To efficiently use this content, we created a proposed generic flow consisting of six simple steps:

1. Get access to your private TARGET_X, KALI_X, and C2_X VMs.

2. Install EDR/Runtime Security/DFIR tooling @ TARGET_X:

• Choose and install the Linux EDR/Runtime Security/DFIR engine you want to evaluate. Within TARGET_Xin PurpleLabs Cyber Range, we support by default:

  • Falco Runtime Security

  • Kunai Runtime Security

  • Tetragon Runtime Security

  • Elastic Security

  • Splunk SIEM

  • Linux IR scripts

  • Wazuh

  • OSquery + osquery-defense-kit

  • UAC

  • Velociraptor IR

  • bpftrace

  • ghostscan

Step-by-step instructions showing how to install individual agents are available in the section:

• https://edu.defensive-security.com/view/courses/linux-attack-detection-and-live-forensics-v2-0/3372305-golden-rules-before-you-start-hands-on/11062451-enable-runtime-security-dfir-agents

Dedicated instructions per tool can also be found in the "Defensive/DFIR Tooling" section.

3. Search Technique:

• Identify relevant techniques from a comprehensive EDRmetry Matrix database.

4. Choose offensive commands:

• Extract the necessary commands or code snippets and follow step-by-step instructions.

5. Execute attack emulations:

• Prepare attack chains or manually execute single offensive tests on a vulnerable-by-design TARGET_X Linux system.

6. Verify detections and alerts:

• Check detections, telemetry, and alerts generated within the chosen EDR/Runtime/SIEM platform. You can challenge yourself by searching for detections/artifacts, or you can easily use the provided DETECTION/DFIR PHASE instructions

7. Dig deeper:

• Make configuration changes to your EDR/Runtime/DFIR or ask the EDR/SIEM vendor questions.

• Customize offensive steps, make changes to the code, and develop potential bypasses eventually

• Customize defensive/forensics steps and search for new detection logics

• Do additional research from the perspective of the red and blue teams

• Create complex attack paths