Purple
opseclint
What would a defender see?
- Rust
- MITRE ATT&CK
- Sigma
- SARIF
- GitHub Actions
- detectability score
- 0–100
- telemetry platforms
- 3
- published
- crates.io
- code-scanning output
- SARIF
Offensive tooling usually answers "will this work?" opseclint answers the question the other side of the table is asking: what does this look like to someone watching? It resolves a command to its MITRE ATT&CK techniques, the host telemetry those techniques produce, and the Sigma rules that would fire, then scores the result 0–100.
Coverage spans Linux auditd, Windows Sysmon, and the macOS Endpoint Security framework, because the same technique leaves very different residue depending on what is watching. It integrates real Sigma rules rather than a hand-written approximation of them.
It ships as a Rust binary via cargo, and as a GitHub Action emitting SARIF so results land in code scanning alongside everything else — a purple-team check that runs in CI rather than living in someone's terminal history.
It is explicitly not an evasion tool, and the project says so. The scope is detectability measurement, and the governing principle is stated in the README: absence of a finding is never proof of stealth.
Details
- Resolves commands, scripts, and playbooks to MITRE ATT&CK techniques
- Maps techniques to host telemetry across Linux auditd, Windows Sysmon, and macOS Endpoint Security
- Integrates real Sigma rules — not a reimplementation
- 0–100 detectability score with the reasoning shown, not just a number
- Ships as a cargo binary and a GitHub Action with SARIF code-scanning output
- Scoped as a measurement tool, not an evasion tool — stated plainly in the project's own docs