>Sigma Rules Repository - <a href="
<li>SpecterOps Blog - <a href="
<li>TIBER-EU Purple Teaming Best Practices - <a href="
<li>The DFIR Report - <a href="
<li>Threat Thursday Blog by SCYTHE - <a href="
<li>YARA Rules Resource - <a href="
</ul>
<b></b>
<p><h1 align="left">🏋️<b>TRAINING</b></h1></p>
<ul>
<li>Antisyphon InfoSec Training - Some Purple Team related offerings - Cost: "Pay What You Can" 💲 - <a href="
<li>Applied Purple Teaming - Infrastructure, Threat Optics, and Continuous Impro by Defensi - Cost: FREE & 💲 - <a href="
<ul><li>TRAINING: Applied Purple Teaming - How to Build a Purple Team Lab with Kent Ickler & Jordan Drysdale by Defensi - <a href="
<li>Blue Team Training Toolkit - Cost: FREE & 💲 - <a href="
<li>BOSS of the SOC v3 by Splunk - Ryan Kovar, Da, James Brodsky, John Stoner, Jim Apger, Da, Lily Lee, and Matt - Cost: FREE - <a href="
<li>DarkSide Ops 1 & 2 Training - Malware Dev & Ad Simulation by Netspi - Cost: 💲 - <a href="
<li>Dark Training - Cost: 💲 - <a href="
<li>Hands-On Purple Team Workshop with Tim Schulz by SCYTHE - Cost: FREE - <a href="
<li>MITRE ATT&CK Training on Cybrary - Cost: FREE - <a href="
<li>Pink Badge Training Program by Prelude - Cost: FREE - <a href="
<li>Purple Academy by Picus Security - Cost: FREE - <a href="
<li>Purple Teaming: The Big Picture by Cristian Pascariu on Pluralsight - Cost: 💲 - <a href="
<li>Purple Teaming Training by AttackIQ - Cost: FREE - <a href="
<li>Red Team Operator Malware De Courses by Sektor7 Institute- Cost: 💲 - <a href="
<li>SEC564: Red Team Exercises and Ad Emulation by SANS Institute - Cost: 💲 - <a href="
<li>SEC599: Defeating Ad Ad - Purple Team Tactics & Kill Chain Defenses by SANS Institute - Cost: 💲 - <a href="
<li>SEC699: Purple Team Tactics - Ad Emulaiton for Breach Pre & Detection by SANS Institute - Cost: 💲 - <a href="
<li>SpecterOps Training - Cost: 💲 - <a href="
<li>Weaponising C# - Fundamentals Training by Faith Ozavci - Cost: FREE - <a href="
<li>Zero Point Security Training - Cost: 💲 - <a href="
</ul>
<b></b>
<p><h1 align="left">🛠️<b>PURPLE TEAM FREE-ISH TOOLS</b></h1></p>
<ul>
<li>Applied Purple Teaming Threat Optics Lab - Azure TerraForm by Defensi - <a href="
<li>APT-Hunter by Ahmed Khlief - <a href="
<li>APTSimulator by Nextron Systems GmbH - <a href="
<li>Atomic Operator by Josh Rickard of Swimlane - <a href="
<li>Atomic Red Team by Red Canary - <a href="
<li>Atomic Red Team wrapper script by Phage-nz - <a href="
<li>ATTACKIFY - <a href="
<li>Stratus Red Team by Datadog - <a href="
<li>ATTACK Datamap by Olaf Hartong - <a href=" Link</a> & <a href=" Link</a></li>
<li>Attack Range by Splunk - <a href="
<ul><li>TALK: Purple Team Summit 2020 - Ad Emulation using Splunk Attack Range Local by Rod Soto and d1vious (Jose Hernandez) - <a href="
<li>Attack Simulator - Office 365 by Microsoft - <a href="
<li>Attack Surface Analyzer by Microsoft - <a href="
<li>Attack2Jira by Mauricio and Olindo - <a href="
<li>AutoTTP by Jym Cheong - <a href="
<li>BeaconHunter by Andrew Oliveau - <a href="
<li>BlueCloud by iknowjason - <a href="
<li>Caldera by MITRE - <a href="
<li>Detection Lab by Chris Long - <a href="
<li>DumpsterFire by TryCatchHCF - <a href="
<li>Empire by BC Security - <a href="
<ul><li>BLOG: O of Empire 4.0 and C# by BC Security - <a href="
<li>Emulate.GO by Haydn Johnson - <a href="
<ul><li>TALK: DEF CON Red Team - Indicators of Emulation: Extra Spicy Ad Emulation - Ch33r10 (Xena Olsen) and haydnjohnson (Haydn Johnson) - <a href="
<li>ezEmu by Jamie Williams - <a href="
<li>Infection Monkey by Guardicore - <a href="
<li>In by CyberMonitor - <a href="
<li>Kali-Purple - Community Project - <a href="
<li>MAL-CL by 3CORESec, Nasreddine Bencherchali and Tiago Faria @0xtf - Malicious Command-Line collection - <a href="
<li>Meerkat by Tony Phipps - <a href="
<li>Metasploit by Rapid7 - <a href="
<li>Metta Ad Simulation by Uber - <a href="
<li>Operator by Prelude - <a href="
<ul><li>BLOG: Purple is the New Red by David Hunt - <a href="
<li>PlumHound - BloodHoundAD Report Engine for Blue and Purple Teams - <a href="
<li>Pneuma by Prelude - A cross-platform GoLang agent that connects to Operator and executes attacks - <a href="
<li>Purple AD - Acti Purple Team Playbook by Mauricio - <a href="
<li>Purple Power by Jean-Francois Maes - An experimental defense e tool - <a href="
<ul><li> by Randy Pargman - An experimental .Net Windows application that helps defenders detect when an attacker might be muting or blocking event logs on an endpoint - <a href="
<ul><li>TALK: Texas Cyber Summit 2021 - Busting the Ghost in the Logs by Randy Pargman and Jean-Francois Maes - <a href="
<li>Purple Sharp by Mauricio - <a href="
<ul><li>BLOG: Sharpen Your Simulation Game by Mauricio - <a href="
<ul><li>TALK: BlackHat USA Arsenal 2020 - PurpleSharp: Ad Simulation for the Blue Team by Mauricio - <a href="
<ul><li>TALK: DEF CON Blue Team - Purple On My Mind with Olaf Hartong & Mauricio - <a href="
<li>Purple Team ATT&CK Automation by Praetorian - <a href="
<ul><li>DEMO: Getting Started with Purple Team ATT&CK Automation - <a href="
<li>pyattack by Josh Rickard of Swimlane - <a href="
<li>Racketeer Project - Ransomware Simulation Toolkit by dsnezhkov & gitter-badger - <a href="
<li>Red Team Attack Lab by Marshall-Hallenbeck - <a href="
<li>Red Team Automation (RTA) by Olaf Hartong and Nihlander - <a href="
<li>RE:TERNAL by d3vzer0 (Joey Dreijer), Olaf Hartong, and Yaleesa - <a href="
<li>Slingshot C2 Matrix Edition VM with C2s Pre-Installed + VECTR by SANS Institute - <a href="
<ul><li>DEMO: C2 Matrix with Jorge Orchilles - <a href="
<li>Unfetter by NSA - <a href="
<li>VECTR by Security Risk Ad - <a href="
<ul><li>TALK: Red Team Exercise Closure and Showing Value with VECTR with Jorge Orchilles - <a href="
<ul><li>TALK RESOURCES: Ad Threat Modeling - A Practical Approach to Purple Teaming in the Enterprise by Sajid Nawaz Khan - <a href="
</ul>
<b></b>
<p><h1 align="left">🍭<b>PURPLE TEAM COMMERCIAL TOOLS</b></h1></p>
<ul>
<li>ATTACKIFY - <a href="
<li>ATTACKIQ - <a href="
<li>BlindSpot - <a href="
<li>Cymulate - <a href="
<li>Pentera - <a href="
<li>PlexTrac - <a href="
<li>RELIAQUEST - <a href="
<li>SafeBreach - <a href="
<li>SCYTHE - <a href="
<li>SNAPATTACK - <a href="
<li> by Mandiant - <a href="
<li>XM CYBER - <a href="
</ul>
<b></b>
<p><h1 align="left">💎<b>THANK YOU</b></h1></p>
<ul>
A HUGE <b>THANK YOU</b> to the participants that made this research possible! <3
<p></p>
Special thanks to Dr. Donna Schaeffer, Dr. Andrew Hall, Dr. Alex Mbaziira, Dr. Chelsea Hicks, and Dr. Sean Zadig. Also, <b>THANK YOU</b> to Bassem Helmy, Ben Goerz, Bryson Bort, D. Muran-de Assereto, Joe Schottman, Jorge Orchilles, Michael Kearn, Michael A. Raggi, Micah Brown, Nikolas Loukas, and Stephen Deutsch.
<p></p>
Credit belongs to the original authors and publishers.

</ul>
<b></b>
<hr></hr>
<h6 align="center"><small>FOR THE LAWYERS</small></h6>
<h6 align="center">_{"The opinions expressed in this Github repo are those of the indi account, in their indi capacity, and not necessarily those of the employers. Mention of any , services, products, or otherwise does not endorse them as a . This content and any related discussions are solely the views, opinions, and experiences of the participants and should not be presumed to reflect the opinion or the official position of any employers of the participants. Examples and views provided herein, including strategies, goals, targets, and indicators are for illustrati only and should not be regarded as representative of the participants' employers or respecti. To the extent that this participation, discussion, and interview outlines a general technology direction, the participants' employers have no obligation to pursue any such approach or to develop or use any functionality mentioned herein. Any suggested technology strategy or possible future de are subject to change at the employers' sole discretion without notice. Content in this presentation is the intellectual property of the applicable creators and may be protected under the copyright laws of the United States and/or other countries. All trademarks are the property of their respecti and are used for informational purposes only."}</h6>

项目信息

开发语言：未知

Star 数：680

技术要点

该项目属于红蓝攻防方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕Purple Team Resources for Enterprise Purple Teaming: An Exploratory Qualitative Study by Xena Olsen.展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。