Adversary Emulation & Control Validation (purple.6b74.dev)
Same static HTML/JS architecture as hunt.6b74.dev, separating offensive trigger commands, prerequisites, cleanup steps, and validation logs into a dedicated workspace without cluttering blue-team hunt workflows. Indicators are keyed by exact ATT&CK ID for 1-to-1 cross-reference.
NET · Network & Cloud Emulation
Validate network sensors (Zeek, Suricata, PCAP, NetFlow) and cloud control planes (CloudTrail, Entra ID, GCP Audit Logs) with reproducible CLI triggers and copyable CMS validation notes.
HOST · Endpoint & System Emulation
Test Sysmon, Windows Security Event Logs, Linux auditd, and EDR behavioral detections across Collection, Credential Access, Defense Evasion, Discovery, Execution, Impact, Lateral Movement, Persistence, and Privilege Escalation.
Both hunt.6b74.dev and purple.6b74.dev index by exact ATT&CK ID (T1003.001, T1078.004), allowing instant 1-to-1 cross-reference links.
Every indicator pairs an operator execution command with explicit cleanup instructions so test artifacts are never left behind on target hosts.
Marking any technique builds a structured ## TAG - PURPLE - <TACTIC> Markdown block recording execution time, command run, cleanup status, and Blue Team outcome.
Engagement Rollup
Combined NET + HOST validation report for everything marked Blocked, Alerted, Logged Only, or Missed this session.