Intro

Introduction

Purple teaming is a security methodology in which red and blue teams work closely together to maximize cyber capabilities through continuous feedback and knowledge transfer.

Purple teaming can help security teams to improve the effectiveness of vulnerability detection, threat hunting, and network monitoring by accurately simulating common threat scenarios and facilitating the creation of new techniques designed to prevent and detect new types of threats.

In every Purple Team there should be at least one:

• Red Team member which will run Tactics, Techniques, and Procedures (TTPs),

• Blue Team member who will identify and eradicate attacks of Red Team.

Red Team

Responsible for emulating TTPs to test people, processes, and information assets.

The goal of the team is to make the Blue team better by training and measure whether blue team’s detection and response policies, procedures, and technologies are effective.

Blue Team

They are the defenders, entrusted with identifying and remediating attacks and are generally associated with Security Operations Center or Managed Security Service Provider (MSSP), Hunt Team, Incident Response, and Digital Forensics.

The goal of the team is to identify, contain and eradicate attacks.

Goals & Objectives

Our goal for doing the Purple Team exercise is:

• Test attack chains against Organizations.

• Test TTPs that have not been tested yet in Company.

• Filling the gaps between teams in terms of security.

• Preparation for a zero-knowledge Red Team Engagement.

Purple Team Exercise Framework

Methodology Description

The following framework (PTEF), created by industry experts (ref 1) , will be used during our purple team exercises at Organization, more explanation on each step can be found below.

Cyber Threat Intelligence

(Decide Where and Decide Which TTPs )

Cyber Threat Intelligence(CTI) is a team/group of people that research and provide adversary tactics, techniques, and procedures (TTPs) about a threat to an organization.

CTI is the first reason that Purple Team Programs are of high value. While a Red Team can try thousands of methods to reach an objective, a Purple Team will focus on the methods, tradecraft, and TTPs that are most likely to impact the organization.

In this phase, attendees will try to focus on which Mitre Att&ck TTPs can be used during the exercise. The phase should give answers on which infrastructure the exercises will be and which TTPs will be run during the exercise.

Plan a meeting on this phase for 1 or 1,5 hours by trying to answer questions:

• Where will the exercise be?

• Which TTPs we can implement on these platforms?

This phase will help to form a detailed preliminary picture of the entity and its weak points from the attacker’s perspective. This will enable the Cyber Threat Intelligence to be put into context and will contribute to the development of the attack chains or attack scenarios to be used in the Purple Team Exercise.

Preparation

(How?)

The amount of meetings in this phase is directly correlated with TTPs' volume. The number of meetings is flexible.

Some of the must-have meetings are

• Pitch: First planning meeting, can be seen as a pitch of the exercise and purple team program. The meeting should introduce the concept of Purple Teaming, present the goals and objectives, and share this methodology

• Planning meeting 1-x: Once the exercise is accepted, several meetings can have place with respective stakeholders to ensure all actions are completed before the final meeting. This may include but is not limited to:

  • Exercise Coordinator(s)

    • Ensuring physical location has met all the requirements including but not limited to power, connectivity to all systems (attack and defend infrastructure), A/C, etc.

    • Determine if tabletop discussions will occur before the exercise or the day of the exercise.

  • After the CTI meeting, Red Team Preparation and decide/presents Tools for the exercise.

  • Setup at least 2 systems to show attack activity.

  • Ensure Attack Infrastructure is fully functional.

  • Ensure Target Systems are accessible.

  • Document all commands required to emulate TTPs in a playbook.

  • Test TTPs before exercise on different hosts than the exercise hosts but that is configured exactly alike similarly.

  • Blue Team Preparation and decide/present Tools for the exercise

  • Validate security tools are reporting to production security tools from the target systems.

  • Ensure attack infrastructure is accessible through proxy/outbound controls.

  • Work with Red Team as payloads and C2 are tested before exercise on non-exercise systems.

  • Ensure the correct forensic tools are deployed on the target systems, if applies.

  • Install Live Forensic Tools for efficiency during Purple Team Exercise, if applies.

• Final meeting: Exercise Coordinator would lead the meeting and go over each action item assigned in previous meetings validating they are completed.

Metrics

Purple Team Exercises focus on Tactics, Techniques, and Procedures (TTPs) that do not follow the traditional vulnerability management metrics. A TTP, unlike a vulnerability, is not open or closed. It cannot be easily remediated by applying a patch. These are some of the metrics that may be discussed and agreed upon prior to the exercise:

• Data Sources

  • Logging events locally

  • Logging events centrally

• Detection

  • Alerts

  • Telemetry

  • Indicator of Compromise

  • General Behavior

  • Specific Behavior

• Response

  • Time to Detect

  • Time to Investigate

  • Time to Remediate

DETT&CT tool can be used.

Execution

(Kick Off)

1. Exercise Coordinator or Cyber Threat Intelligence analysts presents the TTPs, and technical details. This can be a series of slides that introduce the adversary, previous targets, known behaviors, tools, attack vectors leveraged, and the tactics, techniques, and procedures.

2. Red Team executes the TTP while sharing the screen and providing all indicators of compromise and behaviors:

   • Provide attacker IP

   • Provide target

   • Provide exact time

   • Shows the attack to attendees

3. Blue Team will follow standard process to identify evidence of TTP. Time should be monitored to meet expectations and move exercise along. Exercise Coordinator should share screen if TTP was identified due to alerts, threat hunting for logs, or any other evidence. Metrics should be taken and documented.

4. Document any output, action items, or notes for the TTP.

5. Repeat for next TTP.

Most purple team exercises can be between 1 - 5 days.

To keep track on TTPs during the exercise, the following table is useful to be used.

Tactic	Technique	Procedure	CTI Reference
Description	Technique/SubTechnique or Mittre Att&ck ID
Reconnaissance	Active Scanning/Scanning IP Blocks ID: T1595.002	It could be attached to an APT or it can be generic.
Initial Access	Phishing/Spearphishing Attachment ID: T1566.001	It could be attached to an APT or it can be generic.
….	….

VECTR tool can be used as well.

Lessons Learned

Exercise Coordinators are responsible for taking minutes, notes, action items, and attendee/sponsor feedback. The Exercise Coordinators are also responsible for the creation of a Lessons Learned document (Report) following each exercise.

For the Purple Team Exercise itself, feedback requests should be sent to all attendees on the last day of the Purple Team Exercise to obtain immediate feedback while it is fresh on attendees’ minds.

In that phase, we should schedule a meeting, talk and decide on the following questions.

• Which of TTPs did we execute?

• Could we detect them?

• If not, how we can detect and how we can improve the current situation.

• When and where will be the next exercise.

Roles and Responsibilities

Title	Role	Responsibility
CISO/CTO/Security Team Lead	Sponsor/Attendee	Approve Purple Team Exercise
SOC Team Manager	Sponsor/Attendee	Preparation: Defining goals for both Red and Blue teams, Select Attendees
Red Team	Attendee	Coordinating TTPs during the Cyber Threat Intelligence phase, Preparation, Execution
Blue Team - SOC	Attendee	Coordinating TTPs during the Cyber Threat Intelligence phase, Preparation, Execution

Tools in Purple Team Exercise

Red Team Tools

The red Team should decide which tools are more appropriate for the exercise.

The C2 matrix can be used for that The C2 Matrix.

Blue Team Tools

https://github.com/rabobank-cdc/DeTTECT

Documentation

https://docs.vectr.io/

Reference

1. https://github.com/scythe-io/purple-team-exercise-framework/blob/master/PTEFv2.md

2. The C2 Matrix
3. What is Purple Teaming? How Can it Strengthen Your Security? | Redscan
4. Ethical Hacking Definitions