Red + Blue, How Purple Are You? Identifying Gaps in The Spectrum of Security

Have you heard about Purple Teaming, but you were unsure of exactly what it is? Maybe you've heard it explained as "the red and blue teams working together to improve the organization's security posture." While that may be a good high level description of Purple Teaming as a concept, it lacks a clear direction of how this outcome is achieved. As they say, "The Devil is in the details." At SpecterOps, we believe that a Purple Team exercise is one that leverages an adversarial mindset to evaluate the overall efficacy of security controls, whether they are detective or preventative.
Watch this webinar as we dive into the major questions regarding Purple Team including:
- Why small changes in adversary tradecraft have a profound effect on detectability.
- How to map variations between tools that implement the same technique.
- How to construct a representative sample set of test cases.
You can learn more about our Purple Team Assessments here: specterops.io/...

[@shreyasd6794]

Thankyou

[@sunny_disposition]

Problems I’ve run into as a detection engineer (blue): * red team NOT willing to share their best tradecraft * red team not understanding the challenge of designing detections that are precise enough to be viable * red team drops undetected kill chain and *mic drops*. “We win, gg”. And gets frustrated with the time it takes for blue to come up with a detection and ship / deploy it, analyze early results, deploy allowlisting, and arrive at a detect worth triaging. Some questions for others doing purps out there in the field: * are you purple teaming on your org’s actual network or a testing (and likely much simpler, less noisy) network? * what info / access are you giving red to start with and what is a successful kill chain? Do they get to drop and exec a file on the box or do they have to start with recon / enumerating the attack surface? * Is there a flag that red must exfil, or is the goal to achieve persistence inside the perim, or domain admin?