PurpleSharp: Automated Adversary Simulation
Mauricio Velazco presents PurpleSharp, an open-source C# adversary simulation tool that generates realistic Active Directory attack telemetry across Windows environments.
Summary
The Telemetry Deficit in Enterprise Detection Engineering
Blue teams often struggle to build robust detection rules because enterprise environments lack authentic, labeled adversary telemetry to validate alert pipelines.
Introducing PurpleSharp for Active Directory Simulation
Mauricio Velazco releases PurpleSharp, an automated C# tool designed to simulate adversary behavior across Windows and Active Directory domains.
Executing Controlled ATT&CK Technique Playbooks
PurpleSharp executes comprehensive playbooks mapped to MITRE ATT&CK—including Kerberoasting, password spraying, process injection, and WMI lateral movement.
Benchmarking SIEM and EDR Detection Capabilities
Velazco illustrates how purple teams use PurpleSharp to measure telemetry collection rates, validate EDR alerts, and systematically tune detection rules.
Related talks
Adversary Village·31 min
Samuel Kimmons
Samuel Kimmons provides a foundational guide to adversary emulation, explaining how threat intelligence and the MITRE ATT&CK framework guide testing.
Adversary Village·30 min
David Hunt
CALDERA creator David Hunt introduces Prelude Operator, an accessible desktop adversary emulation platform designed to automate offensive security testing.
Adversary Village·29 min
Atul · Harshal
Atul and Harshal present Tenacity, an adversary emulation tool automating the deployment and testing of complex Windows persistence mechanisms.