PurpleKeep: Providing Azure pipelines to create an infrastructure and run Atomic tests

PurpleKeep

With the rapidly increasing variety of attack techniques and a simultaneous rise in the number of detection rules offered by EDRs (Endpoint Detection and Response) and custom-created ones, the need for constant functional testing of detection rules has become evident. However, manually re-running these attacks and cross-referencing them with detection rules is a labor-intensive task which is worth automating.

To address this challenge, I developed “PurpleKeep,” an open-source initiative designed to facilitate the automated testing of detection rules. Leveraging the capabilities of the Atomic Red Team project which allows to simulate attacks following MITRE TTPs (Tactics, Techniques, and Procedures). PurpleKeep enhances the simulation of these TTPs to serve as a starting point for the evaluation of the effectiveness of detection rules.

Automating the process of simulating one or multiple TTPs in a test environment comes with certain challenges, one of which is the contamination of the platform after multiple simulations. However, PurpleKeep aims to overcome this hurdle by streamlining the simulation process and facilitating the creation and instrumentation of the targeted platform.

Primarily developed as a proof of concept, PurpleKeep serves as an End-to-End Detection Rule Validation platform tailored for an Azure-based environment. It has been tested in combination with the automatic deployment of Microsoft Defender for Endpoint as the preferred EDR solution. PurpleKeep also provides support for security and audit policy configurations, allowing users to mimic the desired endpoint environment.

To facilitate analysis and monitoring, PurpleKeep integrates with Azure Monitor and Log Analytics services to store the simulation logs and allow further correlation with any events and/or alerts stored in the same platform.

TLDR: PurpleKeep provides an Attack Simulation platform to serve as a starting point for your End-to-End Detection Rule Validation in an Azure-based environment.

Design

Infrastructure

Deploying the infrastructure uses the Azure Pipeline to perform the following steps:

• Deploy Azure services:
  • Key Vault
  • Log Analytics Workspace
  • Data Connection Endpoint
  • Data Connection Rule
• Generate SSH keypair and password for the Windows account and store in the Key Vault
• Create a Windows 11 VM
• Install OpenSSH
• Configure and deploy the SSH public key
• Install Invoke-AtomicRedTeam
• Install Microsoft Defender for Endpoint and configure exceptions
• (Optional) Apply security and/or audit policy files
• Reboot

Install