AI
Purple Teams: Collaborative Workshops, Not Automation
Purple teams bring red and blue teams together to execute attacks side by side in an open-book format. Blue teamers get the adversary perspective on alerts they handle daily. Sarah Hume stresses that purple teams are not breach-and-attack simulation tools. BAS solutions require putting security tools in audit mode and run thousands of techniques from a single process, which inflates detection correlations. Purple teams are also distinct from red teams (which evade tools) and pentests (which run noisy enumeration). Only purple teams evaluate security tool effectiveness directly.
Assume Breach: Test Visibility, Not Vulnerability
The assumed compromise approach gives red teamers a workstation, domain user account, and even domain admin rights to run attacks like DCSync. Traditional assume compromise stops at network access. Hume extends it: grant all access needed to execute the technique under test. The goal is to evaluate whether security tools detect the underlying activity, not whether attackers can reach that stage. DCSync abuses replication rights to obtain any domain user credentials. By providing domain admin, the test isolates the detection capability of SIM and identity threat protection tools from compensating controls.
Underlying Activity Over Procedure Variants
Hume argues that no matter how attackers modify a DCSync attack, the underlying replication activity stays the same. Windows event ID 4662 always contains a GUID string for replication. The RPC call always binds to the same interface and function. Testing to this core activity provides future-proof detection. If a control catches the underlying behavior, procedure variants—running from a rogue workstation, Linux server, or custom payload—are irrelevant. Compensating controls should be documented but not relied upon for prevention. The area under test for DCSync is directory service object access, correlating to SIEM and identity threat protection.
Score for Continuous Improvement
Each test case receives a successful outcome if a security tool or configuration prevents or detects the attack. The score is successful outcomes divided by total test cases. Unsuccessful outcomes do not count against the score, eliminating blame and fostering collaboration. The score never reaches 100% but provides a metric to track over time. Results are analyzed at the tactic level (columns in MITRE ATT&CK) to prioritize left-of-killchain remediation. Historical comparisons show progress. Continuous testing catches regressions, such as a detection turned off in Q3 and never reactivated.
Q&A
Does the approach focus on insider threats? It is comprehensive to any breach, but especially good for insider threats. ▶ 22:41
How do you keep other teams, like networking, engaged beyond detection? Bring everyone into the room to watch the hacker; the live demonstration builds perspective and balances detection with response. ▶ 23:12
Do you use any automatic tools for this style of testing? Hume prefers manual execution during engagements and uses Mythic C2 with Jupyter notebooks for automation between purple teams. ▶ 25:50
How do you handle reporting, especially legal sensitivity? Eliminate audit speak; no failures, no vulnerability ratings. Assign remediation project priority instead. ▶ 26:35
Notable Quotes
We are setting the stage and giving our testers access required to run these tasks that we chose because it lets us focus on visibility, not vulnerability. Sarah Hume · ▶ 10:07
If you use a bad solution on its own, we find it tends to leave a lot to be desired. Sarah Hume · ▶ 6:28
It’s about assuming our controls will fail. Sarah Hume · ▶ 21:55
Key Takeaways
- Give testers required access to evaluate security tool visibility over vulnerability.
- Test the underlying activity of a technique, not every procedure variant.
- Score purple team results by successful outcomes only to foster collaboration.
About the Speaker(s)
Sarah Hume leads the Purple Team service at Security Risk Advisors (SRA). She has led hundreds of Threat Intelligence-based Purple Team exercises for Fortune 500 and Global 1000 organizations over the past seven years. Her background includes offensive security, internal network, OT/ICS, and physical penetration testing. She holds multiple certifications, including CRTO, CISSP, and AWS Certified Cloud Practitioner.