Changelog

2023/10/23:
- https://edu.defensive-security.com/view/courses/linux-attack-live-forensics-at-scale/1427336-0x0e-linux-attack-detection-analysis/7087019-ks-rootkits-ebpf-kovid-analysis
- https://edu.defensive-security.com/view/courses/linux-attack-live-forensics-at-scale/1427385-0x0c-tunnels-pivots-redirectors/4438471-chisel [UPDATED]
2023/09/17:
- https://edu.defensive-security.com/view/courses/linux-attack-live-forensics-at-scale/1427336-0x10-linux-attack-detection-analysis/6873861-us-rootkits-sshd-dummy-cipher-suite
2023/08/11:
- https://edu.defensive-security.com/view/courses/linux-attack-live-forensics-at-scale/1427385-0x0e-tunnels-pivots-redirectors/6660278-sshimpanzee
2023/08/10:
- https://edu.defensive-security.com/view/courses/linux-attack-live-forensics-at-scale/1430312-0x03-purplelabs-default-targets/4429223-reverse-shell-backdoor-payloads [UPDATED]
2023/08/09:
- https://edu.defensive-security.com/view/courses/linux-attack-live-forensics-at-scale/1430312-0x03-purplelabs-default-targets/6655206-cve-2022-22963-spring-cloud-function-rce
2023/08/05:
- https://edu.defensive-security.com/view/courses/linux-attack-live-forensics-at-scale/1430416-0x0a-linux-memory-forensics/6632836-fileless-plugin
2023/08/04:
- https://edu.defensive-security.com/view/courses/linux-attack-live-forensics-at-scale/1427317-0x04-introduction-to-the-course/6627113-linux-mitre-att-ck
- https://edu.defensive-security.com/view/courses/linux-attack-live-forensics-at-scale/1430286-0x06-blue-dfir-components-host/6627098-host-clamav
2023/07/19:
- https://edu.defensive-security.com/view/courses/linux-attack-live-forensics-at-scale/1427336-0x10-linux-attack-detection-analysis/6525289-us-fileless-scripting-execution
2023/07/17:
- https://edu.defensive-security.com/view/courses/linux-attack-live-forensics-at-scale/1427336-0x10-linux-attack-detection-analysis/6524685-us-rootkits-oh-my-father
2023/07/12:
2023/07/10:
- https://edu.defensive-security.com/view/courses/linux-attack-live-forensics-at-scale/1430416-0x0a-linux-memory-forensics/6490944-linux-report-sections
- https://edu.defensive-security.com/view/courses/linux-attack-live-forensics-at-scale/1430286-0x06-blue-dfir-components-host/4438402-host-tracee-syscall-tracing [UPDATED]
2023/06/22:
- https://edu.defensive-security.com/view/courses/linux-attack-live-forensics-at-scale/1427336-0x10-linux-attack-detection-analysis/5963551-ks-rootkits-bad-bpf-trip
2023/04/17:
- https://edu.defensive-security.com/view/courses/linux-attack-live-forensics-at-scale/1427336-0x10-linux-attack-detection-analysis/6018906-ks-rootkits-in-memory-lkm-loading
2023/04/07:
- https://edu.defensive-security.com/view/courses/linux-attack-live-forensics-at-scale/1427336-0x10-linux-attack-detection-analysis/5949506-ks-rootkits-xdp-udp-backdoor
- https://edu.defensive-security.com/view/courses/linux-attack-live-forensics-at-scale/1427336-0x10-linux-attack-detection-analysis/5949497-ks-rootkits-ftrace-hooking-1
2023/04/06:
- https://edu.defensive-security.com/view/courses/linux-attack-live-forensics-at-scale/1430312-0x03-purplelabs-default-targets/5960559-remote-heap-exploitation
2023/04/04:
- https://edu.defensive-security.com/view/courses/linux-attack-live-forensics-at-scale/1427385-0x0e-tunnels-pivots-redirectors/5947615-reverse-ssh
- https://edu.defensive-security.com/view/courses/linux-attack-live-forensics-at-scale/1430312-0x03-purplelabs-default-targets/5947855-cve-2022-2588
2023/04/01:
- https://edu.defensive-security.com/view/courses/linux-attack-live-forensics-at-scale/1427326-0x0d-linux-shells-c2-implants/5946619-sliver-in-details
2023/03/25:
- https://edu.defensive-security.com/view/courses/linux-attack-live-forensics-at-scale/1427336-0x10-linux-attack-detection-analysis/5806299-ks-rootkits-xt_conntrack-ko-infection
2023/02/24:
- https://edu.defensive-security.com/view/courses/linux-attack-live-forensics-at-scale/1427336-0x10-linux-attack-detection-analysis/5704325-us-rootkits-zombie-ant-farm-pypreloader-1

Linux Attack and Live Forensics At Scale MATERIALS-ONLY

Buy nowLearn more

Course Mindmap - Linux Attack and Forensics Inspection at scale-v3.png1

PurpleLABS Cyber Range Network Architecture

0x01. PurpleLabs Hunting Components Dashboard

PurpleLabs Dashboard

PurpleLabs Components - Helicopter View

0x02. PurpleLabs User Setup Overview

Welcome to PurpleLABS!

Open Source Community

Network Addressing

Your Virtual Machines

Data sources and SIEM/DFIR components

Troubleshooting

Rules and policies

Threat Detection and Hunting with PurpleLabs #1

Threat Detection and Hunting with PurpleLabs #2

0x03. PurpleLabs Default Targets

Reverse Shell / Backdoor payloads

File transfers

Apache Tomcat

Apache HTTP CVE-2021-41773

NFS no_root_squash

Dirty Pipe CVE-2022-0847

pkexec CVE-2021-4034

CVE-2022-2588

CVE-2022-22963: Spring Cloud Function RCE

Solr Log4j

Samba / CIFS

Weblogic SSRF

SSH Brute force

Docker escape

Exiftool CVE-2021-22204

Remote Heap Exploitation

Attack emulation: Red Canary Atomics against your VMs

0x04. Blue/DFIR Components: SIEM

SIEM/HELK introduction

SIEM/HELK Data sources

SIEM/Splunk introduction

SIEM/Splunk Data sources

SIEM/Graylog intro

SIEM/Graylog Data sources

SIEM/Wazuh Data Sources

0x05. Blue/DFIR Components: HOST

Host/Syslog

Host/Auditd2

Host/Falco Runtime Security

Host/Tracee Syscall Tracing

Host/Sysdig Syscall tracing

Host/Sysmon4Linux

Host/Velociraptor

Host/OSQuery

Host/Sandfly

Host/Wazuh

Host/CatScale

Host/UAC

Host/varc

Host/rkhunter

Host/Yara Scanning

Host/LKRG

Host/SELinux

Host/Clamav

0x06. Blue/DFIR Components: NETWORK

Network/Zeek

Network/Suricata

Network/Arkime Full Packet Capture

Network/Forward Proxy Squid SSL Decryption

Network/WAF Modsecurity

0x07. Introduction to the course

About the course

Why Linux as a target?

Current Linux threat landscape (2022/2023)

Linux Appliances Exploitation Cases

Purple teaming approach

Threat Hunting vs Incident Response

Linux MITRE ATT&CK

Linux EDR/Security Products1

DFIR basics

DFIR Preparation

Basic TCP/IP stack

Basic Linux Investigation tools

General rootkits behavior

Recommended books1

0x08. Establishing baseline vs Attack Vectors

Process names

Process arguments

Parent-child process relationship

/proc/ exploration

sysctl

Linker / LD_PRELOAD

Linux Kernel Modules

LKM Off

DNS Settings

Network profiling

Open Ports

iptables

At / cron / systemd timers

Users

Shell Configuration

Initialization scripts

Special File Attributes

File Hashing / checksums

OS / application logging behavior

SSH keys

Linux namespaces

0x09. Rule-based Linux Log Analysis

Sigma Rules Hands-on Introduction

Protections Artifacts from Elastic

Detection Rules from Elastic

0x0a. Linux Memory forensics

Linux Report Sections

Building Volatility 2 Linux Profiles

Building Volatility 3 ISF JSON

Memory Acquisition

Forensics with Volatility2

Forensics with Volatility 3

Fileless plugin

0x0b. Linux Shells / C2 Implants

Sliver C2 Setup

Sliver Transports and Pivoting

Sliver in details

Meterpreter Setup

Sliver to Meterpreter Sideload

Meterpreter shell_to_meterpreter

TLS/sniCAT

Merlin Setup

Merlin Transports

Merlin libprocesshider

DNS/AXFR Payload Delivery

DNS/Weasel

DNS/dnscat2

ICMP-based C2 and Exfiltration

Port knocking

0x0c. Tunnels / pivots / redirectors

SSH Socks Proxy

SSH Tunneling

Reverse SSH

Shootback Protocol Tunneling

SSHimpanzee

socat

Chisel

ngrok

0x0d. Incident response

IRIS Introduction

IR Playbooks2

0x0e. Linux ATTACK/Detection Analysis

Evaluation of Linux Rootkits and Detection INTRO SLIDES - Practical Linux Rootkits for Red and Blue .pdf

eBPF SLIDES - Practical Linux Rootkits for Red and Blue .pdf

[US] Rootkits: Shared Library Injection

[US] Rootkits: Oh my Father!

[US] Rootkits: Socket Command Injection

[US] ELF injection with ptrace()

[US] ELF injection without ptrace()

[US] Proxy execution with DDexec

[US] In-memory execution with memrun

[US] memfd_vs_no_exec

[US] Fileless Scripting Execution

[US] Rootkits: Dynamic Linker Preloading

[US] Rootkits: Zombie Ant Farm Pypreloader #1

[US] MSF Shellcode from bash

[US] Rootkits: sshd injection

[US] Rootkits: sshd dummy cipher suite

[US] PAM-based Rootkits #1

[US] PAM-based Rootkits #2

[US] PAM-based Rootkits #3

[US] Yum/RPM Persistence

[US] Rootkits: Apache mod_authg

[US] Rootkits: HTTPD mod_backdoor

[US] Webshells: SOCKS from JSP

[US] Webshells: meterphp

[US] Webshells slopshell

[KS] Rootkits: Usermode Helper on ICMP

[KS] Rootkits: In-Memory LKM Loading

[KS] Rootkits: Reptile Analysis

[KS] Rootkits: Suterusu Analysis

[KS] Rootkits: Reveng_rtkit Analysis

[KS] Rootkits: iptables evil bit

[KS] Rootkits: systemtap creds() upgrade

[KS] Rootkits: Netfilter hooking #1

[KS] Rootkits: xt_conntrack.ko Infection

[KS] Rootkits: Ftrace Hooking #1

[KS] Rootkits: bad-bpf trip

[KS] Rootkits: XDP-UDP-Backdoor

[KS] Rootkits: eBPF hooking / TripleCross

[KS] Rootkits: eBPF SSL/TLS text capturing

[KS] Rootkits: eBPF Raw Tracepoint Interception

[KS] Rootkits: eBPF PAM creds stealing

[KS] Rootkits: eBPF KoviD Analysis

[KS] Rootkits: eBPF bpfdoor

[KS] Rootkits: ebpfkit Analysis

[KS] Randomized Faulter [RETIRED]

0x0f. Changelog

Changelog

0x10. Active Security Research

Active Research

Rootkits: Syscall hooking

Linux Incident Response

In-memory Execution

Evasion / Bypassing techniques

Exploitation

Memory Forensics

Linux Internals