PurpleSharp vs Stratus Red Team

PurpleSharp is a free, open-source C# adversary simulation tool for Windows Active Directory environments. It generates attack telemetry for detection teams building and testing analytics, checking detection resilience, locating visibility gaps, and identifying event-logging pipeline problems. Documentation maps 47 MITRE ATT&CK techniques across execution, persistence, privilege escalation, credential access, lateral movement, discovery, and defense evasion. JSON playbooks can combine techniques, define variations, and set technique-specific parameters. Local simulations run interactively after copying the PurpleSharp assembly to a host. Remote simulations use Windows SMB and RPC, requiring administrative credentials on the target plus network access to TCP ports 445 and 135. Scout tasks retrieve audit policy, event subscriptions, PowerShell logging settings, processes, and services. ATT&CK Navigator layers can be exported or imported as JSON playbooks. PurpleSharp is self-hosted on Windows, requires .NET Framework 4.5, and is licensed under BSD 3-Clause. The latest documented release is v1.3 from August 2021.

Stratus Red Team is a free, open-source Go binary for running specific offensive attack techniques against a live cloud environment and checking detections. Its techniques map to MITRE ATT&CK, with coverage for AWS, Azure, GCP, Kubernetes, Amazon EKS, and Entra ID. For each technique, it can prepare prerequisites, detonate the activity, reverse side effects, and remove prerequisites. Terraform creates and removes required infrastructure, and Stratus downloads its own Terraform binary. Installation options include Go, Homebrew, pre-built Linux, Windows, and macOS binaries, and Docker. The tool can also operate as a Go library for automation and custom techniques. It supports Linux, macOS, Windows, API use, and self-hosting. Documentation recommends an administrator role in a sandbox account or test cluster, not production infrastructure. Kubernetes clusters must already exist, AWS customer-provided detonation infrastructure is unsupported, and Azure resources are fixed to West US.