Purple Edge
Get started

Purple Team Exercises

advanced5 labsSubscription

Advanced attack-and-detect capstones: run a red action, then detect and respond to it in the SIEM/EDR — covering web exploitation, AD attacks, lateral movement, ransomware, and C2 beaconing.

This path is available with a Purple Edge subscription. Sign in to read the full overview and start the labs.

Labs in this path

  1. 1
    advanced Hands-on lab Subscription

    Detect a Web-Exploit Chain

    Red: drop a webshell through a file-upload exploit. Blue: detect the exploitation attempt and the tell-tale child process the web service spawns when the shell runs.

    45 min3 tasksPurple Team
  2. 2
    advanced Hands-on lab Subscription

    Detect Kerberoasting & AD Attacks

    Red: Kerberoast service accounts from Kali to crack their passwords offline. Blue: detect the burst of anomalous TGS (service-ticket) requests and the weak RC4 encryption that gives the attack away.

    45 min3 tasksPurple Team
  3. 3
    advanced Hands-on lab Subscription

    Detect Lateral Movement

    Red: move laterally with PsExec/WMI to execute commands on a remote host. Blue: detect the remote execution through the service the tool installs and the network logon it produces.

    45 min3 tasksPurple Team
  4. 4
    advanced Subscription

    Detect & Respond to Ransomware Behavior

    Red: run a benign ransomware simulation that mass-renames/encrypts files and deletes the shadow copies. Blue: detect the burst of file changes and the anti-recovery command, then contain the host.

    50 min4 tasksPurple Team
  5. 5
    advanced Hands-on lab Subscription

    Detect C2 Beaconing

    Red: launch a C2 implant that beacons back to your team server. Blue: detect the regular, low-and-slow callback pattern and tie the network connection back to the offending process.

    50 min3 tasksPurple Team

Unlock this lab

Launch the lab in your browser. Real Kali, Ubuntu and Windows targets, guided step by step. No setup, no VM downloads.

Create free accountSign in to start

Updated 2026-06-15