Here you can find information about the provided updates, modifications, and new lab scenarios:

• 13.07.2026:

  • Host/Tetragon Custom Tracing Policies:

    • https://edu.defensive-security.com/p/courses/linux-attack-detection-and-live-forensics-v2-0/3350642-defensive-dfir-tooling/11532301-host-tetragon-custom-tracing-policies [UPDATED]

  • Host/Tetragon Runtime Security:

    • https://edu.defensive-security.com/p/courses/linux-attack-detection-and-live-forensics-v2-0/3350642-defensive-dfir-tooling/10922536-host-tetragon-runtime-security [UPDATED]

  • Custom eBPF C:

    • https://edu.defensive-security.com/p/courses/linux-attack-detection-and-live-forensics-v2-0/3350642-defensive-dfir-tooling/11862991-custom-ebpf-c [UPDATED => Prevent Ghostlock CVE-2026-43499 exploitation - live patch]

• 9.07.2026:

  • EDR-T6485 - Falco BPF Map Poisoning:

    • https://edu.defensive-security.com/p/courses/linux-attack-detection-and-live-forensics-v2-0/3288961-defense-evasion-ta0005/11998973-edr-t6485-falco-bpf-map-poisoning

  • EDR-T6459 - Copy Fail - CVE-2026-31431 LPE:

    • https://edu.defensive-security.com/p/courses/linux-attack-detection-and-live-forensics-v2-0/3342719-privilege-escalation-ta0004/11807887-edr-t6459-copy-fail-cve-2026-31431-lpe [UPDATED => New Velociraptor artifact has been added - Linux.Detection.CopyFail.Exploitation]

  • Host/Falco Runtime Security:

    • https://edu.defensive-security.com/p/courses/linux-attack-detection-and-live-forensics-v2-0/3350642-defensive-dfir-tooling/10922528-host-falco-runtime-security [UPDATED => new ruleset added, Falco engine updated to v0.44]

• 8.07.2026:

  • O-EDR-T6468 - DirtyClone CVE-2026-43503:

    • https://edu.defensive-security.com/p/courses/linux-attack-detection-and-live-forensics-v2-0/3342719-privilege-escalation-ta0004/11993407-o-edr-t6468-dirtyclone-cve-2026-43503

  • K8S - EDR-T6105 - Apache HTTPD CVE-2021-41773:

    • https://edu.defensive-security.com/p/courses/linux-attack-detection-and-live-forensics-v2-0/3467182-kubernetes/11990685-k8s-edr-t6105-apache-httpd-cve-2021-41773

  • K8S - EDR-T6464 - Tomcat Tribes CVE-2026-34486:

    • https://edu.defensive-security.com/p/courses/linux-attack-detection-and-live-forensics-v2-0/3467182-kubernetes/11990742-k8s-edr-t6464-tomcat-tribes-cve-2026-34486

  • K8S - EDR-T6062 - Kafka CVE-2023-25194:

    • https://edu.defensive-security.com/p/courses/linux-attack-detection-and-live-forensics-v2-0/3467182-kubernetes/11990895-k8s-edr-t6062-kafka-cve-2023-25194

  • K8S - EDR-T6114 - ActiveMQ CVE-2023-46604:

    • https://edu.defensive-security.com/p/courses/linux-attack-detection-and-live-forensics-v2-0/3467182-kubernetes/11991017-k8s-edr-t6114-activemq-cve-2023-46604

  • K8S - EDR-T6467 - Flask SSTI:

    • https://edu.defensive-security.com/p/courses/linux-attack-detection-and-live-forensics-v2-0/3467182-kubernetes/11993009-k8s-edr-t6467-flask-ssti

  • K8S - EDR-T6355 - Langflow API CVE-2025-3248:

    • https://edu.defensive-security.com/p/courses/linux-attack-detection-and-live-forensics-v2-0/3467182-kubernetes/11993019-k8s-edr-t6355-langflow-api-cve-2025-3248

  • K8S - EDR-T6416 - React2shell - CVE-2025-55182:

    • https://edu.defensive-security.com/p/courses/linux-attack-detection-and-live-forensics-v2-0/3467182-kubernetes/11993023-k8s-edr-t6416-react2shell-cve-2025-55182

  • K8S - EDR-T6113 - Spring CVE-2022-22963:

    • https://edu.defensive-security.com/p/courses/linux-attack-detection-and-live-forensics-v2-0/3467182-kubernetes/11993034-k8s-edr-t6113-spring-cve-2022-22963

  • K8S - EDR-T6354 - Remote UAF+Heap Overflow:

    • https://edu.defensive-security.com/p/courses/linux-attack-detection-and-live-forensics-v2-0/3467182-kubernetes/11993048-k8s-edr-t6354-remote-uaf-heap-overflow

• 6.07.2026:

  • Codex/Claude Code AI Integration:

    • https://edu.defensive-security.com/p/courses/linux-attack-detection-and-live-forensics-v2-0/3350673-introduction/11986887-ai-integration

• 30.06.2026:

  • Custom eBPF C:

    • https://edu.defensive-security.com/p/courses/linux-attack-detection-and-live-forensics-v2-0/3350642-defensive-dfir-tooling/11862991-custom-ebpf-c [Detect/prevent overwriting modprobe_path via physmap region + Detect/prevent overwriting modprobe_path via VA .data section + Detect/prevent overwriting core_pattern via VA .data section + physmap region]

• 29.06.2026:

  • Memory/Volatility3 Framework:

    • https://edu.defensive-security.com/p/courses/linux-attack-detection-and-live-forensics-v2-0/3350642-defensive-dfir-tooling/10922550-memory-volatility3-framework [ModXRef added]

• 16.05.2026:

  • EDR-T6360 - UAF Dirty Page Table LPE:

    • https://edu.defensive-security.com/view/courses/linux-attack-detection-and-live-forensics-v2-0/3342719-privilege-escalation-ta0004/10910681-edr-t6360-uaf-dirty-page-table-lpe [UPDATED => Tetragon Prevention Policy added]

• 15.05.2026:

  • EDR-T6463 - pidfd_getfd + ptrace - Read root files:

    • https://edu.defensive-security.com/view/courses/linux-attack-detection-and-live-forensics-v2-0/3342719-privilege-escalation-ta0004/11812454-edr-t6463-pidfd_getfd-ptrace-read-root-files

• 14.05.2026:

  • EDR-T6459 - Copy Fail - CVE-2026-31431 LPE:

    • https://edu.defensive-security.com/view/courses/linux-attack-detection-and-live-forensics-v2-0/3342719-privilege-escalation-ta0004/11807887-edr-t6459-copy-fail-cve-2026-31431-lpe

  • EDR-T6462 - Fragnesia LPE:

    • https://edu.defensive-security.com/view/courses/linux-attack-detection-and-live-forensics-v2-0/3342719-privilege-escalation-ta0004/11808317-edr-t6462-fragnesia-lpe

  • EDR-T6261 - Remote UAF Exploitation - user:

    • https://edu.defensive-security.com/view/courses/linux-attack-detection-and-live-forensics-v2-0/3341314-initial-access-ta0001/11244659-edr-t6261-remote-uaf-exploitation-user [UPDATED => Tetragon Prevention Policy added]

  • EDR-T6105 - Apache HTTP CVE-2021-41773:

    • https://edu.defensive-security.com/view/courses/linux-attack-detection-and-live-forensics-v2-0/3341314-initial-access-ta0001/11037854-edr-t6105-apache-http-cve-2021-41773 [UPDATED => Tetragon Prevention Policy added]

  • EDR-T6354 - Remote UAF+Heap Overflow:

    • https://edu.defensive-security.com/view/courses/linux-attack-detection-and-live-forensics-v2-0/3341314-initial-access-ta0001/11037858-edr-t6354-remote-uaf-heap-overflow [UPDATED => Tetragon Prevention Policy added]

  • EDR-T6416 - React2shell - CVE-2025-55182:

    • https://edu.defensive-security.com/view/courses/linux-attack-detection-and-live-forensics-v2-0/3341314-initial-access-ta0001/11108001-edr-t6416-react2shell-cve-2025-55182 [UPDATED => Tetragon Prevention Policy added]

• 26.04.2026:

  • EDR-T6455 - Fake TLS ClientHello DPI bypass:

    • https://edu.defensive-security.com/view/courses/linux-attack-detection-and-live-forensics-v2-0/3288961-defense-evasion-ta0005/11734278-edr-t6455-fake-tls-clienthello-dpi-bypass

• 20.04.2026:

  • EDR-T6450 - K8S Ingress-NGINX CVE-2025-1974:

    • https://edu.defensive-security.com/view/courses/linux-attack-detection-and-live-forensics-v2-0/3341314-initial-access-ta0001/11705928-edr-t6450-k8s-ingress-nginx-cve-2025-1974

  • PANIX:

    • https://edu.defensive-security.com/view/courses/linux-attack-detection-and-live-forensics-v2-0/3578650-automated-attack-emulation-projects/11705970-panix

• 19.04.2026:

  • EDR-T6454 - eBPF XDP UDP Backdoor:

    • https://edu.defensive-security.com/view/courses/linux-attack-detection-and-live-forensics-v2-0/3331658-persistence-ta0003/11706150-edr-t6454-ebpf-xdp-udp-backdoor

• 16.04.2026:

  • EDR-T6039 - File Transfer to a hidden directory:

    • https://edu.defensive-security.com/view/courses/linux-attack-detection-and-live-forensics-v2-0/3288961-defense-evasion-ta0005/10996246-edr-t6039-file-transfer-to-a-hidden-directory [UPDATED]

  • EDR-T6011 - PHP Webshells:

    • https://edu.defensive-security.com/view/courses/linux-attack-detection-and-live-forensics-v2-0/3331658-persistence-ta0003/11055179-edr-t6011-php-webshells [UPDATED]

• 15.04.2026:

  • EDR-T6445 - PAM XOR VeilCreds:

    • https://edu.defensive-security.com/view/courses/linux-attack-detection-and-live-forensics-v2-0/3343257-exfiltration-ta0010/11691152-edr-t6445-pam-xor-veilcreds

• 8.04.2026:

  • EDR-T6448 - ICMP Assembly C2:

    • https://edu.defensive-security.com/view/courses/linux-attack-detection-and-live-forensics-v2-0/3289144-command-and-control-ta0011/11665490-edr-t6448-icmp-assembly-c2

• 7.04.2026:

  • Memory/mquire:

    • https://edu.defensive-security.com/view/courses/linux-attack-detection-and-live-forensics-v2-0/3350642-defensive-dfir-tooling/11618864-memory-mquire

  • Memory/RAM acquisition:

    • https://edu.defensive-security.com/view/courses/linux-attack-detection-and-live-forensics-v2-0/3350642-defensive-dfir-tooling/11661365-memory-ram-acquisition

  • Memory/Volatility3 Framework:

    • https://edu.defensive-security.com/view/courses/linux-attack-detection-and-live-forensics-v2-0/3350642-defensive-dfir-tooling/10922550-memory-volatility3-framework [UPDATED]

  • Host/go-journalctl:

    • https://edu.defensive-security.com/view/courses/linux-attack-detection-and-live-forensics-v2-0/3350642-defensive-dfir-tooling/11618814-host-go-journalctl

• 1.04.2026:

  • EDR-T6328 - io_uring Agent

    • https://edu.defensive-security.com/view/courses/linux-attack-detection-and-live-forensics-v2-0/3289144-command-and-control-ta0011/11618752-edr-t6328-io_uring-agent

• 31.03.2026:

  • EDR-T6325 - BPFDoor Backdoor:

    • https://edu.defensive-security.com/view/courses/linux-attack-detection-and-live-forensics-v2-0/3331658-persistence-ta0003/11238336-edr-t6325-bpfdoor-backdoor

• 26.03.2026:

  • EDR-T6317 - SOA/ECS DNS C2 Channel:

    • https://edu.defensive-security.com/view/courses/linux-attack-detection-and-live-forensics-v2-0/3289144-command-and-control-ta0011/10998522-edr-t6317-soa-ecs-dns-c2-channel [UPDATED]

  • Host/Exploration of /proc:

    • https://edu.defensive-security.com/view/courses/linux-attack-detection-and-live-forensics-v2-0/3350642-defensive-dfir-tooling/11010061-host-exploration-of-proc [UPDATED]

• 7.03.2026:

  • Host/Tetragon Custom Tracing Policies:

    • https://edu.defensive-security.com/view/courses/linux-attack-detection-and-live-forensics-v2-0/3350642-defensive-dfir-tooling/11532301-host-tetragon-custom-tracing-policies

• 9.02.2026:

  • EDR-T6439 - Malasada .so to Shellcode Loader:

    • https://edu.defensive-security.com/view/courses/linux-attack-detection-and-live-forensics-v2-0/3288961-defense-evasion-ta0005/11402068-edr-t6439-malasada-so-to-shellcode-loader

• 8.02.2026:

  • EDR-T6033 - SSH Linux Tunneling:

    • https://edu.defensive-security.com/view/courses/linux-attack-detection-and-live-forensics-v2-0/3342720-lateral-movement-ta0008/11393850-edr-t6033-ssh-linux-tunneling

• 1.02.2026:

  • Active Defense, PT, DE & Assume Breach:

    • https://edu.defensive-security.com/view/courses/linux-attack-detection-and-live-forensics-v2-0/3350673-introduction/10922707-active-defense-pt-de-assume-breach [UPDATED]

  • Host/Tetragon Runtime Security:

    • https://edu.defensive-security.com/view/courses/linux-attack-detection-and-live-forensics-v2-0/3350642-defensive-dfir-tooling/10922536-host-tetragon-runtime-security [UPDATED]

  • Host/Falco Runtime Security:

    • https://edu.defensive-security.com/view/courses/linux-attack-detection-and-live-forensics-v2-0/3350642-defensive-dfir-tooling/10922528-host-falco-runtime-security [UPDATED]

• 28.01.2026:

  • Falco Deployment in K8S

    • https://edu.defensive-security.com/view/courses/linux-attack-detection-and-live-forensics-v2-0/3467182-kubernetes/11310953-falco-deployment-in-k8s [UPDATED]

  • Host/Elastic Security Agent:

    • https://edu.defensive-security.com/view/courses/linux-attack-detection-and-live-forensics-v2-0/3350642-defensive-dfir-tooling/10922527-host-elastic-security-agent [UPDATED]

• 27.01.2026:

  • K8S Grafana + PostgreSQL RCE:

    • https://edu.defensive-security.com/view/courses/linux-attack-detection-and-live-forensics-v2-0/3467182-kubernetes/11340513-k8s-grafana-postgresql-rce

  • EDR-T6167 - BOF Loading with BOF-Stager:

    • https://edu.defensive-security.com/view/courses/linux-attack-detection-and-live-forensics-v2-0/3288961-defense-evasion-ta0005/11041918-edr-t6167-bof-loading-with-bof-stager [UPDATED]

• 22.01.2026:

  • K8S Static Hidden Pod:

    • https://edu.defensive-security.com/view/courses/linux-attack-detection-and-live-forensics-v2-0/3467182-kubernetes/11318241-k8s-static-hidden-pod

  • K8S Security Scanners:

    • https://edu.defensive-security.com/view/courses/linux-attack-detection-and-live-forensics-v2-0/3467182-kubernetes/11322770-k8s-security-scanners

• 21.01.2026:

  • Kubernetes Section:

    • https://edu.defensive-security.com/view/courses/linux-attack-detection-and-live-forensics-v2-0/3467182-kubernetes

  • Linux Hardening Guide:

    • https://edu.defensive-security.com/view/courses/linux-attack-detection-and-live-forensics-v2-0/3467181-linux-hardening/11308819-linux-hardening-guide

  • EDR-T6359 - UAF Cross-cache Dirty Pipe LPE:

    • https://edu.defensive-security.com/view/courses/linux-attack-detection-and-live-forensics-v2-0/3342719-privilege-escalation-ta0004/11316014-edr-t6359-uaf-cross-cache-dirty-pipe-lpe

  • Decloaker:

    • https://edu.defensive-security.com/view/courses/linux-attack-detection-and-live-forensics-v2-0/3350642-defensive-dfir-tooling/11238616-host-decloaker

• 14.01.2026:

  • EDR-T6212 - Emp3r0r HTTP2 AES Stager C2:

    • https://edu.defensive-security.com/view/courses/linux-attack-detection-and-live-forensics-v2-0/3289144-command-and-control-ta0011/11285941-edr-t6212-emp3r0r-http2-aes-stager-c2

  • https://edu.defensive-security.com/view/courses/linux-attack-detection-and-live-forensics-v2-0/3350642-defensive-dfir-tooling/10922540-host-velociraptor-agent [UPDATED]

• 7.12.2025:

  • Initial release