purple-team

Security sensor for realtime threat detection and protection

☁️ ⚡ Granular, Actionable Adversary Emulation for the Cloud

Open-source AI Security Operations Center: alert fusion, LLM-agent triage, MITRE ATT&CK investigation, and a replayable decision ledger for every agent step. Self-hostable, runs with no API keys, MIT licensed. Ships an MCP server for Claude, Cursor and Continue.

Open Adversarial Exposure Validation Platform

BigBountyRecon tool utilises 58 different techniques using various Google dorks and open source tools to expedite the process of initial reconnaissance on the target organisation.

AttackGen is a cybersecurity incident response testing tool that leverages the power of large language models and the comprehensive MITRE ATT&CK framework. The tool generates tailored incident response scenarios based on user-selected threat actor groups and your organisation's details.

Tool for building Kubernetes attack paths

PurpleSharp is a C# adversary simulation tool that executes adversary techniques with the purpose of generating attack telemetry in monitored Windows environments

Purple Team Resources for Enterprise Purple Teaming: An Exploratory Qualitative Study by Xena Olsen.

BadZure automates the deployment of intentionally misconfigured Entra ID tenants and Azure subscriptions, populating them with diverse entities and configurable, traversable attack paths.

AWS CloudSaga - Simulate security events in AWS

KslDump — Why bring your own knife when Defender already left one in the kitchen?

Slack enumeration and exposed secrets detection tool

M365/Azure adversary simulation tool that generates realistic attack telemetry to help blue teams improve their detection and response capabilities.

A comprehensive modern architecture model is proposed to integrate platform solutions and tooling to support a professional Red Team.

Finding exposed secrets and personal data in GitLab

ARTi-C2 is a post-exploitation framework used to execute Atomic Red Team test cases with rapid payload deployment and execution capabilities via .NET's DLR.

Automating EDR Testing with reference to MITRE ATTACK via Cobalt Strike [Purple Team].

A customizable, easy-to-navigate tool for researching, pen testing, and defending with the power of Shodan.

AutoPwnKey is a red teaming framework and testing tool using AutoHotKey (AHK), which at the time of creation proves to be quite evasive. It is our hope that this tool will be useful to red teams over the short term, while over the long term help AV/EDR vendors improve how they handle AHK scripts.