Purple teaming: why and how

Red team attacks. Blue team defends. Purple team coordinates both to maximize learning. It is not a separate team: it is a way of working where the red team shares their techniques in real time with the blue team, and the blue team adjusts their detections and responses immediately.

Without purple teaming, the red team finds 20 compromise paths, writes a report, and the blue team takes months to implement the recommendations. With purple teaming, each technique is tested, detected (or not), and detection is improved in the same session.

AI accelerates both sides of the purple team simultaneously: generates more realistic and sophisticated attack simulations, and improves detection and response capability in real time.

The purple maturity model

• Level 0: No coordination. Red and blue work in silos. Red team does an annual pentest, delivers a PDF, and nobody reads it completely.
• Level 1: Post-engagement debriefs. After the pentest, red and blue meet and discuss findings. Improvement, but reactive.
• Level 2: Coordinated purple sessions. Red executes specific techniques, blue observes whether they detect them, and both adjust in real time.
• Level 3: Continuous purple with AI. Attack simulation is continuous and automated. Detections adjust automatically based on results. The human supervises and decides in complex cases.

Attack simulation with AI

AI-powered attack simulation allows executing ATT&CK techniques in an automated, realistic and repeatable way. It is not a vulnerability scanner: it is a behavioral simulation of a real attacker.

Campaign simulation generation

An LLM can generate complete simulation plans based on a real threat actor:

PURPLE_SIMULATION_PROMPT = """
Generate a purple team simulation plan that emulates {threat_actor}
attacking an organization in the {sector} sector in {country}.

Structure:
1. Actor profile (motivation, capability, history)
2. Complete kill chain with ATT&CK techniques
3. For each step:
   - ATT&CK technique (ID + name)
   - Specific command/tool to execute
   - Expected result if the technique succeeds
   - What the blue team should detect
   - Expected Sigma rule or detection query
   - Generated indicators of compromise
4. Success criteria (detection vs non-detection per step)
5. Metrics to measure (MTTD, MTTR, detection coverage)

Actor: APT29 (Cozy Bear)
Sector: European government
Country: Spain
"""

Simulation tools (BAS)

BAS (Breach and Attack Simulation) platforms automate ATT&CK technique execution:

• Atomic Red Team: open source, the most popular. Library of atomic tests per ATT&CK technique. Each test is independent and runs in minutes.
• CALDERA (MITRE): MITRE's adversarial simulation platform. Emulates multi-step campaigns with autonomous agents. Free.
• Infection Monkey (Akamai): simulates lateral movement automatically. Open source. Ideal for testing network segmentation.
• AttackIQ: commercial BAS with MITRE ATT&CK integration and detailed reporting.
• SafeBreach: commercial BAS focused on continuous control validation.

AI for adaptive simulations

The difference between a traditional BAS and an AI-powered one: the traditional one executes the same tests always in the same order. The AI-powered one adapts the simulation based on results:

# Adaptive simulation with AI
class AdaptiveSimulation:
    def __init__(self, actor_profile, target_environment):
        self.actor = actor_profile
        self.env = target_environment
        self.techniques_tried = []
        self.techniques_detected = []

    def next_technique(self):
        # The LLM decides the next technique based on:
        # 1. What techniques were already tried and if they were detected
        # 2. What techniques the real actor would use in this situation
        # 3. The current state of the environment (what access has been gained)
        decision = llm.decide(
            prompt=ADAPTIVE_DECISION_PROMPT,
            context={
                "actor": self.actor,
                "tried": self.techniques_tried,
                "detected": self.techniques_detected,
                "current_access": self.env.current_access_level,
                "available_techniques": self.actor.ttp_repertoire
            }
        )
        return decision.next_technique, decision.reasoning

Adaptive defense with AI

While the red team (or BAS) executes techniques, the blue team uses AI to detect and respond in real time.

Real-time detection with LLMs

An LLM can analyze event sequences from the SIEM and detect patterns that static rules cannot capture:

• Behavioral anomalies: "This user normally accesses 3 network shares. Today they accessed 47 in 10 minutes." A rule would be based on a fixed threshold. An LLM understands that context matters.
• Evasion techniques: the attacker uses PowerShell with obfuscation. String-based rules fail. An LLM can deobfuscate the command and analyze its intent.
• Event chains: three individually innocuous events that together form an attack chain. The LLM correlates temporally and narratively.

Automated detection generation

When the red team executes a technique that is not detected, the system can automatically generate a detection rule:

# Auto-generation of detection after miss
def generate_detection_after_miss(technique, execution_log):
    detection = llm.generate(
        prompt="""
        Technique {technique.id} ({technique.name}) was executed
        successfully and was NOT detected by the SOC.

        Execution log:
        {execution_log}

        Generate:
        1. A Sigma rule that detects this specific technique
        2. A more generic rule that detects variants of this technique
        3. Test criteria to verify the rule works
        4. Possible false positives to consider
        """,
        technique=technique,
        execution_log=execution_log
    )
    return detection

Detecting adversarial AI use

Attackers also use AI. Detecting their use is an emerging capability the blue team needs to develop.

How attackers use AI

• AI-generated phishing: emails without the typical grammatical errors, personalized for each target. Much harder to detect with heuristic-based filters.
• AI-generated malware: polymorphic variants that change their signature on every execution. Signature-based antivirus cannot detect them.
• Voice deepfakes: vishing calls where the attacker clones the CEO's voice to authorize a transfer.
• Exploitation automation: autonomous agents that scan, exploit and pivot without human intervention.
• CAPTCHA bypass: vision models that solve CAPTCHAs automatically.

Indicators of attacker AI use

• Superhuman speed: reconnaissance and exploitation in minutes when a human would take hours.
• Excessive consistency: all phishing emails in a campaign have the same grammatical quality and structure.
• Automation patterns: regular timing between actions, without a human's natural pauses.
• Rapid adaptation: if a technique is blocked, the attacker switches to an alternative in seconds (an AI agent adapting).

AI-generated content detection

For emails and documents, AI-generated text detectors exist (GPTZero, Originality.ai). They are not perfect (high false positives) but can be an additional layer in the email filter. For audio/video deepfakes, tools like Microsoft Video Authenticator or Intel FakeCatcher analyze generation artifacts.

Threat hunting with LLMs

Threat hunting is the proactive search for threats that have evaded existing detections. You do not wait for an alert to fire. You actively search for indicators of compromise based on hypotheses.

Hypothesis generation with AI

An LLM can generate hunting hypotheses based on current threat intelligence:

HUNTING_HYPOTHESIS_PROMPT = """
Given the following context:
- Organization sector: {sector}
- Most active threat actors against this sector: {actors}
- Most used techniques by these actors: {techniques}
- Latest relevant advisories/CVEs: {advisories}
- Current SOC detections (deployed rules): {current_rules}

Generate 5 threat hunting hypotheses, prioritized by probability and impact.

For each hypothesis:
1. Hypothesis (formulated as "If {actor} is in our network, we would expect to see...")
2. Associated ATT&CK technique
3. Data sources to query (logs, EDR, netflow, etc.)
4. Search queries (Splunk SPL or Elastic KQL)
5. Indicators to look for
6. Actions if the hypothesis is confirmed
"""

Log hunting with LLMs

An LLM can analyze logs in natural language, finding patterns that would be difficult to express in a formal query:

• "Find processes that ran for the first time in the last 7 days from service accounts."
• "Find network connections to domains registered in the last 72 hours from internal servers."
• "Identify user accounts that changed their access time pattern this week."

The LLM translates these requests into formal queries (SPL, KQL, SQL) and then analyzes the results to identify anomalies.

MITRE ATT&CK automation

MITRE ATT&CK is the central framework of purple teaming. AI automates three key processes with ATT&CK:

1. Coverage evaluation

Given the SIEM rule catalog and SOAR playbooks, an LLM can map each rule to ATT&CK techniques and generate a coverage heatmap. Techniques without coverage are the gaps the purple team should prioritize.

2. Technique prioritization

Not all ATT&CK techniques are equally relevant. AI prioritizes based on: what actors target your sector? What techniques do those actors use? Which of those techniques are you not covering? Those are the ones the red team should simulate first.

3. Automated gap closure

# Automated ATT&CK gap closure
def close_detection_gap(technique_id):
    # 1. Get technique information
    technique = mitre_attack.get_technique(technique_id)

    # 2. Generate simulation tests
    atomic_tests = llm.generate_atomic_tests(technique)

    # 3. Generate detection rules
    sigma_rules = llm.generate_sigma_rules(technique)

    # 4. Execute simulation
    for test in atomic_tests:
        result = execute_atomic_test(test)
        detection = check_if_detected(result)

        if not detection:
            # 5. Deploy rule and re-test
            deploy_sigma_rule(sigma_rules)
            result = execute_atomic_test(test)
            detection = check_if_detected(result)

            if detection:
                log_success(technique_id, sigma_rules)
            else:
                escalate_to_analyst(technique_id, "Auto-detection failed")
        else:
            log_already_covered(technique_id)

The continuous purple improvement cycle

Purple teaming with AI is not a one-time exercise. It is a continuous cycle:

1. Intel: collect threat intelligence (feeds, reports, dark web). AI filters and prioritizes.
2. Plan: generate a simulation plan based on the most relevant actors and techniques. AI generates the plan.
3. Execute: the red team (or BAS) executes the techniques. AI can run atomic tests automatically.
4. Detect: the blue team analyzes whether each technique was detected. AI measures MTTD (Mean Time To Detect).
5. Improve: for each gap, generate a new detection, deploy it and verify. AI generates the rules.
6. Measure: calculate coverage metrics, MTTD, MTTR. AI generates the report and trends.
7. Repeat: return to step 1 with new intelligence and new capabilities.

With AI, this cycle can run weekly instead of quarterly. Detection coverage improves measurably and continuously.

Tools and frameworks

• MITRE ATT&CK Navigator: coverage and gap visualization. Free. Essential for any purple program.
• Atomic Red Team: atomic tests per ATT&CK technique. Open source. The foundation of all purple simulation.
• CALDERA: MITRE's adversarial simulation platform. Autonomous agents. Free.
• Vectr (Security Risk Advisors): platform for tracking purple exercises. Documents each tested technique, whether it was detected, and improvements implemented. Open source.
• Sigma: open format for detection rules. Compatible with Splunk, Elastic, Sentinel, QRadar.
• DeTT&CT: MITRE framework for measuring data visibility and detection coverage.

Ejercicio practico

Puntos clave