SEC699: Purple Team Tactics - Adversary Emulation for Breach Prevention & Detection

  • In Person (6 days)
  • Online
36 CPEs

This course provides advanced purple team training, with a focus on adversary emulation for data breach prevention and detection. Throughout this course, students will learn how real-life threat actors can be emulated in a realistic enterprise environment, including multiple AD forests. In true purple fashion, the goal of the course is to educate students on how adversarial techniques can be emulated (manual and automated) and detected (use cases/rules and anomaly-based detection). A natural follow-up to SEC599, this is an advanced SANS course offering, with 60 percent of class time spent in 29 hands-on labs, plus extended access to the CTF range for 7 days after class ends!

What You Will Learn

SEC699 is SANS's advanced purple team offering, with a key focus on adversary emulation for data breach prevention and detection. Throughout this course, students will learn how real-life threat actors can be emulated in a realistic enterprise environment. In true purple fashion, the goal of the course is to educate students on how adversarial techniques can be emulated and detected.

A natural follow-up to SEC599, this is an advanced SANS course offering, with 60 percent of class time spent on labs. Highlights of class activities include:

  • A course section on typical automation strategies such as Ansible, Docker and Terraform. These can be used to deploy a full multi-domain enterprise environment for adversary emulation at the press of a button
  • Building a proper process, tooling, and planning for purple teaming
  • Building adversary emulation plans that mimic real-life threat actors such as APT-28, APT-34, and Turla in order to execute these plans using tools such as Covenant and Caldera
  • In-depth techniques such as Kerberos Delegation attacks, Attack Surface Reduction / Applocker bypasses, AMSI, Process Injection, COM Object Hi-jacking and many more...
  • SIGMA rule-building to detect the above techniques

Course authors Erik Van Buggenhout (the lead author SEC599) and James Shewmaker (the co-author SEC660) are both certified GIAC Security Experts (GSEs) and are hands-on practitioners who have built a deep understanding of how cyber attacks work through both red team (penetration testing) and blue team (incident response, security monitoring, threat hunting) activities. In this course, they combine these skill sets to educate students on adversary emulation methods for data breach prevention and detection.

The SEC699 journey is structured as follows:

  • In Section one, we will lay the foundations that are required to perform successful adversary emulation and purple teaming. As this is an advanced course, we will go in-depth on several tools that we'll be using and learn how to further extend existing tools.
  • Sections two through four will be heavily hands-on lecturing a number of advanced techniques and their defenses (focused on detection strategies). Section two focuses on Initial Access techniques, section three covers Lateral Movement and Privilege Escalation, while section four deals with Persistence.
  • In section five, we will build an emulation plan for a variety of threat actors. These emulation plans will be executed in Covenant, Caldera, and Prelude Operator.
  • Students will have extended access to an individual CTF range for a week after class to practice their skills.

Business Takeaways:

  • Build realistic adversary emulation plans to better protect your organization
  • Deliver advanced attacks, including application whitelisting bypasses, cross-forest attacks (abusing delegation), and stealth persistence strategies
  • Building SIGMA rules to detect advanced adversary techniques

What You Will Receive

  • A SEC699 course VM that includes necessary scripts and dependencies that are used to spin up a detection lab on-demand

Syllabus (36 CPEs)

Download PDF
  • Overview

    In section one we will lay the foundations for the rest of the course by:

    • Leveraging the power of automation to deploy our lab infrastructure.
    • Learning how to build a purple team in-house, covering process, approach, and tooling.
    • Tracking purple teaming exercises using VECTR.
    • Building an emulation and detection pipeline using a variety of available technology (SIGMA for detection rule development, and various adversary emulation tools, with a focus on Covenant and Prelude Operator).

    Even though this is the first section, you will have significant hands-on opportunities, as students will complete five different exercises.

    • Exercise: Deploying the lab environment
    • Exercise: Introduction to VECTR
    • Exercise: Preparing our Elastic and SIGMA stack
    • Exercise: Preparing our adversary emulation stack
    • Exercise: Prelude
    • Introduction

      • Course objectives
      • Building our lab environment
      • Introducing the lab architecture
      • Purple Teaming Organization
    • Key Tools

      • Building a stack for detection
      • Assessing detection coverage
      • Rule-based versus anomaly-based detection
      • Building a stack for adversary emulation
      • Automating emulation using Prelude Operator
  • Overview

    The following modules will be covered in section two:

    • We'll start with a state-of-the-art overview on current attack strategies & defenses for initial execution.
    • We will zoom in on built-in defenses provided by Microsoft such as the Anti Malware Scanning Interface (AMSI). How does it work, how effective is it and can it be bypassed?
    • Controlling execution on your endpoints using Attack Surface Reduction (ASR) rules. Introduced in Windows 10, ASR rules are an additional security layer that can be used to prevent execution of malicious payloads. We will zoom in on there effectiveness and test several bypasses.
    • Controlling execution on your endpoints using AppLocker. Introduced in Windows 7, Applocker is an application control technique that can be used to prevent execution of malicious payloads. We will zoom in on its effectiveness and test several bypasses.
    • The rise of Endpoint Detection & Response (EDR) tools has provided organisations with a means to enable in-depth detection and perform immediate response activities on their endpoints. These tools have changed the security landscape and have forced adversaries to get creative. We will look at a number of EDR bypass strategies including Child-Parent Process ID spoofing, Command line argument spoofing, Process injection & hollowing and finally the use of direct syscalls. It gets quite technical here...
    • Exercise: VBA Stomping, Purging & AMSI Bypasses
    • Exercise: Bypassing Application Execution Control
    • Exercise: Bypassing Attack Surface Reduction
    • Exercise: Bypassing Modern Security Products - Child-parent and command-line spoofing
    • Exercise: Bypassing Modern Security Products - Process hollowing
    • Exercise: Bypassing Modern Security Products - Direct System calls
    • Initial Intrusion Strategies

      • Traditional Attack Strategies & Defenses
    • Emulating Adversarial Techniques & Detections
      • Anti-Malware Scanning Interface (AMSI)
      • Office Macro Obfuscation Techniques
      • Application Execution Control
      • ExploitGuard & Attack Surface Reduction Rules
    • Going Stealth - Process Shenanigans

      • Zooming in on Windows Internals
      • Bypassing Security Products through Process Shenanigans
      • Hunting for These Shenanigans
    • Conclusions

  • Overview

    The following modules will be covered in section three:

    • Enumerating Active Directory resources and configurations to map the overall attack surface of an AD environment.
    • Understanding the Local Security Authority Subsystem Service (LSASS) process. What is its purpose and how is it traditionally attacked? We will go in-depth and explan topics such as Security Support Provicers (SSPs) and Authentcation Packages (APs). After this explanation, we will zoom in on the execution and detection of LSASS dumping attacks using a variety of tools (including Mimikatz, Dumpert, ProcDump,&)
    • Given the focus of security products on LSASS, we will also investigate other credential dumping techniques. How can adversaries steal credentials without touching LSASS? Key techniques will include Internal Monologue (NTLMv1 downgrade), NTDS.dit stealing and DCSync.
    • Forcing Windows Authentication: Provided with network-level access (or an initial payload on a network-connected device), how can we obtain additional credentials through forcing other Windows systems to connect to us? Typical topics include the use of LLMNR, but also IPv6-based MitM attacks.
    • A refresh on Kerberos and traditional attacks such as Kerberoasting, ASReproasting, golden tickets, silver tickets and the Skeleton Key attack. After the refresh, we will focus on advanced attack strategies, primarily focused on delegation attacks. We will cover unconstrained delegation, constrained delegation and resource-based constrained delegation.

    • Exercise: Analyzing BloodHound attack chains
    • Exercise: Stealing credentials from LSASS
    • Exercise: Internal Monologue in NTLMv1 downgrades
    • Exercise: Creative NTLMv2 Challenge-Response stealing
    • Exercise: Abusing unconstrained delegation
    • Exercise: Abusing constrained delegation

    • Active Directory Enumeration

      • Bloodhound Enumeration
    • Credential Dumping

      • LSASS Credential Stealing Techniques
      • Stealing credentials without touching LSASS
      • Stealing NTLMv2 Challenge-Response
    • Kerberos Attacks

      • Kerberos refresh
      • Unconstrained Delegation Attacks
      • (Resource-based) Constrained Delegation Attacks
    • Conclusion

  • Overview

    The following modules will be covered in section four:

    • An explanation on the security boundaries in AD environment and how adversaries can possibly pivot between different domains and forests.
    • Explaining typical persistence strategies used by adversaries. We will also discuss typical detection strategies.
    • Abusing the Component Object Model (COM) to establish a persistent foothold in a target environment. Attacks we will cover include Phantom COM Objects and COM Search Order Hijacking
    • Obtaining persistence through the use of Windows Management Instrumentation (WMI). We will explain WMI Event Filters, Event Consumers and Event Filter to Consumer bindings
    • Establishing persistence through DLLs such as AppCert, AppInit and Netshell.
    • Leveraging Microsoft Office for persistence, with a key focus on template shenanigans and malicious add-ins
    • Abusing the Application Compatibility Toolkit (ACT) to obtain persistence through application shims.
    • Stealth persistence using the AD
    • Exercise: Pivoting between domains and forests
    • Exercise: COM Object Hijacking
    • Exercise: WMI Persistence
    • Exercise: Implementing Netsh helper DLLs
    • Exercise: Office Persistence
    • Exercise: Application Shimming
    • Exercise: Stealth AD persistence
    • Pivoting between domains and forests

      • Breaking Domain & Forest Trusts
    • Persistence Techniques
      • COM Object Hijacking
      • WMI Persistence
      • AppCert, AppInit & Netsh Helper DLLs
      • Office Template & Library tricks
      • Application shimming
      • Sealth AD Persistence
    • Conclusion

  • Overview

    The following modules will be covered in section five:

    • We will build out emulation plans for five specific threat actors: APT-33, EvilCorp, APT-28, APT-34 and Turla.
    • Upon completing the emulation plans, we will execute them using Caldera, Covenant, and Prelude Operator.
    • APT-33 Emulation Plan
    • EvilCorp Emulation Plan
    • APT-28 Emulation Plan
    • APT-34 Emulation Plan
    • Turla Emulation Plan
    • Executing Emulation Plans
      • APT-33 Emulation Plan
      • EvilCorp Emulation Plan
      • APT-28 Emulation Plan
      • APT-34 Emulation Plan
      • Turla Emulation Plan
  • Overview

    In Section 6, students will take all the knowledge they have gained over the course and put it into practice! Plus, students will retain access to the CTF range for 7 days after class ends. This individual CTF will let students emulate an advanced threat actor that will infiltrate an organization that mimics a real corporation. The participants will have to conduct OSINT, tailor their own initial access payload, and perform various tasks inside the corporate perimeter, ranging from network discovery to lateral movement, to domain privilege escalation. A true test of skill!


This is a fast-paced, advanced course that requires a strong desire to learn advanced red and blue team techniques. The following SANS courses are recommended either prior to or as a companion to taking this course:

Experience with programming in any language is highly recommended. At a minimum, students are advised to read up on basic programming concepts.

You should also be well versed with the fundamentals of penetration testing prior to taking this course. Familiarity with Linux and Windows is mandatory. A solid understanding of TCP/IP and networking concepts is required. Please contact the author at if you have any questions or concerns about the prerequisites.

Laptop Requirements

Important! Bring your own system configured according to these instructions.

A properly configured system is required to fully participate in this course. If you do not carefully read and follow these instructions, you will not be able to fully participate in hands-on exercises in your course. Therefore, please arrive with a system meeting all of the specified requirements.

Back up your system before class. Better yet, use a system without any sensitive/critical data. SANS is not responsible for your system or data.

  • CPU: 64-bit Intel i5/i7 (8th generation or newer), or AMD equivalent. A x64 bit, 2.0+ GHz or newer processor is mandatory for this class.
  • CRITICAL: Apple systems using the M1/M2 processor line cannot perform the necessary virtualization functionality and therefore cannot in any way be used for this course.
  • BIOS settings must be set to enable virtualization technology, such as "Intel-VTx" or "AMD-V" extensions. Be absolutely certain you can access your BIOS if it is password protected, in case changes are necessary.
  • 8GB of RAM or more is required.
  • 200GB of free storage space or more is required.
  • At least one available USB 3.0 Type-A port. A Type-C to Type-A adapter may be necessary for newer laptops. Some endpoint protection software prevents the use of USB devices, so test your system with a USB drive before class.
  • Wireless networking (802.11 standard) is required. There is no wired Internet access in the classroom.

Additional requirements for this course:

  • An Amazon Web Services (AWS) account is required to perform hands-on labs during this course. SANS provides an AWS account for the duration of Live and Live Online events. However, for use beyond the classroom and for OnDemand students, an AWS account is NOT provided. Those students must create an AWS account prior to beginning class. Your ability to perform the hands-on labs will be delayed if you do not have access to a usable AWS account.
  • If a personal AWS account is needed for this class, estimated costs are approximately $50 but could be greater if you deviate from the lab instructions.
  • Your host operating system must be the latest version of Windows 10, Windows 11, or macOS 10.15.x or newer.
  • Fully update your host operating system prior to the class to ensure you have the right drivers and patches installed.
  • Linux hosts are not supported in the classroom due to their numerous variations. If you choose to use Linux as your host, you are solely responsible for configuring it to work with the course materials and/or VMs.
  • Local Administrator Access is required. (Yes, this is absolutely required. Don't let your IT team tell you otherwise.) If your company will not permit this access for the duration of the course, then you should make arrangements to bring a different laptop.
  • You should ensure that antivirus or endpoint protection software is disabled, fully removed, or that you have the administrative privileges to do so. Many of our courses require full administrative access to the operating system and these products can prevent you from accomplishing the labs.
  • Any filtering of egress traffic may prevent accomplishing the labs in your course. Firewalls should be disabled or you must have the administrative privileges to disable it.
  • Download and install VMware Workstation Pro 16.2.X+ or VMware Player 16.2.X+ (for Windows 10 hosts), VMware Workstation Pro 17.0.0+ or VMware Player 17.0.0+ (for Windows 11 hosts), or VMWare Fusion Pro 12.2+ or VMware Fusion Player 11.5+ (for macOS hosts) prior to class beginning. If you do not own a licensed copy of VMware Workstation Pro or VMware Fusion Pro, you can download a free 30-day trial copy from VMware. VMware will send you a time-limited serial number if you register for the trial at their website. Also note that VMware Workstation Player offers fewer features than VMware Workstation Pro. For those with Windows host systems, Workstation Pro is recommended for a more seamless student experience.
  • On Windows hosts, VMware products might not coexist with the Hyper-V hypervisor. For the best experience, ensure VMware can boot a virtual machine. This may require disabling Hyper-V. Instructions for disabling Hyper-V, Device Guard, and Credential Guard are contained in the setup documentation that accompanies your course materials.
  • Download and install 7-Zip (for Windows Hosts) or Keka (for macOS hosts). These tools are also included in your downloaded course materials.

Your course media is delivered via download. The media files for class can be large. Many are in the 40-50GB range, with some over 100GB. You need to allow plenty of time for the download to complete. Internet connections and speed vary greatly and are dependent on many different factors. Therefore, it is not possible to give an estimate of the length of time it will take to download your materials. Please start your course media downloads as soon as you get the link. You will need your course media immediately on the first day of class. Do not wait until the night before class to start downloading these files.

Your course materials include a "Setup Instructions" document that details important steps you must take before you travel to a live class event or start an online class. It may take 30 minutes or more to complete these instructions.

If you have additional questions about the laptop specifications, please contact

Author Statement

After the success of SEC599, I'm very excited to unleash this course offering upon the SANS audience! SEC699 is an amazing course that came about because we listened to student requests for a hands-on adversary emulation class leveraging an enterprise lab environment. This is it!

SEC699 attendees will learn advanced red and blue team techniques for proper purple teaming in an enterprise environment. Throughout the week we do not just focus on explaining tips and tricks, but also empower students to build and adapt their own tooling for proper adversary emulation. This includes, for example, custom Caldera, SIGMA and Velociraptor development.

The SEC699 lab environment is fully built using Teraform playbooks and covers multiple domains and forests that can be attacked! Students spin up the lab environment in their own AWS account and can thus keep on practicing months (and years) after they took the class!

- Erik Van Buggenhout

Register for SEC699


All pricing excludes applicable taxes