Automated PurpleSharp Adversary Simulation
Defending enterprise networks against attackers continues to present a difficult challenge for blue teams. Prevention has fallen short; improving detection & response capabilities has proven to be a step in the right direction. However, without the telemetry produced by adversary behavior, building new and testing existing detection capabilities will be constrained. PurpleSharp is an open source adversary simulation tool written in C# that executes adversary techniques within Windows Active Directory environments. The resulting telemetry can be leveraged to measure and improve the efficacy of a detection engineering program. PurpleSharp leverages the MITRE ATT&CK Framework and executes different techniques across the attack life cycle: execution, persistence, privilege escalation, credential access, lateral movement, etc
Recommended
Recommended
More Related Content
What's hot
What's hot (20)
Similar to Automated PurpleSharp Adversary Simulation
Similar to Automated PurpleSharp Adversary Simulation (20)
More from Mauricio Velazco
More from Mauricio Velazco (16)
Recently uploaded
Recently uploaded (20)
Automated PurpleSharp Adversary Simulation
- 3. #whoami ✘ Threat Research @ Splunk ✘ @mvelazco ✘ Bsides, Derbycon, Defcon, BlackHat ✘ github.com/mvelazc0
- 4. Detection engineers need the capability to generate attack telemetry.
- 5. ✘ Executes adversary techniques within Windows Active Directory environments ✘ Follows the MITRE ATT&CK Framework (50+ supported) ✘ C# -> .NET or Win32 API Goal: ✘ Generate attack telemetry that enables detection teams to build, test and enhance detection controls. github.com/mvelazc0/PurpleSharp www.purplesharp.com
- 7. Enter PurpleSharp ✘ Flexible ✘ Remote Simulation Deployment ✘ User Impersonation ✘ Technique Variations ✘ Active Directory ‘support’
- 8. Flexible ✘ A single C# assembly ✘ JSON simulation playbooks ✘ Customizable technique parameters
- 9. Flexible
- 11. Remote Simulation Deployment ✘ Leverages Windows native features: SMB, WMI and Named pipes ✘ Requirements Network connectivity Administrative credentials
- 12. Remote Simulation Deployment ✘ 3 modules instrument the simulation: Orchestrator, Scout & Simulator ✘ They synchronize on simulation details over named pipes using serialized objects.
- 13. Remote Simulation Deployment PurpleSharp/PurpleSharp/Lib/NamedPipes.cs PurpleSharp/PurpleSharp/Lib/Models.cs
- 14. User Impersonation First Approach: DuplicateTokenEx CreateProcessWithTokenW ImpersonateLoggedOnUser Second Approach: CreateRemoteThread
- 15. User Impersonation ✘ Scout starts the Simulator as a child process of explorer.exe using PPID spoofing (T1134.004) ✘ Simulation behavior runs under the context of the logged user ✘ Breaks process relationship between the Scout and Simulator
- 16. User Impersonation PurpleSharp/PurpleSharp/Lib/NamedPipes.cs - RunScoutServiceSerialized()
- 18. Technique Variations ✘ Execute the same technique in different variations ✘ Attempt to bypass detection ✘ Helps validate detection resilience
- 19. T1021.002 - Remote Services #1: sc.exe to create remote service #2: CreateService to create a remote service #3: ChangeServiceConfig to modify an existing service Initial idea: github.com/Mr-Un1k0d3r/SCShell
- 20. Technique Variations T1110.003 - Password Spraying
- 21. Active Directory ‘support’ ✘ PurpleSharp is able to interact with AD and domain members in the context of the logged user ✘ LDAP support for random target selection host_target_type & user_target_type
- 22. 3. Demos
- 23. Lab
- 24. Demo 1 Playbook #2 T1087.002 - Domain Account Discovery T1069.002 - Domain Group Discovery T1482 - Domain Trust Discovery T1018 - Remote System Discovery T1110.003 - Password Spraying Playbook #1 T1033 - System User Discovery T1087.001 - Local Account Discovery T1069.001 - Local Group Discovery T1018 - Remote System Discovery T1558.003 - Kerberoasting
- 25. Demo 2 Playbook #2 T1135 - Network Share Discovery T1047 - Windows Management Instrumentation T1021.006 - Windows Remote Management Playbook #1 T1046 - Network Service Scanning T1021.002 - Remote Services T1053 - Scheduled Task
- 26. Demo 2