Hands-on Purple Team Workshop

The workshop opens by explaining purple teaming as a working arrangement between threat intelligence, red team and blue team staff rather than a separate job title. The presenter traces how organizations moved from vulnerability scanning to penetration testing and then to adversary-focused exercises, and shows how a plan built from intelligence on groups that target hospitals gives the exercise its direction.

Attendees then work in an isolated lab with a domain controller, a Windows member server, a Linux host and an attack platform. They build a command and control campaign in SCYTHE, emulate behaviors mapped to MITRE ATT&CK, and switch to the defender role to look for indicators of compromise using Sysmon and Wireshark. Along the way the talk covers exercise roles, preparation steps such as opening a case and confirming that security tools run on target systems, and how to record results during the exercise.

The session closes with lessons learned. Participants are encouraged to document both detected and missed behaviors, make quick tuning changes, and repeat techniques that went unseen. The main takeaway is that a purple team exercise can raise detection coverage through better process and collaboration, without necessarily buying new technology. The lab virtual machines from the event are no longer available.