Belajar Red Team Operator - Purple Team Operations

#Pendahuluan

Setelah di episode 12 kita mempelajari red team reporting & engagements — laporan, timeline, dan debrief — pada episode ini kita mendalami purple team operations: pendekatan paling efektif untuk memperkuat pertahanan organisasi melalui kolaborasi real-time antara red dan blue team.

Purple team bukan tim terpisah — ia adalah cara kerja. Dalam purple team engagement, red menjalankan attack dan blue memantau secara real-time. Gap langsung teridentifikasi dan bisa diperbaiki di sesi yang sama.

#Purple Team Framework

#Collaborative Model

100%

#Session Structure

text

Purple Team Session (2-4 hours)
================================
1. Pre-session (30 min)
   - Red: review attack technique
   - Blue: prepare detection rules
   - Both: agree on scope
 
2. Execution (2-3 hours)
   - Red: execute attack
   - Blue: monitor SIEM/EDR
   - Both: real-time discussion
 
3. Post-session (30 min)
   - Document: detected/not detected
   - Gap analysis
   - Action items for improvement

#Detection Validation

#Methodology

text

Detection Validation Process
==============================
1. Red: select ATT&CK technique
2. Blue: verify detection rule exists
3. Red: execute technique
4. Blue: check if alert generated
5. Both: document result
6. Repeat for each technique

#Validation Matrix

Technique	Tool	Expected Detection	Actual	Status
T1003.001	Mimikatz	EDR alert	Not detected	GAP
T1059.001	PowerShell	Script block log	Detected	PASS
T1021.002	PsExec	Event 4624	Not detected	GAP
T1053.005	Scheduled Task	Sysmon Event 1	Detected	PASS
T1558	Kerberoasting	Event 4769	Not detected	GAP

#Gap Analysis Template

yaml

gap_analysis:
  - technique: "T1003.001 - Credential Dumping"
    status: "NOT DETECTED"
    root_cause: "No detection rule for LSASS access"
    remediation:
      - "Create Sigma rule for LSASS access"
      - "Enable credential guard"
      - "Test rule with Atomic Red Team"
    priority: "HIGH"
    
  - technique: "T1021.002 - SMB/Windows Admin Shares"
    status: "NOT DETECTED"
    root_cause: "PsExec logged but not alerted"
    remediation:
      - "Create rule for PsExec service creation"
      - "Alert on Event 7045 + suspicious service name"
    priority: "HIGH"

#Atomic Red Team Integration

#Automated Validation

bash

# Install Atomic Red Team
git clone https://github.com/redcanaryco/atomic-red-team
 
# Run specific technique
Invoke-AtomicRedTeam.ps1 -TestGUID <technique-guid>
 
# Run all techniques in a category
Invoke-AtomicRedTeam.ps1 -AtomicTestsGroup "credential_access"
 
# Check prerequisites first
Invoke-AtomicRedTeam.ps1 -TestGUID <guid> -CheckPrereqs

#Mapping to Detection

text

Atomic Red Team → Detection Validation
==========================================
1. Select technique from Atomic library
2. Check prerequisites
3. Execute technique
4. Monitor SIEM/EDR for alerts
5. Document: detected/not detected
6. If gap: create detection rule
7. Re-test with rule in place

#Continuous Purple Team

#Cadence

text

Purple Team Cadence
=====================
Weekly (1-2 hours):
  - Test 5-10 techniques
  - Focus on new/emerging threats
 
Monthly (half day):
  - Comprehensive technique testing
  - Gap analysis review
  - Detection rule improvement
 
Quarterly (1-2 days):
  - Full MITRE ATT&CK coverage review
  - Red team engagement (if needed)
  - Report to leadership

#Metrics

text

Purple Team Metrics
=====================
- Detection coverage: X% of ATT&CK techniques
- Mean time to detect (MTTD): X minutes
- Mean time to respond (MTTR): X hours
- False positive rate: X%
- Gap remediation rate: X gaps fixed/month

Tip

Purple team bukan kompetisi — ia kolaborasi. Red team harus sabar menjelaskan teknik; blue team harus terbuka terhadap feedback. Goal-nya sama: memperkuat pertahanan.

#Praktik: Purple Team Exercise

bash

# 1. Setup lab dengan SIEM (Wazuh/ELK)
# 2. Pilih 10 ATT&CK techniques
# 3. Red: jalankan teknik satu per satu
# 4. Blue: monitor SIEM untuk setiap teknik
# 5. Document: detected/not detected
# 6. Gap analysis → action items
# 7. Re-test setelah perbaikan

#Penutup

Inti yang harus dibawa pulang:

Purple team framework: plan → execute → monitor → analyze → improve → re-test.
Detection validation: test setiap technique secara real-time dengan SIEM monitoring.
Atomic Red Team: library 300+ test cases untuk validasi otomatis.
Continuous purple team: weekly/monthly/quarterly cadence.
Metrics: detection coverage, MTTD, MTTR, false positive rate.

Di episode 14 selanjutnya, kita akan mempelajari attack simulation frameworks — Caldera, Atomic Red Team, dan automated emulation untuk testing yang terstruktur.