Purple Sharp

PurpleSharp.exe --playbook <yml>

Executes real attack techniques (ATT&CK playbooks) on a Windows host to validate that SOC detections see them.

Run it in the purple team lab (or on a test host in the environment) when you want to validate that your detections actually work: PurpleSharp launches real techniques — process creation, injection, simulated LSASS dumping, persistence, lateral movement — defined in a YAML playbook, and the team confirms which ones generated an alert. It's the way to turn the Navigator layer (059) into something verified: the technique scored as 'covered' is executed and you check if the rule fired. In an environment with EDR and SIEM, the playbook runs and the resulting events are correlated with alerts — the full detection validation cycle.

Don't run it in production: the techniques are real (though simulated) and generate events, processes, and, in the case of dumping, accesses to lsass that EDRs may block or SOCs may treat as an incident — the lab or an isolated host is the place. The noise of the exercise must be planned (blue teams notified, rules in test mode). And beware: PurpleSharp validates detection, not prevention — a technique that generates the correct alert but that the EDR lets run is a valid result of the exercise, not a failure. The quality of the playbook decides the quality of the exercise: write techniques that you have mapped in the layer, not the ones you already know work.