Terraform code generator to create different Azure security labs.
For full documentation visit: https://www.purplecloud.network
- On managed_identity.py, changed the default VM size to
A1v2to provide better cost. - On aadjoin.py, changed the default Azure AD password to remove special characters.
- Added a new Terraform Generator: adfs.py. This builds a Federation ADFS lab with a DC.
- Added a new Terraform Generator: aadjoin.py. This builds an Azure AD Join lab with Windows 10 managed devices.
- Moves all generators into separate sub-directories for cleaner separation of terraform resources and state, ease of use
- Remove archive directory for older templates
- Drops AAD connect msi on desktop of ADFS server
- Adds PurpleSharp to always download on Windows 10 Pro: ad.py, sentinel.py
- Updated bootstrap scripts to always expand-archive: ad.py, sentinel.py
- Fixed one issue with new directory name for Windows 10
- Changed managed_identity.py to use new automatic white listing using http data resource of ifconfig.me
- Customizable Azure AD Connect msi included in
files/dcfolder. - Updates AAD Connect MSI to version 2.x
- Automatic upload/download to DC's local administrator Desktop
9/2/22: Added support for custom CSV files for loading your own AD users, groups, and OUs into AD DS.
- Import your own CSV file with
--csv file.csv. Must conform with a specific format described inHow AD Builds on the DCsection - Supported for both
sentinel.pyandad.pyAD DS code generators.
- Removed local-exec and ansible dependencies. All post configuration management is done with user-data and bash/powershell.
- Changed all files in range (winlogbeat, sysmon, sysmon-config) to be self-contained and customizable for upload to/from a storage container.
- Upgraded Sysmon to v14 and and latest SwiftOnSecurity Sysmon-Config
- Upgraded Velociraptor to v6.5.2
8/4/22: Updated Sentinel Lab for Active Directory Build + Ship Sysmon and Security Logs into Sentinel!
Build an Azure Sentinel lab with optional support for shipping Windows 10 Sysmon and Security logs into Sentinel Log Analytics Workspace. Optionally build Active Directory with Domain Join.
You can quickly spin up a multi-tenant Azure Ad application to be used for app consent phishing simulations. It automatically builds typical API consent permissions such as reading email and files, but can be customized for any supported permissions you require.
7/18/22: Added three new Terraform Generators: Azure Sentinel, Azure Storage, Azure Managed Identity
Create three new security labs for different use cases. You can quickly spin up an Azure Sentinel security lab, an Azure storage account with file shares, containers, blobs, and sample files. This also includes an Azure Key Vault with resources. Or create an Azure managed identity security lab for offensive operations and network defenders. See the full documentation for more details.
Added support to dynamically add some Service Principal abuse attack primitives. This includes dynamically adding an Application Administrator to a random Azure AD user (-aa), a Privileged role admin to a random application SP (-pra), as well as a Global admin role target to a random application SP (-ga). See the azure_ad.py usage examples below for more information. We also added attack scripts for the service principal abuse scenario in attack_scripts directory.
PurpleCloud has changed! Introducing a Terraform generator using python. Instead of offering terraform templates that have to be manually edited, the starting point is a Python terraform generator. The python scripts will create your own custom terraform files based on user input. The terraform template files have been moved to archive.