Operationalized Purple Teaming

The talk picks up after a first purple team exercise and asks what a security program should do next. The speaker argues that purple teaming should become an ongoing process rather than a scheduled event, with cyber threat intelligence, red team and blue team working together as a virtual group. When new threat reporting appears, members from each function analyze it, pull out procedure-level behaviors, map them to MITRE ATT&CK, and check whether the behavior has already been tested.

As a worked example, the speaker uses a public ransomware intrusion report describing a phishing email that linked to a OneDrive-hosted archive containing an ISO with a shortcut and a DLL. The notable new element was the ISO container, which can bypass mark-of-the-web controls because ISO files do not support the alternate data streams that carry that flag. The red team reproduced the behavior by packaging a DLL and shortcut into an ISO and running it on a test endpoint. The blue team then walked through detection options, starting from a Sigma rule and checking whether the needed logs existed across proxy, email, EDR and Sysmon sources.

The talk closes by recommending that results feed back into the program. Tabletop expectations are documented, detections are turned into alerts with a response process, and the new test is contributed to Atomic Red Team. The speaker also suggested tracking progress with a purple team maturity model so stakeholders can see improvements in detection and coverage over time.