Enemy Within: Leveraging Purple Teams for Advanced Threat Detection & Prevention

The talk opens with the problem of sudden shifts in the threat landscape, such as a group that began hitting large technology companies in 2022 and left leadership asking whether they had been targeted. The speakers, from a purple team and a threat intelligence function inside a large company, explain that intelligence teams rarely see new actors or fresh exploits coming. Instead they rebuild an adversary's playbook from public incident reports, vendor research, sharing communities and internal tracking, then decide which techniques matter most.

The middle of the talk covers how the two teams work together. Purple teaming is run as an internal consultancy with joint reports, and the speakers introduce TTP Forge, an open-source framework that describes simulated techniques as stackable building blocks. The live demo follows a credential captured through a phishing proxy, a cloud-logging gap that hid API activity for a while, retrieval of a database secret from a cloud secrets manager, persistence on a macOS host, and a database dump. They also report that a broad hunt for the proxy's session pattern returned hundreds of hits, which they narrowed by flagging sources tied to recently registered domains.

The closing section names shared obstacles, including getting management to fund security work, avoiding floods of low-value signal, and translating probabilistic intelligence into concrete detection results. The takeaways are the release of TTP Forge and a companion collection of commodity techniques focused on Linux, cloud and macOS, plus a call for offensive and intelligence staff to work together on realistic testing.