Invisible link to canonical for Microformats

The Basics of Purple Teaming

Introduction

This chapter provides an overview of purple teaming and how it compares to other forms of technical testing. It also explores considerations on whether to establish an internal purple team or procure services from an external vendor. The chapter concludes with technical considerations, including offensive tooling, test environments and progress tracking options.


Chapter Content

This section provides reproductions of the key figures and code snippets seen in this chapter.

Methodology Selection

Figure 1-1: A graph showing where offensive exercise types fit on a scale of technique coverage and attack realism

Resources

The following resources expand on topics covered in this chapter.

Assumed Breach Testing

A report on the compromise of SolarWinds and subsequent large scale supply chain attack by the Russian SVR

Kim Zetter, "The Untold Story of the Boldest Supply-Chain Hack Ever" Wired, May, 2023

Read More
A report from Lily Haw Newman in the early days of the Log4j vulnerability disclosure, highlighting the scale and impact of the security flaw

Lily Hay Newman, "'The Internet Is on Fire'" Wired, December, 2021

Read More

Offensive Tooling

Highlights of Cobalt Strike's featureset, including its customizability and post-exploitation capabilities

"Features", Fortra, accessed January, 2025

Read More
Features of Bishop Fox's Sliver C2 framework, including mTLS communications and compile-time obfuscation

"Sliver", Bishop Fox, accessed January, 2025

Read More
Cody Thomas's Mythic C2 framework, including cross-platform agent support and remarkable extensibility

"Mythic", Cody Thomas, accessed January, 2025

Read More
The Havoc C2 framework, developed by Paul Ungur, with its flagship Demon agent, that includes features like patching of ETW and AMSI via hardware breakpoints and sleep obfuscation

"6. Agent.md", Paul Ungur, accessed January, 2025

Read More