PurpleSharp playbook

PurpleSharp.exe --playbook <yml>

Executes a technique playbook with PurpleSharp, validating multiple detections in a single pass over the test host.

Run it in the purple team lab when you want to validate multiple techniques at once: PurpleSharp launches the techniques defined in the YAML playbook (the list of techniques with their commands: dumping, persistence, injection, lateral movement) and the team verifies what was detected for each one. It's multi-technique validation: the playbook with the in-scope techniques, executed sequentially, and coverage measured per technique. In purple teaming, PurpleSharp is the Windows validation tool (alongside Atomic Red Team): the playbook is designed with the techniques from the matrix and the result feeds coverage.

Don't run it in production: the techniques are real (dumping, injection) — the lab is the place. The noise of the full playbook is planned (SOCs notified, the window). And watch out: the playbook validates the defined techniques — those in the exercise scope; techniques outside the playbook are not tested. The playbook design (technique selection, commands) is the quality of the exercise: it's reviewed before execution. Per-technique verification (events and alerts for each) requires telemetry connected to the SIEM: without it, the result is manual. Cleanup of playbook artifacts is part of the flow.