Name & Direct Link: Constructing Defense

Platform: Constructing Defense

Cost: $150 (get 25% off using code: DFIRDIVA)

Proof of Completion: Certificate of Completion

Topics Include: 

• Lab Construction and Provisioning
• Terraform Setup
• Domain Controller
• Windows 11
• Certer
• Linux
• PCAP
• Cloud Accounts (Azure, AWS)
• Kubernetes Setup
• Sysmon Setup
• Telemetry Setup & Miscellaneous Lab Configuration
• Windows Auditing and GPO Setup
• Linux Auditd + Laurel
• SIEM
• Windows and Linux Event Collection
• Kubernetes Monitoring
• Cloud Collection
• Lab Executions
• Credential Access
• Lateral Movement
• Threat Detection
• LOLBAS / LOLBINs

Name & Direct Link: Practical Purple Teaming 101

Platform: BlackPerl DFIR Academy

Cost: $18

Hands-On: Yes

Proof of Completion: Certificate

Community: There is a BlackPerl DFIR Discord Server

Topics:

• Set up Your Lab
• Introduction to Red Teaming
• Red Team Manual Simulation
• Red Team Automated Simulation
• Introduction to Blue Teaming
• Pyramid of Pain in Blue Teaming
• Create Detections
• Create Alerting System
• Introduction to Purple Teaming
• Discovery Scan Attack & Defend
• Network Based Attack & Defend
• Host Based Attack & Defend
• Follina Exploit Attack & Defend

Name & Direct Link: Certified Purple Team Analyst V2 [CPTA V2]

Platform: CyberWarFare Labs

Cost: $199

Proof of Completion: Certification

Topics:

• Introduction to Purple Teaming
• Offensive Security Techniques
• Red Team Lifecycle
• Adversary Simulation using MITRE ATT&CK Framework
• Defensive Security Strategies
• Adversary Detection using MITRE D3FEND
• Defensive Security Tools and Technique
• SIEM
• Incident Response
• Threat Intelligence
• Incident Management
• OSQuery
• Network Monitoring
• Security Testing Methodologies
• Web Exploitation and Detection
• Network Exploitation and Detection
• Host Exploitation and Detection
• AD Exploitation and Detection

Name & Direct Link: Pwned Labs

Platform: Pwned Labs

Cost: Basic – Free, Pro – $20/month or $200/year

Good For Beginners: Yes – There are labs labeled as “Beginner”

Community: There is a Pwned Labs Discord Server

Description: Hands-On Security Cloud Labs. There are labs for both blue and red teams. Including DFIR-type labs such as “Investigate Threats with Amazon Detective” and “Breach in the Cloud”.

Name & Direct Link: Enterprise Purple Teaming

Platform: GitHub

Topics: Enterprise Purple Teaming: An Exploratory Qualitative Study (dissertation), Purple Team Frameworks, Practitioner Resources, Training, Purple Team Tools

Name & Direct Link: Intermediate Purple Teaming Learning Path

Platform: AttackIQ Academy

Cost: Free

Proof of Completion: Badge

Topics: Foundations of Purple Teaming, Operationalizing MITRE ATT&CK, Foundations of Breach & Attack Simulation, Threat Alignment for Purple Teams, Emulation Planning for Purple Teams

Name & Direct Links:

SANS Purple Team Summit 2021 Playlist

Purple Teaming Explained

Platform: YouTube

Topics: Threat Focused Purple Team Exercises, Exploit Mitigations for Purple Teams, Intro to Adversary Emulation & Its Place in Security Operations, Simulating Supply Chain Attacks, Evaluating the Cost of New Technology, Grow Your Skills, Attack of the Emulators, Red Team Engagements: Training Your Blue Team to Hunt Adversaries, The Active Directory Purple Team Playbook, Purple Team War Stories, Designing Playbooks with Purple Team Approach, MITRE ATT&CK, Purple Team Feedback Loop

Name & Affiliate Link*: Purple Teaming: The Big Picture

Platform: Pluralsight

Price: $29/Month or up to $499/Year

Topics: Identifying Challenges, The Role of the Purple Team, High-Level Planning, Finding Value-Oriented Opportunities, Scaling up the Purple Team Exercise, Coming up with Scenarios, Using Existing Standards and Frameworks, Evaluating the Results

*DFIR Diva is an affiliate of Pluralsight and receives a small percentage of sales made through affiliate links that go toward keeping the site running.

Book Title: Purple Team Field Manual

Author: Tim Bryant

Where to Buy (link):

Amazon*

Topics: MITRE Techniques, attack, capture, defend

*As an Amazon Associate I earn from qualifying purchases. This helps with the cost of running this website.

Name & Direct Link: Picus Purple Academy

Platform: Picus

For Beginners: Yes

Proof of Completion: Yes – Certificate

Learning Paths and Topics:

Continuous Security Validation Learning Path: Use Cases, Breach and Attack Simulation

Proactive Security Operations Center (SOC) Learning Path: Threat Hunting, Log Management Practices, SIEM Alert Rule Development, Operationalizing MITRE ATT&CK for SOCs, Endpoint Detection and Response (EDR).

The MITRE ATT&CK Framework Learning Path: Absolute Beginners Guide to MITRE ATT&CK, Process Injection, PowerShell, Credential Dumping, Masquerading, Windows Command Shell, Command and Scripting Interpreter, Scheduled Task/Job, Registry Run Keys / Startup Folder, System Information Discovery, Impair Defenses

Ransomware Attacks Learning Path: Basics, TTPs, Countermeasures, Detection in the Early Phases of the Attack Lifecycle, Detection in the Late Phases of the Attack Lifecycle