International Journal of Science, Engineering and TechnologyAuthors: Kushagra Patel
Abstract: Purple team exercises are supposed to bring red and blue teams together, but in practice they are expensive, slow, and hard to run frequently. Most organizations do them once or twice a year at best. I wanted to see if I could automate the repetitive parts of that process as a final year project, and this paper is the result of about four months of building, breaking, and rebuilding. The framework I ended up with automates the core loop of purple teaming: simulate an attack, generate a detection rule for it, and check whether the rule actually catches it. The system has three parts. A Red Engine generates fake Windows telemetry logs for seven MITRE ATT&CK techniques. A Blue Engine produces Sigma detection rules from those logs, either through an LLM API or using pre-built offline rules. A Validator scores how well the rule catches the simulated attack. Everything runs through a FastAPI REST API. In offline testing across all seven techniques, the framework averaged 97% detection coverage, with six techniques at 100% and one (T1059.001, PowerShell Execution) at 79%. The whole pipeline finishes in under 30 seconds per technique. The 79% score on PowerShell is actually the most interesting result because it shows exactly the kind of gap a real SOC would need to address. The framework is open source, runs on a regular laptop, and does not require any paid APIs to demonstrate.
