Solo Purple Teaming

Set up a solo purple team lab with Windows 11 and Kali Linux VMs to run Mythic C2 and practice red team and defense in a guided, hands-on environment.

Choose a realistic, practical C2 framework for solo purple teaming using Mythic, guided by threat intel, with Windows Apollo features like peer-to-peer, credential tracking, and Socks v5.

Baseline a PowerShell reverse TCP shell in a lab, recognizing normal behavior to support detections. Build and audit the payload, set up a listener, and observe connections.

Identify root cause of error 'script contained malicious content' by examining PowerShell run spaces and defender interactions, then explore in-memory PowerShell execution via C# run spaces to bypass defenses.

Explore how the Windows Defender anti-malware scan interface defends real-time execution, and how PowerShell runspaces in C# apps interact with memory; assess high-level bypass concepts and risks.

Demonstrate bypassing AMSI using x64dbg by tampering with the AMSI scan buffer to run a reversed PowerShell payload; patch bytes and observe defender behavior.

Learn to patch an AMC bypass by locating the AMC scan buffer, altering memory protections, and injecting a return instruction, while ethically disclosing findings and noting evolving defenses.

Explore the contrast between managed and unmanaged code under the CLR, analyzing memory management, garbage collection, security enforcement, and attack surfaces for red team operations.

Analyze how the amc interface detects real-time threats from script-based attacks and fileless malware, and view a full amc bypass demo with managed code, patching and a powershell reverse payload.

Recognize evasion techniques have a limited shelf life as security tools evolve. Stay agile and patch AMC related functions, including the Ansi bypass, to understand detection and execution.

Install mythic on a kali vm by preparing the system, installing docker and docker-compose, cloning the mythic repo, building binaries with make, and launching the mythic ui at localhost:7443.

Install the Apollo agent in the Mythic web UI via the CLI, configure http and smb c2 profiles, and verify Mythic access.

Explore reflection in .NET and PowerShell from a red team perspective, showing in-memory loading, dynamic method invocation, and fileless payloads, with detection considerations and living-off-the-land techniques.

Modify the Apollo agent to add a parameterless execute method for reflection. Generate and host the payload on http port 8000 and test reflective loading with Mythic stager.

Explore how antivirus software detects malware using signature and heuristic analysis, with real-time and cloud-based protection, and understand its core components and defense in depth strategy.

Explore red teaming techniques to bypass signature-based antivirus detections using threat check and the Mythic Apollo agent, testing payload evasions in private infrastructure.

Move the tuned Apollo agent code to the Mythic server and customize it for the workflow. Ensure the updated payload bypasses Defender and is fully functional before proceeding.

Practice solo purple teaming with two isolated LANs for attack path level zero, pfSense firewalls, a reverse engineering workstation, and Kali Linux C2 to master post-compromise techniques on Windows 11.

Set up two pfSense edge appliances in a Proxmox lab to simulate a level zero attack path, configuring WAN and LAN with static IPs and templates for rapid cloning.

Set a static 10.0.3.2 Kali IP with gateway 10.0.3.1 for the attack LAN, verify with pings to pf sense and the router, and configure DNS for internet access.

Configure firewall rules on the attack LAN edge to forward ports for mythic C2, SSH, and mythic UI, then test connectivity and pfSense nat configuration for attack level zero.

Set up a Windows 11 assumed breach host with a static 10.0.2.10 IP and gateway 10.0.2.3, then test connectivity across LAN and WAN and verify firewall rules in the lab.

Configure and test the Apollo payload across attack and echo LANs on assumed breach hosts using pfSense port forwarding and mythic http listener to validate C2 traffic.

Configure the E Corp edge pfSense appliance in the Proxmox lab, set static WAN and LAN IPs and route traffic through the E coin domain to the simulated internet.

Set up the E Corp domain controller in a lab by creating a VM template, configuring IP 10.0.1.2 and gateway 10.0.1.3, then promote with AD DS and DNS.

Add an assumed breach host to the echoing domain by creating a domain user and joining the host to the domain. Validate the join using DNS and a ping test.

Create a vulnerable Windows service and service account, configure local admin rights via group policy, and deploy a test service with sc create for level 0 attack path.

Execute level zero attack path in solo purple teaming, starting with initial access and defender bypass, then enumerate services, identify privilege escalation opportunities, and prepare Mythic UI basics for level-zero.

Introduce mythic ui basics and the mythic c2 framework for solo purple teaming, guiding how the dashboard, active callbacks, profiles and payload types support red team operations.

Explore Mythic user settings to add and manage users, set the admin password via the CLI, and customize font and UI for upcoming operations such as attack path level zero.

Launch and manage a red team operation for attack path level zero. Select an agent profile and payloads, then archive data for analysis and training with command block lists.

Generate and stage the Apollo payload, configure the reflective loader, and establish an initial foothold by connecting a payload to the mythic server over http in a controlled lab environment.

Demonstrate initial access and foothold in the echoing network by simulating phishing, valid credentials, and other entry vectors, using the Lockheed Martin cyber kill chain to test detections.

Explore mythic callbacks as live channels between the C2 server and deployed agents, enabling tasking, output, and metadata like process ID, username, and integrity level.

Demonstrate mythic tasking to issue commands to agents in the target environment, using manual and automated methods, with a feature-rich UI, opsec checks, previews, and tagging for efficient enumeration.

Walk through level zero enumeration to gain situational awareness after initial access, identifying current user, host and system info, services, and local administrators to plan privilege escalation.

Explore level zero privilege escalation in a solo purple team scenario, detailing vertical vs horizontal escalation and common techniques like misconfigured services and DLL hijacking to inform detections.

Configure allsafe edge device in a pfSense lab with wan 192.168.10.103 and lan 10.0.4.3, build a waza server for a centralized siem and edr on the lan, and verify connectivity.

Set up a Lubuntu VM and install the Wazuh server, configure a static IP on the allsafe LAN, and enable port forwarding to access the Wazuh dashboard via pfSense.

Configure port forwarding to the Wazuh server by creating nat rules for ports 1514, 1515, and 55000, directing traffic from the assumed breach host via edge devices to 10.0.4.2.

Install the Wazuh agent on the zoom breach host, configure the edge device port forwarding, and verify the agent reports to the Wazuh manager in the dashboard.

Install Sysmon on assume breach host in Allsafe LAN, import base config from GitHub, tailor rules to capture PowerShell activity, install via PowerShell, verify logs in Event Viewer.

Configure Wazuh to forward Sysmon and Windows Defender logs from Windows endpoints, organize agents into groups, enable log all json archives, and build searchable archives dashboards for centralized detection.

Set up syslog forwarding on the Echoing Edge device to send firewall events to the Wowza server, configure the Wazuh manager to receive syslog, and verify logs.

Design and tune detection engineering, including rules and analytics, for solo purple teaming, aligning with threat intelligence to make alerts proactive, reduce false positives, and strengthen security operations.

Explore the pyramid of pain, a model for ranking indicators of compromise from hashes to tactics and procedures, revealing how domains, ip addresses, and network artifacts aid detection and disruption.

Explore the trade offs between accuracy and coverage in detection engineering, and learn how true positives, true negatives, false positives, and false negatives shape precision, recall, and overall accuracy.

Balance telemetry volume with performance to enable timely, actionable detections while optimizing signal to noise and managing storage in solo purple teaming.

Identify detection opportunities for attack path level zero by auditing telemetry and Sysmon events in a solo purple team workflow, focusing on unsigned downloads and outbound connections.

Enable sysmon event id 1 and 3 on a breached host to collect process creation and network connection telemetry for developing detections in the wazuh manager.

Extend Sysmon telemetry by enabling event ID 7 for unsigned image loads, verify with Sigcheck, and validate detections in Windows logs and Wazuh manager.

Explore Sysmon file create events (id 11) on the host, filter downloads and autostart paths using exact, contains, begins with, ends with, and regex conditions to log initial access payload.

Explore PowerShell script block logging to capture full script contents, including initial access payload, and validate blue team detections and telemetry in a solo purple teaming lab.

Set up Wasa for blue team tracing activities, leveraging its open source siem features, rule engine, and xml rules to detect attacker behavior and build high-fidelity detections.

Create a custom rule to detect unsigned image loads for a base detection in a correlation rule, using Sysmon event ID seven and the solo purple teaming C2 group.

Build and test a base rule to detect network connections to common C2 ports (80 or 403) from downloads or Windows temp locations, then configure alerts in the Wazuh manager.

Correlate two base rules by time to build higher fidelity detections for possible c2 activity, triggering when 100100 and 100101 occur within a two-second window.

Build an advanced correlation engine that links security events by meaningful relationships, not coincidence, using time windows and process or user context to detect multi-step threats for solo purple teaming.

Refine the advanced correlation engine by parsing host name and image fields from alerts, embedding them in the output to improve context for detections.

Continue building an advanced correlation engine by writing alerts to a JSON log (correlation.json), enabling Wazuh manager monitoring, and designing a decoder to visualize correlation alerts on a dashboard.

Finish building an advanced correlation engine with a systemd service, log rotation, and monitoring correlation json with the Wasa manager. Create custom decoders and rules to surface alerts.

Hunt for malicious PowerShell traces using script block logging to enable precise behavior-based detections. Build and test PowerShell detections in a solo purple teaming lab.

Create a custom PowerShell reflection rule with ID 100103 and level 15, using CID 9102 (PowerShell script block logging), then validate it in the manager and run initial access payload.

Build a solo purple teaming dashboard to turn logs into real-time visibility, monitor rule performance, and rapidly assess alerts, detections, and feedback for continuous improvement.

Rerun the level zero attack in solo purple teaming to validate detection rules and correlations, uncover gaps, and refine tooling through end-to-end re-engagement and reflection.

Explore how threat intelligence informs the iterative solo purple teaming process to develop bypasses through targeted research and align with real world threats.

Explore level one of the red team layout, deepen offense and defense by bypassing detections from the run dialog to lateral movement. Practice evasions for unsigned images and reflection-based loading.

Operate a red team technique by using the run box to reflectively load the Apollo implant into memory, bypassing disk writes and common defenses, with a compact PowerShell one-liner.

Examine how dotnet app domains isolate code and enable in-memory loading of assemblies, explore reflection-based techniques in PowerShell, and discuss bypassing brittle detections in red team testing.

Build red team service enumeration tool to scan endpoint services for modifiability and privilege escalation, using a C# .NET console app with ServiceController and WMI, run in memory via Apollo.

Continue building a windows service enumeration tool using PInvoke to call OpenSCManager, OpenService, and QueryServiceObjectSecurity, marshal data, and extract the service security descriptor for auditing.

Develop a red team service enumeration tool that checks if the current user can start services by parsing security descriptors, including sddl, dacl, ace types, and security identifiers.

finish a service scan utility that uses wmi to fetch win32 service paths and analyze file security with sids to determine if current user can start or modify the service.

Practice solo purple teaming by staging and executing a .NET service scan assembly in memory, then explore dynamic injection techniques to bypass Windows Defender and observe defense evasion.