Implementing a Purple Teaming Function

Introduction

In Part III of the book, we focus on organizing exercises and establishing a purple teaming function in your organization. In this first chapter we consider effective methods for reporting and tracking your emulation activities, whether that be via spreadsheet, ticketing system or a purpose-built platform like SRA’s VECTR.

Chapter Content

This section provides reproductions of the key figures and code snippets seen in this chapter.

Maturing Your Purple Team Processes

Attack Automation

Development Considerations

A command that leverages the procdump.exe LOLBIN to load an arbitrary DLL.

C:\Tools> procdump.exe -md malware.dll foobar

Alert Regression Testing

A Continuous Purple Teaming Cycle

Resources

The following resources expand on topics covered in this chapter.

Attack Automation

A Continuous Purple Teaming Cycle