2026 Semiconductor Cybersecurity Academy | From Red to Blue: Attack-Chain-Driven Purple Team Threat Hunting in Practice

Why blue teams need to understand the red team

Attackers do not announce themselves with an Event ID. An odd process, an IIS log entry, a network connection or a file change may each look normal alone; only when data sources are joined does the full attack path appear.

Course goals

Understand the traces common attack techniques leave in Windows, IIS, networks and Active Directory; spot anomalies in process, file, network, authentication and Kerberos data; build a complete attack timeline; and turn it into threat hunting and detection logic.

Session 1 outline

Purple team thinking and trace analysis; file-upload flaws and ASPX web shell traces; outbound command-and-control channels; detecting discovery on IIS and Windows hosts; lateral movement across multi-site IIS and web.config exposure; correlating the first day’s attack chain.

Session 2 outline

Sensitive-data leaks and valid-account attacks; SYSTEM privilege escalation through scheduled tasks and writable scripts; credential access after LocalSystem and Kerberos basics; Kerberoasting and privileged service accounts; Active Directory attack paths and domain takeover; Golden Ticket and incident judgment after domain compromise; full-chain threat hunting and event reconstruction.

Notes for participants

Companies should send suitable staff, mainly in security defense and monitoring, blue team and incident response roles. The aim is to understand attacker thinking and turn it into detection and investigation skills, not to teach how to carry out attacks.