PurpleSharp is an open source C# adversary simulation tool that executes MITRE ATT&CK techniques inside authorized Windows Active Directory lab environments to generate telemetry for detection engineering.
| Tool | mvelazc0/PurpleSharp — C# adversary simulation tool for Windows Active Directory detection testing |
| Category | Adversary simulation / purple team tooling |
| Primary Use | Executing MITRE ATT&CK technique simulations in Active Directory environments to build and validate detection analytics |
| Safe Use | Explicitly intended for authorized security assessments, controlled lab environments, and defensive detection engineering programs |
| Telemetry Note | By design the tool produces abundant Windows security event telemetry — exactly what blue teams ingest into their SIEM to hunt simulations and validate logging pipelines |
PurpleSharp, hosted at mvelazc0/PurpleSharp, is an open source adversary simulation tool written in C# that executes attacker techniques against Windows Active Directory environments. Its purpose is deliberately defensive in orientation: rather than serving as an operational attack framework, it exists to produce the telemetry of adversary behavior so that detection engineering programs can measure and improve their efficacy. The project currently implements 47 unique MITRE ATT&CK techniques, spanned across the attack lifecycle including execution, persistence, privilege escalation, credential access, and lateral movement.
The README frames the problem space well: prevention alone has repeatedly fallen short in defending enterprise networks, and while improving detection and response is a step in the right direction, blue teams are constrained without realistic adversary telemetry to work against. PurpleSharp fills that gap by emitting authentic-looking behavior against a domain so that analysts have concrete events to correlate, rather than hypothetical ones. This positions it firmly in the purple team tradition where red-side execution exists only to exercise blue-side detection.
Architecturally, the tool is a single .NET assembly targeting .NET Framework 4.5, which the README notes is a hard requirement. The assembly is all you need to start simulating techniques, keeping the deployment footprint simple for lab operators. Builds can be produced with Visual Studio Community 2019 or 2020, or operators can grab a prebuilt release binary directly from the repository's GitHub releases page for immediate use in an authorized test domain.
Coverage is tracked through a MITRE ATT&CK Navigator layer file (PurpleSharp_navigator.json) shipped in the repository, which lets engineers visualize exactly which techniques the tool can simulate before committing lab time. This is a thoughtful touch for detection teams doing gap analysis: you can map your existing analytics against the layer and immediately identify where visibility is untested. The README also links the technique list through the ATT&CK Navigator web interface for quick reference.
The stated use cases are all defensive. The README enumerates five: building new detection analytics, testing existing detection analytics, validating detection resiliency, identifying gaps in visibility, and identifying issues with the event logging pipeline itself. That last one deserves emphasis — a surprisingly common failure mode in mature environments is a broken or incomplete logging pipeline, and simulation tools are one of the few reliable ways to empirically prove that expected events actually arrive at the SIEM.
PurpleSharp has a respectable public pedigree. It debuted at Derbycon IX in September 2019, received an updated release for BlackHat Arsenal 2020, and its latest major version shipped in August 2021 as part of BlackHat Arsenal 2021. It also appeared at BlackHat Arsenal Asia 2023, indicating continued community visibility. The author is Mauricio Velazco (@mvelazco), and the acknowledgments read like a who's-who of detection engineering — Olaf Hartong, Roberto Rodriguez (Cyb3rWard0g), Matt Graeber, Jonny Johnson, Keith McCammon, and Andrew Schwartz — which speaks to the tool's credibility within the defensive community.
The ecosystem around the tool strengthens its workflow value considerably. The companion repository PurpleAD, described as an Active Directory Purple Team Playbook, provides ready-to-use JSON playbooks for PurpleSharp. This playbook pattern means detection teams can standardize repeatable simulation sets — for example, running the same battery of techniques before and after a detection change to measure regression or improvement — rather than ad-hoc manual execution. Full documentation and demos live at purplesharp.com.
From a defender's telemetry perspective, PurpleSharp is loud by design. Every simulated technique generates the native Windows event stream an attacker performing the same action would produce: 4688 process creation records, 4624/4672 logon events, PowerShell operational logs, Sysmon pipeline data, and so on depending on sensor coverage. This is precisely what defenders should be hunting for in their own labs: if you run a simulation and cannot find corresponding evidence in your SIEM, you have found either a detection gap or a logging pipeline defect — both of which are the tool's explicitly intended findings.
Licensing is BSD-3-Clause, permissive enough for enterprise security teams to fork, audit, and integrate into internal automation without legal friction. The repository carries 847 stars and topics including adversary-simulation, controls-validation, detection-engineering, and purple-team, which accurately reflect its positioning. The project is associated with the Open Threat Research community, aligning it with the broader detection engineering research movement.
Where PurpleSharp fits in an authorized workflow is straightforward: build or use a lab domain that mirrors production telemetry sources, run technique simulations or full JSON playbooks, and treat the resulting events as ground truth for analytics development. It is equally useful as a regression harness — rerun the same playbook after tuning rules or upgrading agents to verify detections still fire. What it is not, and should not be treated as, is a stealth or operational attack tool; the community around it and its documentation are unambiguous about that.
One caveat for operators: the README notes the latest major release dates to August 2021, so teams should verify current ATT&CK technique coverage against their analytics matrix rather than assuming parity with the newest ATT&CK version. The Navigator layer file remains the authoritative coverage map. Despite its age, the tool remains a practical, well-documented entry point for any detection engineering program that needs realistic adversary telemetry inside Active Directory without standing up a full red team engagement — and within the BSD-3-Clause license, it invites the community to extend it.
mvelazc0/PurpleSharp.Educational analysis for authorized security professionals. Use only in controlled, authorized environments.
Related coverage
0 comentários:
Post a Comment
Note: Only a member of this blog may post a comment.