2026 Semiconductor Cybersecurity Academy | From Red to Blue: Attack-Chain-Driven Purple Team Threat Hunting in Practice

Why blue teams need to understand the red team

Attackers do not announce themselves with an Event ID. An odd process, an IIS log entry, a network connection or a file change may each look normal alone; only when data sources are joined does the full attack path appear.

Course goals

Understand the traces common attack techniques leave in Windows, IIS, networks and Active Directory; spot anomalies in process, file, network, authentication and Kerberos data; build a complete attack timeline; and turn it into threat hunting and detection logic.

Session 1 outline

Purple team thinking and trace analysis; file-upload flaws and ASPX web shell traces; outbound command-and-control channels; detecting discovery on IIS and Windows hosts; lateral movement across multi-site IIS and web.config exposure; correlating the first day’s attack chain.

Session 2 outline

Sensitive-data leaks and valid-account attacks; SYSTEM privilege escalation through scheduled tasks and writable scripts; credential access after LocalSystem and Kerberos basics; Kerberoasting and privileged service accounts; Active Directory attack paths and domain takeover; Golden Ticket and incident judgment after domain compromise; full-chain threat hunting and event reconstruction.

Notes for participants

Companies should send suitable staff, mainly in security defense and monitoring, blue team and incident response roles. The aim is to understand attacker thinking and turn it into detection and investigation skills, not to teach how to carry out attacks.

Who the course is for

The course "From Red to Blue: Attack-Chain-Driven Purple Team Threat Hunting" belongs to the Semiconductor Cybersecurity Academy programme. It is aimed at blue-team staff who monitor logs, tune detections and investigate incidents. The problem it addresses is practical: an alert has fired, but nobody knows which stage of an attack it belongs to, or whether to look forwards or backwards.

The series ran as two full-day sessions of six hours each, with a one-hour lunch break, on 30 September and 30 October 2026. Both took place in a computer classroom at the ITTraining (艾鍗) computer classroom on Chongqing South Road, Taipei. Both sessions have now been held. This page keeps the design and content for reference, and for companies deciding how to train their security teams.

One attack chain, start to finish

The course does not survey attack techniques one by one. It follows a single scenario. The chain begins with a bypassed file-upload function, then moves through an ASPX web shell, an outbound control channel, lateral movement across IIS sites, credentials stored in configuration files, abuse of valid accounts, privilege escalation through a scheduled task, Kerberos credential attacks and, finally, compromise of an Active Directory domain.

Every stage is handled with the same method. The instructor first explains what the attacker did. Participants then ask where that action leaves observable traces, which logs must be collected, and how data from different sources can be correlated into a detection that can be run repeatedly. The sequence is the point. Learners practise reasoning from behaviour to evidence, instead of memorising event codes.

The design also answers a common blind spot. Many companies write monitoring rules event code by event code. Each rule looks reasonable alone, yet none can say how far an intrusion has progressed. Building on the attack chain draws the map first, then checks whether anyone is watching each junction.

What each session covers

The first session stays at the web server and host layer. Participants use IIS access logs and parent-child process relationships to find unusual commands, examine how an ordinary-looking HTTPS connection can hide a control channel, and discuss how weak isolation between sites on one IIS host exposes web.config files. The last block joins the day into a first incident timeline.

The second session moves to identity and the domain. It starts with password reuse and low-volume password spraying, then covers privilege escalation through a writable script, the Kerberos authentication flow and Kerberoasting, and ends with domain control and the judgement calls after a Golden Ticket. The course makes one point plainly: rebuilding a web server or resetting ordinary user passwords does not complete incident response.

What participants should bring, and take away

The source material lists no entry requirements. The content does assume familiarity with Windows processes, IIS logs, network connections and Active Directory, so teams should confirm they already collect logs and have some experience reading them. Eligibility and places are set by the registration page. The deadlines were 29 September and 27 October, and registration closed early if the class filled.

On completion, participants should be able to recognise abnormal behaviour in process, file, network, authentication and Kerberos data, trace an incident forwards and backwards from a single event, and convert red-team techniques into hunting hypotheses, detection logic and investigation steps. The course states that its aim is not to teach anyone to carry out attacks, but to give blue teams a joined-up view of attack and defence.

The instructor and related resources

The instructor, Huang Jason, is general manager of Dengfeng Digital Technology (登豐數位科技). He holds the ISC2 CISSP-ISSMP and EC-Council LPT Master certifications and chairs membership for the ISC2 Taipei chapter. The course draws on practical casework, which matches the investigations companies actually face.

The Taiwan Industrial Network of Alliances for Investment (TINAI) was initiated by the National Innovation and Entrepreneurship Association, R.O.C. This page forms part of the TINAI events and registration content. A company with needs in security deployment, log analysis or incident response can describe its situation on the opportunities page for referral. Future sessions will be announced on the events and registration page.