FourCore ATTACK vs PurpleSharp
FourCore ATTACK
fourcore.ioPurpleSharp
purplesharp.comSide by side
| Figure | FourCore ATTACK | PurpleSharp |
|---|---|---|
| Price from | — | — |
| Free plan | — | — |
| Free trial | — | — |
| Open source | — | — |
| Web | Yes | — |
| Windows | Yes | Yes |
| Linux | Yes | — |
| Self-hosted | Yes | Yes |
| Plans published | 0 | 0 |
| Spec score · Breach and Attack Simulation Software | 7.8 (#7) | 6.8 (#18) |
| ATT&CK coverage | Simulation results map to MITRE ATT&CK techniques and classify outcomes as detected, partially detected, blocked, or missed. | The documentation says PurpleSharp supports 47 unique MITRE ATT&CK techniques across the attack life cycle. |
| Purpose | FourCore ATTACK continuously simulates real-world cyberattacks to validate whether security controls work. | PurpleSharp is an open-source C# adversary simulation tool for Windows Active Directory environments. |
In their own words
FourCore ATTACK
FourCore ATTACK is an adversarial exposure validation platform that simulates cyberattacks to assess how security controls respond. Its threat intelligence connects current threats with an organization’s environment to help prioritize tests, and controlled campaigns emulate adversary tactics, techniques, procedures, indicators, and artifacts. Coverage includes endpoints, email, WAF, network segmentation, SIEM, EDR, XDR, firewalls, DLP, and exfiltration controls. Results map to MITRE ATT&CK techniques and classify outcomes as detected, partially detected, blocked, or missed. Campaign evidence can connect simulated behavior with control responses, telemetry, alert timing, and recommended next actions. Teams can generate or refine Sigma, YARA, Snort, and configuration changes, then retest after updates. Listed integrations include CrowdStrike, SentinelOne, Microsoft Sentinel, QRadar, Proofpoint, Cisco Secure Email, and ServiceNow. FourCore describes the product as AWS-hosted SaaS, with on-premises solutions available by discussion. Lightweight Windows and Linux agents connect to the SaaS platform. Simulations are designed not to disrupt or destroy target systems. Pricing is on request.
PurpleSharp
PurpleSharp is a free, open-source C# adversary simulation tool for Windows Active Directory environments. It generates attack telemetry for detection teams building and testing analytics, checking detection resilience, locating visibility gaps, and identifying event-logging pipeline problems. Documentation maps 47 MITRE ATT&CK techniques across execution, persistence, privilege escalation, credential access, lateral movement, discovery, and defense evasion. JSON playbooks can combine techniques, define variations, and set technique-specific parameters. Local simulations run interactively after copying the PurpleSharp assembly to a host. Remote simulations use Windows SMB and RPC, requiring administrative credentials on the target plus network access to TCP ports 445 and 135. Scout tasks retrieve audit policy, event subscriptions, PowerShell logging settings, processes, and services. ATT&CK Navigator layers can be exported or imported as JSON playbooks. PurpleSharp is self-hosted on Windows, requires .NET Framework 4.5, and is licensed under BSD 3-Clause. The latest documented release is v1.3 from August 2021.