Teach on Udemy

Turn what you know into an opportunity and reach millions around the world.

Learn More

Your cart is empty.

Keep shopping

Solo Purple Teaming

Name: Solo Purple Teaming
Rating: 4.9 (21 reviews)

Bridging Red and Blue for Stronger Cyber Defenses

Created byJosh G, Mike S

Last updated 1/2026

English

What you'll learn

Learn advanced red team tactics to bypass signature based detections.
Learn advanced red team tactics to bypass behavioral based detections.
Learn advanced blue team tactics to build detections to detect advanced tactics, techniques, and procedures.
Learn how to conduct solo purple team scenarios to improve both red and blue team skills.

Course content

15 sections • 92 lectures • 18h 15m total length

Course Introduction6:23
Solo Purple Teaming8:41
Scenario One3:12

Red Team Layout -> Initial Lab Setup2:07
Red Team Layout -> Choosing C2 Framework3:14
Red Team Layout -> PowerShell Reverse Shell Without Defender6:18
Red Team Layout -> Determining Root Cause22:53
Red Team Layout -> What is AMSI?3:37
Red Team Layout -> ByPass AMSI Using x64dbg7:22
Red Team Layout -> When Patching Doesn't Go As Planned15:10
Learn to patch an AMC bypass by locating the AMC scan buffer, altering memory protections, and injecting a return instruction, while ethically disclosing findings and noting evolving defenses.
Red Team Layout -> Introduction to Managed Code and .NET Assemblies6:55
Red Team Layout -> Full AMSI ByPass24:07
Red Team Layout - A Warning and a Challenge1:35
Red Team Layout - Installing Mythic C2 Framework6:56
Red Team Layout - Installing Apollo Agent and a Couple C2 Profiles8:17
Install the Apollo agent in the Mythic web UI via the CLI, configure http and smb c2 profiles, and verify Mythic access.
Red Team Layout -> Introduction to Reflection21:49
Red Team Layout -> Prepping Apollo for Reflection10:25
Red Team Layout -> Introduction to AV8:27
Red Team Layout -> Bypassing Signature-Based Detections12:32
Red Team Layout -> Moving Custom Apollo to Mythic Server18:06
Move the tuned Apollo agent code to the Mythic server and customize it for the workflow. Ensure the updated payload bypasses Defender and is fully functional before proceeding.

Lab Setup for Level 0 Attack Path Outline2:09
Practice solo purple teaming with two isolated LANs for attack path level zero, pfSense firewalls, a reverse engineering workstation, and Kali Linux C2 to master post-compromise techniques on Windows 11.
Lab Setup for Level 0 Attack Path - Setting Up Edge Appliances23:36
Lab Setup for Level 0 Attack Path - Moving Kali to Attack LAN7:26
Set a static 10.0.3.2 Kali IP with gateway 10.0.3.1 for the attack LAN, verify with pings to pf sense and the router, and configure DNS for internet access.
Lab Setup for Level 0 Attack Path - Configuring Firewall Rules for Attack LAN11:51
Lab Setup for Level 0 Attack Path - Setting Up Assumed Breach Host8:52
Lab Setup for Level 0 Attack Path - Testing Apollo on Assumed Breach Host9:49
Configure and test the Apollo payload across attack and echo LANs on assumed breach hosts using pfSense port forwarding and mythic http listener to validate C2 traffic.
Lab Setup for Level 0 Attack Path - Setting Up ECORP Edge Appliance12:44
Configure the E Corp edge pfSense appliance in the Proxmox lab, set static WAN and LAN IPs and route traffic through the E coin domain to the simulated internet.
Lab Setup for Level 0 Attack Path - Setting Up ECORP Domain and DC22:49
Lab Setup for Level 0 Attack Path - Joining Assumed Breach Host to ECOIN Domain10:38
Lab Setup for Level 0 Attack Path - Creating Service Account and Service23:17

Red Team Engage - Review Attack Path Level 02:32
Red Team Engage - Introduction to Mythic UI3:36
Introduce mythic ui basics and the mythic c2 framework for solo purple teaming, guiding how the dashboard, active callbacks, profiles and payload types support red team operations.
Red Team Engage - Mythic User Settings5:10
Explore Mythic user settings to add and manage users, set the admin password via the CLI, and customize font and UI for upcoming operations such as attack path level zero.
Red Team Engage - Create Operation for Level 0 Attack Path5:48
Red Team Engage - Generate Payload for Attack Level 09:42
Red Team Engage - Establish Foothold In ECOIN9:40
Red Team Engage- Mythic Callbacks UI7:00
Red Team Engage - Mythic Tasking5:14
Demonstrate mythic tasking to issue commands to agents in the target environment, using manual and automated methods, with a feature-rich UI, opsec checks, previews, and tagging for efficient enumeration.
Red Team Engage - Enumeration10:53
Red Team Engage- Privilege Escalation42:15

Lab Setup For Blue Team Activities - Setting Up The AllSafe Edge Device6:52
Lab Setup For Blue Team Activities - Setting Up Wazuh Server15:14
Set up a Lubuntu VM and install the Wazuh server, configure a static IP on the allsafe LAN, and enable port forwarding to access the Wazuh dashboard via pfSense.
Lab Setup For Blue Team Activities - Port Forwarding to Wazuh Server4:08
Lab Setup For Blue Team Activities - Installing Wazuh Agent on Assumed Breach4:07
Install the Wazuh agent on the zoom breach host, configure the edge device port forwarding, and verify the agent reports to the Wazuh manager in the dashboard.
Lab Setup For Blue Team Activities - Installing Sysmon on Assumed Breach4:58
Lab Setup For Blue Team Activities - Configuring Wazuh for Defender and Sysmon17:47
Lab Setup For Blue Team Activities - Sending Syslog Events From ECOIN Edge15:16

What is Detection Engineering?1:52
Pyramid of Pain3:20
Explore the pyramid of pain, a model for ranking indicators of compromise from hashes to tactics and procedures, revealing how domains, ip addresses, and network artifacts aid detection and disruption.
Balancing Accuracy VS Coverage4:16
Balancing Telemetry VS Performance4:37
Balance telemetry volume with performance to enable timely, actionable detections while optimizing signal to noise and managing storage in solo purple teaming.

Blue Team Explore - Detection Opportunities9:46
Blue Team Explore - Sysmon ProcessCreate Event ID 1 & NetworkConnect Event ID 327:56
Blue Team Explore - Sysmon ImageLoad Event ID 710:05
Blue Team Explore - Sysmon FileCreate Event ID 1110:25
Explore Sysmon file create events (id 11) on the host, filter downloads and autostart paths using exact, contains, begins with, ends with, and regex conditions to log initial access payload.
Blue Team Explore - PowerShell ScriptBlock Logging10:14

Blue Team Trace - Setting Up Wazuh for Trace Activities13:15
Blue Team Trace - Build Custom Rule for Unsigned ImageLoads5:55
Create a custom rule to detect unsigned image loads for a base detection in a correlation rule, using Sysmon event ID seven and the solo purple teaming C2 group.
Blue Team Trace - Build Custom Rule for Network Connect to Common C2 Port4:37
Blue Team Trace - Build Custom Correlation Rule8:25
Blue Team Trace - Building Advanced Correlation Engine - Part 143:00
Blue Team Trace - Building Advanced Correlation Engine - Part 210:36
Blue Team Trace - Building Advanced Correlation Engine - Part 39:56
Blue Team Trace - Building Advanced Correlation Engine - Part 433:43
Blue Team Trace - Hunting For PowerShell IOCs and Building Detections10:43
Blue Team Trace - Creating Custom Rule for PowerShell Reflection4:30
Blue Team Trace - Improving Solo Purple Teaming Detection Dashboard13:05

Red Team Layout - Using Threat Intel to Formulate Next Attack Path2:22
Explore how threat intelligence informs the iterative solo purple teaming process to develop bypasses through targeted research and align with real world threats.
Red Team Layout - Attack Path Level 12:37
Red Team Layout - Using Run Box to Bypass UnSigned ImageLoads From Downloads15:10
Red Team Layout - Using Application Domain to Bypass Reflection Detection16:51
Red Team Layout - Writing A Service Enumeration Tool - Part 19:13
Red Team Layout - Writing A Service Enumeration Tool - Part 21:01:53
Continue building a windows service enumeration tool using PInvoke to call OpenSCManager, OpenService, and QueryServiceObjectSecurity, marshal data, and extract the service security descriptor for auditing.
Red Team Layout - Writing A Service Enumeration Tool - Part 315:41
Red Team Layout - Writing A Service Enumeration Tool - Part 427:19
Red Team Layout - Testing Service Enumeration Bypass18:51
Practice solo purple teaming by staging and executing a .NET service scan assembly in memory, then explore dynamic injection techniques to bypass Windows Defender and observe defense evasion.

Requirements

Warning! This is an advanced course that requires intermediate knowledge of networking, red team tactics, and blue team tactics.

Description

In cybersecurity, most training only scratches the surface—teaching which buttons to press, but not why, when, or how to adapt when the situation changes. This leaves a critical gap between basic tool familiarity and the deep operational mastery required for real-world engagements.

Solo Purple Teaming closes that gap. It trains you to think and operate as both an attacker and a defender, where your limits aren’t dictated by step-by-step lab manuals, but by your creativity, problem-solving skills, and willingness to push beyond your comfort zone and explore new tactics.

The course is built around four focused phases designed to level up your skills: Layout, Engage, Explore, and Trace.

In Layout, you prepare like a professional operator—balancing maximum effectiveness with strict operational security. From initial reconnaissance to privilege escalation, you’ll learn to bypass defenses such as Windows Defender, AMSI, and others, setting the stage for success.

In Engage, you execute your attack path with precision—moving carefully through the network, maintaining stealth, and accomplishing your objectives.

In Explore, you switch to the defender’s mindset—identifying telemetry gaps, spotting blind spots, and uncovering detection opportunities others might miss.

In Trace, you reverse engineer payloads, analyze attack mechanics, and craft high-fidelity detections designed to withstand sophisticated evasion attempts.

This advanced and demanding course is intentionally built to foster independence and true mastery. If you’re ready to sharpen both your red and blue skills, Solo Purple Teaming is the course for you!

Who this course is for:

Cyber security professionals looking to develop advanced blue and red team skills.

Solo Purple Teaming

What you'll learn

Explore related topics

Course content

Introduction3 lectures • 18min

Red Team Layout For Level 017 lectures • 3hr

Lab Setup For Level 010 lectures • 2hr 13min

Red Team Engage For Level 010 lectures • 1hr 42min

Lab Setup For Blue Team Activities7 lectures • 1hr 8min

Detection Engineering 1014 lectures • 14min

Blue Team Explore For Level 05 lectures • 1hr 8min

Blue Team Trace For Level 011 lectures • 2hr 38min

Red Team Re-Engage For Level 01 lecture • 18min

Red Team Layout For Level One - Bypassing New Level 0 Detections9 lectures • 2hr 50min

Requirements

Description

Who this course is for: