🟣 Weekly Purple Team - Threat Hunting Notebooks

A collection of threat hunting and detection engineering Jupyter notebooks accompanying the Weekly Purple Team YouTube channel. Each notebook provides detection logic to help security professionals understand both offensive techniques and defensive strategies.

🎯 About This Repository

These notebooks bridge the gap between red team tactics and blue team defenses. By understanding how attacks work, we build better detections.

Each notebook is designed to:

• Show How to Detect real-world attack techniques
• Analyze telemetry and log data
• Develop detection logic and hunting queries

📺 YouTube Channel

Subscribe to Weekly Purple Team for video walkthroughs of these notebooks and more cybersecurity content covering:

• 🔴 Red Team - Offensive techniques and tooling
• 🔵 Blue Team - Detection engineering and threat hunting
• 🟣 Purple Team - Bridging offense and defense

📂 Repository Structure

├── notebooks/
│   ├── credential-access/      # Kerberoasting, hash dumping, etc.
│   ├── defense-evasion/        # EDR bypass, log tampering, etc.
│   ├── initial-access/         # Phishing, exploitation, etc.
│   ├── lateral-movement/       # Pass-the-hash, RDP, etc.
│   ├── persistence/            # Scheduled tasks, registry, etc.
│   └── command-and-control/    # C2 traffic analysis, beacons, etc.

🚀 Getting Started

Prerequisites

• Python 3.9+
• Jupyter Notebook or JupyterLab
• Required Python packages (see requirements.txt)

Installation

# Clone the repository
git clone https://github.com/YOUR_USERNAME/weekly-purple-team-notebooks.git
cd weekly-purple-team-notebooks

# Create virtual environment (recommended)
python -m venv venv
source venv/bin/activate  # Linux/Mac
# venv\Scripts\activate   # Windows

# Install dependencies
pip install -r requirements.txt

# Launch Jupyter
jupyter lab

📓 Featured Notebooks

🛠️ SIEM Platform Coverage

Detection queries will start with Elastic other platforms can be provided:

🤝 Contributing

Contributions are welcome! Whether it's new notebooks, detection queries, or bug fixes:

1. Fork the repository
2. Create a feature branch (git checkout -b feature/new-detection)
3. Commit your changes (git commit -m 'Add Kerberoasting detection for Splunk')
4. Push to the branch (git push origin feature/new-detection)
5. Open a Pull Request

⚠️ Disclaimer

These materials are provided for educational and authorized security testing purposes only. The techniques demonstrated should only be used in environments where you have explicit permission. Misuse of these tools and techniques may violate laws and regulations.

Always obtain proper authorization before conducting security assessments.

📬 Connect

• YouTube: @WeeklyPurpleTeam
• LinkedIn: Connect with me
• Twitter/X: Follow for updates

Learn to attack. Learn to defend. Stay purple. 🟣