performing-purple-team-exercise

执行紫队演练

何时使用

在以下情况下使用本技能：

• SOC 团队需要验证检测规则是否确实能针对其目标威胁触发
• 红队评估得出的发现需要转化为检测能力的改进
• 新的检测工具或 SIEM 迁移需要验证检测覆盖率
• 分析师培训需要真实攻击技术与 SIEM 响应的实操经验
• 已安排季度或半年度检测验证周期

不要使用于未事先通知的红队交战——紫队演练需要攻防双方明确协调并实时协作。

前提条件

• 红队能力：内部团队或签约的紫队操作人员
• 攻击模拟工具：Atomic Red Team、MITRE Caldera 或 C2 框架（已授权）
• 演练期间用于实时告警监控的 SIEM 访问权限
• 映射到 ATT&CK 的检测规则清单，包含预期告警名称
• 隔离的测试环境，或经变更管理批准的已批准生产范围
• 用于红蓝实时协调的沟通渠道（Slack/Teams）

工作流

第 1 步：定义演练范围与目标

记录演练参数：

purple_team_exercise:
  exercise_id: PT-2024-Q1
  date: 2024-03-20
  duration: 8 hours (09:00-17:00 UTC)
  scope:
    environment: Production (Finance VLAN, 10.0.5.0/24)
    systems_in_scope:
      - WORKSTATION-TEST01 (10.0.5.100) — Test endpoint
      - DC-TEST (10.0.5.200) — Test domain controller
      - FILESERVER-TEST (10.0.5.201) — Test file server
    systems_excluded:
      - All production domain controllers
      - Customer-facing systems
  objectives:
    - Validate 15 detection rules mapped to FIN7 TTPs
    - Test SOC analyst response to real attack indicators
    - Identify detection gaps for credential access and lateral movement
    - Measure detection latency for each technique
  threat_scenario: FIN7 campaign targeting financial data via spearphishing
  authorization: Approved by CISO, Change Request CR-2024-0567
  communication: #purple-team-2024q1 Slack channel

第 2 步：构建映射到 ATT&CK 的测试计划

创建逐技术的测试矩阵：

#	ATT&CK ID	技术	测试工具	预期检测	蓝队指标
1	T1566.001	鱼叉式钓鱼附件	手动邮件	邮件网关告警	检测 是/否，延迟
2	T1204.002	用户执行	宏文档	Sysmon 进程创建	检测 是/否，延迟
3	T1059.001	PowerShell	Atomic RT #1-3	PowerShell 执行告警	检测 是/否，延迟
4	T1053.005	计划任务	Atomic RT	计划任务创建告警	检测 是/否，延迟
5	T1547.001	注册表 Run 键	Atomic RT	注册表修改告警	检测 是/否，延迟
6	T1003.001	LSASS 内存	Mimikatz	凭据转储告警	检测 是/否，延迟
7	T1550.002	Pass-the-Hash	Mimikatz	NTLM 异常检测	检测 是/否，延迟
8	T1021.002	SMB/PsExec	PsExec	PsExec 服务创建告警	检测 是/否，延迟
9	T1047	WMI	wmic /node	WMI 远程执行告警	检测 是/否，延迟
10	T1021.001	RDP	xfreerdp	RDP 横向移动告警	检测 是/否，延迟
11	T1071.001	Web C2	Cobalt Strike	C2 信标检测	检测 是/否，延迟
12	T1041	外泄 C2	Rclone	数据外泄告警	检测 是/否，延迟
13	T1490	抑制恢复	vssadmin	卷影副本删除告警	检测 是/否，延迟
14	T1486	数据加密	测试加密	大规模加密检测	检测 是/否，延迟
15	T1070.001	清除日志	wevtutil	日志清除检测	检测 是/否，延迟

第 3 步：执行红队技术

使用 Atomic Red Team（或手动执行）运行每项技术：

# Install Atomic Red Team
IEX (IWR 'https://raw.githubusercontent.com/redcanaryco/invoke-atomicredteam/master/install-atomicredteam.ps1' -UseBasicParsing)
Install-AtomicRedTeam -getAtomics

# Test 1: T1059.001 — PowerShell Execution
Write-Host "[$(Get-Date -Format 'HH:mm:ss')] Executing T1059.001 - PowerShell"
Invoke-AtomicTest T1059.001 -TestNumbers 1
# Notify blue team: "T1059.001 executed at $(Get-Date)"

# Test 2: T1053.005 — Scheduled Task Creation
Write-Host "[$(Get-Date -Format 'HH:mm:ss')] Executing T1053.005 - Scheduled Task"
Invoke-AtomicTest T1053.005 -TestNumbers 1

# Test 3: T1547.001 — Registry Run Key
Write-Host "[$(Get-Date -Format 'HH:mm:ss')] Executing T1547.001 - Registry Persistence"
Invoke-AtomicTest T1547.001 -TestNumbers 1,2

# Test 4: T1003.001 — Credential Dumping
Write-Host "[$(Get-Date -Format 'HH:mm:ss')] Executing T1003.001 - LSASS Access"
Invoke-AtomicTest T1003.001 -TestNumbers 1,2

# Test 5: T1490 — Shadow Copy Deletion
Write-Host "[$(Get-Date -Format 'HH:mm:ss')] Executing T1490 - Inhibit Recovery"
Invoke-AtomicTest T1490 -TestNumbers 1

# Cleanup after each test
Invoke-AtomicTest T1059.001 -TestNumbers 1 -Cleanup
Invoke-AtomicTest T1053.005 -TestNumbers 1 -Cleanup
Invoke-AtomicTest T1547.001 -TestNumbers 1,2 -Cleanup

第 4 步：实时监控蓝队检测

蓝队在执行期间监控 SIEM：

--- Real-time purple team monitoring dashboard
index=notable earliest=-1h
| where Computer IN ("WORKSTATION-TEST01", "DC-TEST", "FILESERVER-TEST")
  OR src IN ("10.0.5.100", "10.0.5.200", "10.0.5.201")
| eval detection_latency = _time - orig_time
| eval latency_seconds = round(detection_latency, 0)
| sort _time
| table _time, rule_name, urgency, src, dest, user, latency_seconds

--- Check specific technique detection
index=sysmon Computer="WORKSTATION-TEST01" earliest=-15m
(EventCode=1 OR EventCode=3 OR EventCode=10 OR EventCode=11 OR EventCode=13)
| sort _time
| table _time, EventCode, Image, CommandLine, TargetFilename, TargetObject

实时记录结果：

exercise_results = {
    "exercise_id": "PT-2024-Q1",
    "results": [
        {
            "technique": "T1059.001",
            "name": "PowerShell Execution",
            "execution_time": "09:15:00",
            "detected": True,
            "alert_name": "Suspicious PowerShell Encoded Command",
            "detection_time": "09:15:47",
            "latency_seconds": 47,
            "notes": "Detected via Sysmon EventCode 1 with encoded command pattern"
        },
        {
            "technique": "T1003.001",
            "name": "LSASS Memory Access",
            "execution_time": "10:30:00",
            "detected": False,
            "alert_name": None,
            "detection_time": None,
            "latency_seconds": None,
            "notes": "GAP: No detection rule for LSASS access. Sysmon EventCode 10 present but no correlation rule."
        }
    ]
}

第 5 步：协作式差距修复

对于每个差距，蓝队立即构建检测规则：

--- Gap: T1003.001 — No LSASS access detection
--- Build rule during exercise
index=sysmon EventCode=10 TargetImage="*\\lsass.exe"
GrantedAccess IN ("0x1010", "0x1038", "0x1fffff", "0x40")
NOT SourceImage IN ("*\\svchost.exe", "*\\csrss.exe", "*\\MsMpEng.exe")
| stats count by Computer, SourceImage, SourceUser, GrantedAccess
| where count > 0

构建后，重新测试：

Red Team: "Re-executing T1003.001 at 11:45"
Blue Team: "Confirmed — alert 'LSASS Memory Access Detected' fired at 11:45:32 (32s latency)"
Result: GAP CLOSED

第 6 步：生成演练报告

def generate_purple_team_report(results):
    total = len(results["results"])
    detected = sum(1 for r in results["results"] if r["detected"])
    gaps = sum(1 for r in results["results"] if not r["detected"])
    avg_latency = sum(r["latency_seconds"] for r in results["results"]
                      if r["latency_seconds"]) / max(detected, 1)

    report = f"""
PURPLE TEAM EXERCISE REPORT — {results['exercise_id']}
{'=' * 60}

SUMMARY:
  Techniques Tested:     {total}
  Detected:              {detected} ({detected/total*100:.0f}%)
  Gaps Identified:       {gaps} ({gaps/total*100:.0f}%)
  Avg Detection Latency: {avg_latency:.0f} seconds

DETAILED RESULTS:
"""
    for r in results["results"]:
        status = "DETECTED" if r["detected"] else "GAP"
        latency = f"{r['latency_seconds']}s" if r["latency_seconds"] else "N/A"
        report += f"  [{status}] {r['technique']} — {r['name']} (Latency: {latency})\n"
        if not r["detected"]:
            report += f"          Action: {r['notes']}\n"

    return report

核心概念

术语	定义
紫队	红队（攻击）与蓝队（防御）协同开展的演练，用于验证并改进检测能力
对手模拟	对特定威胁行为者 TTP 进行结构化模拟，以测试防御能力
检测验证	确认在目标技术被执行时检测规则能正确触发的流程
检测延迟	从技术执行到 SIEM 生成告警之间的时间——在紫队演练期间测量
差距修复	针对测试期间未被检测到的技术，立即创建或调优检测规则
Atomic Red Team	针对单个 ATT&CK 技术的开源小型、聚焦测试库

工具与系统

• Atomic Red Team：来自 Red Canary 的开源攻击测试库，用于逐技术验证
• MITRE Caldera：自动化对手模拟平台，支持映射到 ATT&CK 的攻击链
• Vectr：紫队管理平台，用于跟踪演练结果和检测覆盖率的改进
• Prelude Operator：对手模拟工具，支持自动化多步攻击场景
• AttackIQ：入侵与攻击模拟（BAS）平台，用于持续检测验证

常见场景

• 季度验证：针对 ATT&CK 技术测试排名前 20 的检测规则，以确保其持续有效
• 新工具验证：部署新的 EDR 后，针对基线技术验证检测覆盖率
• 分析师培训：初级分析师在专家指导下通过 SIEM 调查实时观察真实攻击
• 事件后验证：在真实事件发生后，模拟攻击链以验证检测改进效果
• 合规证据：为 SOC 2、ISO 27001 或 PCI DSS 审计记录检测验证结果

输出格式

PURPLE TEAM EXERCISE REPORT — PT-2024-Q1
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
Date:         2024-03-20 (09:00-17:00 UTC)
Scenario:     FIN7 Financial Sector Campaign
Scope:        Finance VLAN (10.0.5.0/24)

RESULTS:
  Techniques Tested:     15
  Detected:              11 (73%)
  Gaps Identified:       4 (27%)
  Gaps Remediated Same Day: 3
  Avg Detection Latency: 38 seconds

DETAILED RESULTS:
  [PASS]  T1566.001 Spearphishing Attachment      — 12s latency
  [PASS]  T1204.002 User Execution (Macro)         — 8s latency
  [PASS]  T1059.001 PowerShell Execution            — 47s latency
  [PASS]  T1053.005 Scheduled Task                  — 23s latency
  [PASS]  T1547.001 Registry Run Keys               — 31s latency
  [FAIL]  T1003.001 LSASS Memory Access             — REMEDIATED during exercise
  [FAIL]  T1550.002 Pass-the-Hash                   — REMEDIATED during exercise
  [PASS]  T1021.002 PsExec                          — 15s latency
  [PASS]  T1047 WMI Remote Execution                — 42s latency
  [PASS]  T1021.001 RDP Lateral Movement            — 28s latency
  [FAIL]  T1071.001 Web C2 Beaconing                — REMEDIATED during exercise
  [PASS]  T1041 Exfiltration over C2                — 67s latency
  [PASS]  T1490 Shadow Copy Deletion                — 5s latency
  [FAIL]  T1486 Data Encryption for Impact          — OPEN — requires endpoint telemetry
  [PASS]  T1070.001 Event Log Clearing              — 11s latency

POST-EXERCISE COVERAGE: 93% (14/15) — up from 73% at start
REMAINING GAP: T1486 requires EDR file monitoring enhancement