purple-team 开源项目推荐（418 个）

beenuar /AiSOC

开源 AI 安全运营中心：告警融合、LLM 智能体分诊、MITRE ATT&CK 调查，以及可回放的决策账本，记录每个智能体步骤。可自托管，无需 API 密钥即可运行，MIT 许可。附带适用于 Claude、Cursor 和 Continue 的 MCP 服务器。

rabbitstack /fibratus

Security sensor for realtime threat detection and protection

DataDog /stratus-red-team

☁️ ⚡ Granular, Actionable Adversary Emulation for the Cloud

OpenAEV-Platform /openaev

Open Adversarial Exposure Validation Platform

Viralmaniar /BigBountyRecon

BigBountyRecon tool utilises 58 different techniques using various Google dorks and open source tools to expedite the process of initial reconnaissance on the target organisation.

mrwadams /attackgen

AttackGen is a cybersecurity incident response testing tool that leverages the power of large language models and the comprehensive MITRE ATT&CK framework. The tool generates tailored incident response scenarios based on user-selected threat actor groups and your organisation's details.

DataDog /KubeHound

Tool for building Kubernetes attack paths

mvelazc0 /PurpleSharp

PurpleSharp is a C# adversary simulation tool that executes adversary techniques with the purpose of generating attack telemetry in monitored Windows environments

ch33r10 /EnterprisePurpleTeaming

Purple Team Resources for Enterprise Purple Teaming: An Exploratory Qualitative Study by Xena Olsen.

mvelazc0 /BadZure

BadZure automates the deployment of intentionally misconfigured Entra ID tenants and Azure subscriptions, populating them with diverse entities and configurable, traversable attack paths.

awslabs /aws-cloudsaga

AWS CloudSaga - Simulate security events in AWS

andreisss /KslDump

KslDump — Why bring your own knife when Defender already left one in the kitchen?

PaperMtn /slack-watchman

Slack enumeration and exposed secrets detection tool

mvelazc0 /msInvader

M365/Azure adversary simulation tool that generates realistic attack telemetry to help blue teams improve their detection and response capabilities.

dn9uy3n /Modern-Red-Team-Infrastructure

A comprehensive modern architecture model is proposed to integrate platform solutions and tooling to support a professional Red Team.

PaperMtn /gitlab-watchman

Finding exposed secrets and personal data in GitLab

darmado /Atomic-Red-Team-C2

ARTi-C2 is a post-exploitation framework used to execute Atomic Red Team test cases with rapid payload deployment and execution capabilities via .NET's DLR.

TH3xACE /EDR-Test

Automating EDR Testing with reference to MITRE ATTACK via Cobalt Strike [Purple Team].

fierceoj /ShonyDanza

A customizable, easy-to-navigate tool for researching, pen testing, and defending with the power of Shodan.

attackevals /ael

ATT&CK Evaluations Library