Active › Module 9 › Lesson 3
Purple Loop
Purple team loop literacy — plan, exercise, detect, fix, retest on $LAB_AD; improve detection without stranger-domain attacks.
Visual · t25_purple_loop
Purple loop = plan exercise detect fix retest. $LAB_AD RoE. Original Cyberlium.
Opening
Purple closes the loop when the alert fires after the fix — not when red hides from SIEM on a network they do not own.
Purple team loop: (1) select technique from ATT&CK map gap; (2) authorized exercise on $LAB_AD per brief — simulate or controlled red touch; (3) blue validates Event IDs and alerts; (4) implement remediation from Module 9-2; (5) retest — confirm alert still fires or gap closed per goal; (6) document in report. Explicit refuse: purple as cover for unauthorized AD attacks, disabling EDR/SIEM during exercise on production, 'purple' on stranger domains, log clearing after exercise. Cyberlium purple is detection uplift on lab — paired with honeytokens and tuned rules. Output: one completed loop diagram with UTC milestones and honest gap if detection still missing.
1. Loop steps
Plan → exercise → detect → remediate → retest → document — six steps minimum.
RoE lists allowed hosts and techniques — stop if brief omits live red.
Command guide
Try these commands — Loop steps
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
Purple team — https://attack.mitre.org/ (attack + detect loop literacy) Microsoft SOC — https://learn.microsoft.com/en-us/security/operations/ (purple collaboration) BloodHound — https://bloodhound.specterops.io/ (validate path fixes in lab graph)
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install curl
macOS: Built-in
Windows: Built-in (PowerShell: Invoke-WebRequest)
═══ LINUX / macOS ═══
Command — copy this
export LAB_AD=${LAB_AD:-$HOME/cyberlium-lab/t25-ad}
cat > "$LAB_AD/notes/purple-loop.txt" <<'EOF'
purple loop (YOUR lab):
1. Name attack path (literacy — no execution on strangers)
2. Draft detection (Event ID + SIEM rule concept)
3. Apply mitigation in lab (gMSA, tiering, audit policy)
4. Re-check BloodHound graph in lab — edge should shrink
5. Document for blue handoff
EOFCommand — copy this
grep -E 'purple|detection|mitigation|BloodHound' "$LAB_AD/notes/purple-loop.txt" curl -sS https://learn.microsoft.com/en-us/security/operations/ | head -6
Primary tools to practice this lesson: grep, curl. Reference sites: Purple team (https://attack.mitre.org/); Microsoft SOC (https://learn.microsoft.com/en-us/security/operations/); BloodHound (https://bloodhound.specterops.io/). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Blue collaboration
Share expected Event IDs with blue before exercise — no surprise on owned lab.
Findings feed ticketing — purple is not red team trophy hunting.
3. Refused
No anti-forensics after purple, no stranger AD, no public hash drops from exercise.
If detection fails — document gap honestly; don't skip retest.
4. What you ship: purple loop diagram
Six steps + one $LAB_AD completed loop + UTC milestones + gap note.
5. What you record before the next lesson
Purple loop diagram path.
6. Wrong vs right: stranger-domain attacks vs lab AD literacy
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Run unauthorized Kerberoast on employer AD and call it purple team.
Right
Purple loop diagram on authorized $LAB_AD. Next: Report Lab.
Mission: purple loop diagram
1) Write six loop steps. 2) Complete one loop on $LAB_AD or tabletop. 3) UTC milestones. 4) Refuse unauthorized purple line.
Stuck? Ask Cyberlium AI Mentor
Ask Mentor: “Tabletop loop — minimum documentation?”
Knowledge Check
APPLY: Purple loop includes:
Multiple choice
Knowledge Check
APPLY: True or False: Purple justifies unauthorized AD testing.
True or False
Knowledge Check
APPLY: After remediation purple retest confirms:
Multiple choice