Hi everybody welcome to the final video module one of the three teams.
So this particular video is called the purple team.
So we're going to be discussing that particular team in this video.
The purple team as we've discussed before is a blend between the red and blue teams.
So it's not a official team in the respects of the organization.
So you're not going to see it on payroll it's not going to have its own budget.
In some cases some organizations will use a email distribution list.
That kind of has all the members of the blue and red team so that way people can contact the quote Purple
team directly.
So for anybody out there caught it.
So the reason it's called Purple is because red and blue when mixed together creates Color Purple.
So this is a growing term in the industry right now.
So people are trying to morph their own purple teams inside of the organization.
And the one that I am working for is no different.
It's a good combination between red and blue.
So why is this particular team needed there's something called a detection feedback loop which is extremely
important not just for detection but a feedback loop in general and it in a sense is the ability to
take an action get a response and have a reaction and have that loop come back around to produce a different
result on the next go round so in this case the detection feedback loop would be the blue team has put
in a detection for logging or notifying them about a specific command.
The red team then comes in makes a adjustment to the command it's no longer seen.
We report that back to the blue team which in turn they their response is to fix the problem.
And then we go back and forth.
So that's so that's what I mean when I say detection feedback loop which also feeds into consistent
improvements.
So a blue team in a normal sense does not contain any red team members.
There may be a few individuals on the team that branch out a little bit and will test things out on
their own.
But in a general sense most blue team members do not focus on red team engagements or activities.
So the the things that a red team member is going to look for is not always the same as a blue team.
So how they write a particular command how they write the detection for that command.
The process of elevating from one standard user to root or administrator depending on how they did it
there may be a detection in place for that.
We also quickly identify missing detections which again is part of that feedback loop as well where
if we know that something's missing let's say red team goes on an engagement and they identify a certain
way to elevate their privileges or run a particular command or do a password file that was not alerted
to it.
That's a good reason for the feedback loop and that's kind of why the purple team is needed.
There is an additional step around training but we'll get to that in a little bit later.
So there's simulations and active tests for a purple team.
Right.
So red team engagements they get an unknown test which I've talked about in the blue team video previous
to this is around the blue team not knowing that a test is about to happen.
So the detections are alive.
They're real as far as they're concerned they have no idea whether it's an internal person external
or it's the red team.
So but there's also something called replays where the red team will sit down with the blue team and
sort of a purple team aspect and run through an entire engagement from start to finish everything that
was done every command every tool that was ran in the the goal of this is to go through step by step.
How would I do it.
How would you build a detection around this and this and this and this until you get through the whole
engagement where everything should be detected going forward.
So that's kind of something that should happen on a monthly or semi monthly basis depending on the organizational
needs.
Phishing is another one of those simulations that it can be a simulation or an active test.
So in some cases there's a simulation of a phishing engagement where we're testing the employees specifically.
So the blue team will know that that's happening.
In other cases there's an active test where they have no idea that this is actually happening and as
far as they're concerned it's real it's somebody from the outside and they just need to sort that out.
BLOCK The Domain clear everybody's mailboxes of that particular email validate what what's been clicked
what's not.
So the final step is training and this is really the blood sweat and tears of of the purple team along
with the feedback loops and everything is the is the training aspect.
So I'm going to skip the swap for now but this single session is a good type of training because it
allows people from the red team and people from cert or the blue team to take an hour hour and a half
to teach everybody is something so a red team member might come over and teach everybody on the purple
team or on the blue team or in this case the purple team teach everybody how to do a particular task
whether that's static analysis running a particular tool building your own tool how to exploit this
particular service how to handle phishing engagements.
So there's a lot of training that tends to happen where it's it's cross training.
So the swap is another important role it's more like a role swap than anything.
So we take a red team member and move them over to blue for a week or so they perform the standard actions
that a blue team member would and they they sit with somebody who's a little bit more senior is normally
a lead on to kind of go through and learn how the aspects work.
Sometimes it's not a swap.
Sometimes it may be a sit down with with somebody for a week to help identify what they do how they
do it and the same thing goes for booting or red team.
So red team or blue team can go to red and do some testing participate in engagements sometimes just
sit with a red team member.
So there's a lot of variety there that can happen inside of a purple team.
So this particular case this is the end of the first module.
I know it's getting it's a lot of texts a lot of information.
Don't worry.
The next next few modules will get a little bit better.
It's just more of a learning curve at this point trying to get you up to speed on what the teams are
how they're important the processes that are in place because it's good to know that as well as the
technical side.