Keith C. Wilson

RED + BLUE = PURPLE

Every breach has two sides. Learn both.

I’m Keith Wilson. I’ve spent nearly 20 years in cybersecurity and built AttackIQ Academy, a free training platform with more than 80,000 students. Here I teach threat-informed defense from the attacker’s side and the defender’s side at the same time.

Open a case fileRun a breach scenario

Threat Actor Case Files

Coming soon

AN EXAMPLE OF THE FORMAT · TECHNIQUES FROM MITRE ATT&CK

Real adversaries, told from both sides

PURPLE · BOTH SIDES

RED · HOW THEY GET IN

  1. T1566.001 Spearphishing attachment lands in a finance inbox
  2. T1059.001 Macro launches PowerShell to stage the payload
  3. T1003.001 Credentials dumped from LSASS memory

BLUE · HOW YOU DETECT AND TEST IT

  1. Detect Office applications spawning script interpreters
  2. Alert on PowerShell with encoded or obfuscated command lines
  3. Test it: does your EDR block non-system processes reading LSASS?

BREACH SCENARIO · CHOOSE YOUR PATH

A critical GeoServer vulnerability was just published. Two of yours face the internet. What do you do?

Every choice changes what happens next. A wrong call doesn’t end the scenario. It shows you exactly what that call cost.

Built on CISA advisory AA25-266A: a real breach that went undetected for three weeks.

Play the scenario

JULY 1, 2024 · YOUR OPTIONS

  1. A. Emergency-patch the public-facing GeoServers this week
  2. B. Queue it for the normal patch cycle
  3. C. Wait until it’s known to be exploited, then patch

Tools

Lessons Learned

One real threat per issue, from both sides, with something you can test the same week.

Signup launching soon.