General Course Flow Design
General Course Flow Design
Linux Attack, Detection and Forensics v2.1 - Hands-on Purple Teaming Playbook
Introduction
Introduction
Defensive/DFIR Tooling
Defensive/DFIR Tooling
Linux EDR Architecture
Linux EDR Architecture
Linux MITRE ATT&CK Matrix
Linux MITRE ATT&CK Matrix
Initial Access - TA0001
Initial Access - TA0001
Persistence - TA0003
Persistence - TA0003
Privilege Escalation - TA0004
Privilege Escalation - TA0004
Defense Evasion - TA0005
Defense Evasion - TA0005
Command and Control - TA0011
Command and Control - TA0011
Discovery - TA0007
Discovery - TA0007
Lateral Movement - TA0008
Lateral Movement - TA0008
Exfiltration - TA0010
Exfiltration - TA0010
Automated Attack Emulation Projects
Automated Attack Emulation Projects
Kubernetes
Kubernetes
To efficiently use this content, we created a proposed generic flow consisting of six simple steps:
1. Get access to your private TARGET_X, KALI_X, and C2_X VMs.
2. Install EDR/Runtime Security/DFIR tooling @ TARGET_X:
-
Choose and install the Linux EDR/Runtime Security/DFIR engine you want to evaluate. Within
TARGET_Xin PurpleLabs Cyber Range, we support by default:Falco Runtime Security
Kunai Runtime Security
Tetragon Runtime Security
Elastic Security
Splunk SIEM
Linux IR scripts
Wazuh
OSquery + osquery-defense-kit
UAC
Velociraptor IR
bpftrace
ghostscan
Step-by-step instructions showing how to install individual agents are available in the section:
Dedicated instructions per tool can also be found in the "Defensive/DFIR Tooling" section.
3. Search Technique:
Identify relevant techniques from a comprehensive EDRmetry Matrix database.
4. Choose offensive commands:
Extract the necessary commands or code snippets and follow step-by-step instructions.
5. Execute attack emulations:
Prepare attack chains or manually execute single offensive tests on a vulnerable-by-design
TARGET_XLinux system.
6. Verify detections and alerts:
Check detections, telemetry, and alerts generated within the chosen EDR/Runtime/SIEM platform. You can challenge yourself by searching for detections/artifacts, or you can easily use the provided DETECTION/DFIR PHASE instructions
7. Load custom response/prevention policies and re-execute the offensive technique:
Check your true prevention coverage via dedicated Tetragon Tracing Policies and custom blocking eBPF SigKill / eBPF LSM programs
8. Dig deeper:
Make configuration changes to your EDR/Runtime/DFIR or ask the EDR/SIEM vendor questions.
Customize offensive steps, make changes to the code, and develop potential bypasses eventually
Customize defensive/forensics steps and search for new detection logics
Customize prevention policies
Do additional research from the perspective of the red and blue teams
Create complex attack paths