Purple Loop
Purple team loop literacy — plan, exercise, detect, fix, retest on $LAB_AD; improve detection without stranger-domain attacks.
Visual · t25_purple_loop
Purple loop = plan exercise detect fix retest. $LAB_AD RoE. Original Cyberlium.
Purple closes the loop when the alert fires after the fix — not when red hides from SIEM on a network they do not own.
Purple team loop: (1) select technique from ATT&CK map gap; (2) authorized exercise on $LAB_AD per brief — simulate or controlled red touch; (3) blue validates Event IDs and alerts; (4) implement remediation from Module 9-2; (5) retest — confirm alert still fires or gap closed per goal; (6) document in report. Explicit refuse: purple as cover for unauthorized AD attacks, disabling EDR/SIEM during exercise on production, 'purple' on stranger domains, log clearing after exercise. Cyberlium purple is detection uplift on lab — paired with honeytokens and tuned rules. Output: one completed loop diagram with UTC milestones and honest gap if detection still missing.
1. Loop steps
Plan → exercise → detect → remediate → retest → document — six steps minimum.
RoE lists allowed hosts and techniques — stop if brief omits live red.
Command guide
Try these commands — Loop steps
═══ WINDOWS / POWERSHELL (Active Directory Lab) ═══
Check current user, domain context, and security privileges
Command — copy this
whoami /user /groups /priv
Query active Domain Controller and trust relationships
Command — copy this
nltest /dsgetdc:$env:USERDOMAIN nltest /domain_trusts
List password policy across the domain
Command — copy this
net accounts /domain
Check Kerberos ticket cache
Command — copy this
klist
═══ LINUX / BASH (Lab Network) ═══ Test DNS SRV resolution for Active Directory services
Command — copy this
dig _ldap._tcp.dc._msdcs.lab.local SRV +short dig _kerberos._tcp.dc._msdcs.lab.local SRV +short
Primary tools to practice this lesson: grep, curl. Reference sites: Purple team (https://attack.mitre.org/); Microsoft SOC (https://learn.microsoft.com/en-us/security/operations/); BloodHound (https://bloodhound.specterops.io/). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Blue collaboration
Share expected Event IDs with blue before exercise — no surprise on owned lab.
Findings feed ticketing — purple is not red team trophy hunting.
3. Refused
No anti-forensics after purple, no stranger AD, no public hash drops from exercise.
If detection fails — document gap honestly; don't skip retest.
4. What you ship: purple loop diagram
Six steps + one $LAB_AD completed loop + UTC milestones + gap note.
5. What you record before the next lesson
Purple loop diagram path.
6. Wrong vs right: stranger-domain attacks vs lab AD literacy
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
- Wrong: Run unauthorized Kerberoast on employer AD and call it purple team.
- Right: Purple loop diagram on authorized $LAB_AD. Next: Report Lab.
Mission: purple loop diagram
1) Write six loop steps. 2) Complete one loop on $LAB_AD or tabletop. 3) UTC milestones. 4) Refuse unauthorized purple line.
Stuck? Ask Cyberlium AI Mentor
Ask Mentor: “Tabletop loop — minimum documentation?”
APPLY: Purple loop includes:
APPLY: True or False: Purple justifies unauthorized AD testing.
APPLY: After remediation purple retest confirms: