Purple Team Operations

Purple Team.

Operating across both sides of the kill chain — Red Team adversary simulation and Blue Team detection engineering — as a unified discipline.

Active Arch Linux user · CTF competitor · Cloud IAM researcher · LLM security practitioner.

Red & Blue Capabilities ← Back to Portfolio
The Two Sides

Offense & Defense

Purple Team is not a compromise — it's the deliberate fusion of adversarial thinking with detection precision.

Red Team · Offense

Attack Simulation

Thinking like an adversary. Mapping attack surfaces, abuse paths, and exploitable gaps before they become incidents.

  • Reconnaissance & OSINT
  • Cloud IAM privilege escalation
  • Web application exploitation
  • Adversary TTPs mapping (MITRE ATT&CK)
  • Proof-of-concept development
  • Social engineering simulation
Blue Team · Defense

Detection Engineering

Translating attacker behaviour into detection logic. Building systems that catch what most tools miss.

  • SIEM rule authoring & tuning
  • Anomaly detection & baselining
  • Log analysis & threat hunting
  • Incident response playbooks
  • Cloud security monitoring (AWS/GCP)
  • LLM-assisted alert triage
Methodology

How Purple
Works

The loop between attack and detect — run continuously, not once.

01

Simulate the Attack

Execute an adversary technique against a real environment — cloud, endpoint, or application layer.

02

Observe the Gap

Check whether the attack generated a log, triggered an alert, or passed through silently. Document the visibility gap.

03

Engineer Detection

Write detection logic — SIEM rules, queries, or ML models — that reliably catches the technique without excess noise.

04

Validate & Loop

Re-run the attack to confirm detection fires. Iterate on evasion variants until the rule is robust.

Red
Blue
Purple
Team
Active Work

Current
Capabilities

Research, builds, and ongoing efforts across the full purple team spectrum.

Red

Vulnerability Research

Actively identifying and responsibly disclosing vulnerabilities on HackerOne and Intigriti across web and cloud targets.

Blue

Detection Prototyping

Building proof-of-concept detection pipelines that convert MITRE ATT&CK techniques into inspectable, testable SIEM rules.

Purple

LLM-Assisted Triage

Using large language models to summarize alerts, cluster anomalies, and surface high-confidence findings from noisy logs.

Red

Cloud IAM Exploitation

Enumerating misconfigured IAM policies, privilege escalation paths, and cross-account trust relationships in AWS & GCP environments.

Blue

Threat Hunting

Hypothesis-driven log hunting across CloudTrail, VPC Flow Logs, and endpoint telemetry for indicators of living-off-the-land attacks.

Purple

AI Red-Teaming

Probing LLM-based systems for prompt injection, data exfiltration, and jailbreaking — then designing guardrails that hold.

Simulated Output

The Loop in Action

purple-team-ops — bash
┌──[purple@ops]─[~]
└─$ python3 simulate.py --technique T1078 --env aws-staging
[*] Simulating: Valid Accounts — Cloud Accounts (T1078.004)
[*] Using stolen IAM key: AKIA••••••••REDACTED
[*] Calling sts:GetCallerIdentity ... ✓ success
[*] Enumerating S3 buckets .............. ✓ 14 found
[!] Exfil attempt on s3://internal-logs ... ✗ blocked

└─$ python3 hunt.py --source cloudtrail --lookback 1h
[*] Searching CloudTrail for anomalous GetCallerIdentity calls ...
[*] Cross-referencing with baseline user agents ...
[+] ALERT FIRED — Rule: Unusual IAM Source IP + User-Agent mismatch
[+] Confidence: HIGH | Technique: T1078.004 | MITRE Stage: Initial Access

└─$ python3 validate.py --rule iam-anomaly-001 --rerun
[*] Re-executing technique ...
[✓] Detection triggered in 00:00:03. Alert written to SIEM.
[✓] Rule validated. Coverage confirmed for T1078.004.

└─$

Ready to work together?

Let's Build
Better Defenses.

If you're running a security team and need someone who can attack, detect, and iterate — let's talk.