Practical Linux Attack Paths and Hunting for Red and Blue Team (16–18 Sept 2024)
Practical Linux Attack Paths and Hunting for Red and Blue Team (16–18 Sept 2024) - Image 2
Leszek Mis
Practical Linux Attack Paths and Hunting for Red and Blue Team (16–18 Sept 2024) - Image 4

Practical Linux Attack Paths and Hunting for Red and Blue Team (16–18 Sept 2024)

Dive into the world of Linux attack paths, local and remote exploitation, process injection, process hiding, tunneling, network pivoting, and syscall hooking
techniques. See hands-on how Linux malware, userspace, and kernel space rootkits work in well-prepared Detection PurpleLabs Cyber Range, analyze and modify the source codes, find interesting behavior patterns in binaries and logs, learn what telemetry is needed to catch modern Linux threat actors, and find how to proactively validate and improve detection coverage with step-by-step Linux adversary emulations. On top of that, run your VMs RAM acquisition ‘on click’ and analyze memory images with Volatility Framework 2/3 at any stage of the course.
This training is a walkthrough of the Open Source Linux offensive and defensive techniques and tooling in 2023/2024 that allows for chaining these TTPs together and understanding better the threat ecosystems in Linux. I trust this training compilation and hands-on experience will change the way you look at hardening and low-level monitoring of your critical Linux-based ecosystems.
This course takes on An “Attack vs. Detection” approach in a condensed format. This class is intended for students who have a basic understanding of Linux and have to deal with advanced threats. Furthermore, the course is also interesting for experienced DFIR/SOC/CERT Players who aim to dig deeper into understanding Linux internals and corresponding network attack analysis techniques, detection, and response.If you want to enhance your understanding of Linux x86/x64 internals and stay prepared for Linux threats, this training is a must-attend!

 

The three-day course will take place on 16 to 18 September 2024 at the Novotel London West.

The course will be cancelled if minimum numbers are not reached so book early to avoid disappointment.

This product is currently out of stock and unavailable.

SKU: 44CON-TRN-S24-PALP Categories: , , Tags: , , , , ,

Presented by: Leszek Miś

“Practical Linux Attack Paths and Hunting for Red and Blue Team” training has been created with a focus on realistic hands-on experience in analyzing user space and kernel space Linux rootkits, including recent Linux APT campaigns, C2 frameworks for Linux with a focus on Sliver/Metasploit overview/behavior vs hunting/DFIR tooling in Linux ecosystem. This training helps create and understand low-level Linux attack paths, improve your Linux detection coverage, see in action many Open Source DFIR/defensive projects, and understand the need for Linux telemetry, especially including Docker/Kubernetes clusters where Runtime Security solutions are a must these days. The techniques and attack paths covered in this training include many different implementations of loading LKM remotely, eBPF, XDP, FTRACE, KPROBE, UPROBE, NETFILTER, SYSTEMTAP, PAM, SSHD, HTTPD/NGINX, LD_PRELOAD-based code samples and PoCs. Detection and forensics layers include LKRG, BPFTOOL, VELOCIRAPTOR IR, OSQUERY, Elastic Security, cli-based /proc/ and /sys/ analysis, memory forensics with VOLATILITY FRAMEWORK with the semi-automated RAM acquisition, SYSMON4Linux, FALCO, TRACEE, SYSDIG, TETRAGON, SANDFLY SECURITY, ZEEK, SURICATA, MOLOCH/ARKIME, YARA and more.

During the training, we are going to make a custom combo of both red and blue parts and we will achieve that by utilizing an Attack Flow Builder, Defender, Workbench, and Navigator for a structured format of training suitable for production uses immediately after the course.

We will actively discuss and play with a set of real Linux offensive use cases vs detection/forensics view. The hands-on content has been divided into user-space and kernel-space sub-sections. When you are done, dig deeper and create your own custom attack paths, then improve your detection coverage. Purple teaming for life!

  1. Current Linux threat landscape
  2. Linux Appliances Exploitation Cases
  3. Purple teaming approach
  4. Threat Hunting vs Incident Response
  5. Linux MITRE ATT&CK
  6. Linux EDR/Security Products
  7. Basic Linux Investigation tools
  8. General rootkits behavior
  9. Hands-on Blue / DFIR components:
    1. HOST:
      1. Host/Syslog
      2. Host/Auditd
      3. Host/Falco Runtime Security
      4. Host/Tracee Syscall Tracing
      5. Host/Sysdig Syscall tracing
      6. Host/Sysmon4Linux
      7. Host/Velociraptor
      8. Host/OSQuery FleetDM + osquery-defence-kit
      9. Host/Sandfly Security
      10. Host/Wazuh
      11. Host/CatScale
      12. Host/UAC
      13. Host/pspy
      14. Host/varc
      15. Host/rkhunter
      16. Host/Yara FS/memory Scanning
      17. Host/LKRG
      18. Host/SELinux
      19. Host/Clamav
      20. Host/Entropyscan
    2. NETWORK:
      1. Network/Zeek
      2. Network/Suricata
      3. Network/Arkime Full Packet Capture
      4. Network/Forward Proxy Squid SSL Decryption
      5. Network/WAF Modsecurity
    3. SIEM:
      1. SIEM/Elastic Security introduction
      2. SIEM/Elastic Security Data sources
      3. SIEM/Splunk introduction
      4. SIEM/Splunk Data sources
      5. SIEM/Graylog intro
      6. SIEM/Graylog Data sources
      7. SIEM/Wazuh Introduction
      8. SIEM/Wazuh Data Sources
  10. Baseline vs offensive
    1. Process names
    2. Process arguments
    3. Parent-child process relationship
    4. /proc/ and /sys/ exploration
    5. sysctl
    6. Linker / LD_PRELOAD
    7. Linux Kernel Modules / LKM Off
    8. Dmesg
    9. DNS Settings
    10. Network profiling
    11. Open / hidden Ports
    12. iptables
    13. At / cron / systemd timers
    14. Users
    15. Shell Configuration
    16. Initialization / systemd scripts
    17. Special File Attributes
    18. File Hashing/checksums
    19. OS/application logging behavior
    20. SSH keys vs backdoors
    21. Linux namespaces
  11. Local / Remote Exploitation
  12. C2 Frameworks / C2 shells/ implants
    1. Sliver C2 Setup
    2. Sliver Transports and Pivoting
    3. Sliver in details
    4. Meterpreter Setup
    5. Sliver to Meterpreter Sideload
    6. Meterpreter shell_to_meterpreter
    7. TLS/sniCAT
    8. Merlin Setup
    9. Merlin Transports
    10. Merlin libprocesshider
    11. DNS/AXFR Payload Delivery
    12. DNS/Weasel
    13. DNS/dnscat2
    14. ICMP-based C2 and Exfiltration
    15. Port knocking
    16. Hidden NTP Exfiltration
  13. User space rootkits:
    1. [US] Rootkits: Shared Library Injection
    2. [US] Rootkits: Oh my Father!
    3. [US] Rootkits: Socket Command Injection
    4. [US] ELF injection with ptrace()
    5. [US] ELF injection without ptrace()
    6. [US] Proxy execution with DDexec
    7. [US] In-memory execution with memrun
    8. [US] memfd_vs_no_exec
    9. [US] Fileless Scripting Execution
    10. [US] Rootkits: Dynamic Linker Preloading
    11. [US] Rootkits: Zombie Ant Farm Pypreloader #1
    12. [US] MSF Shellcode from bash
    13. [US] Rootkits: sshd injection
    14. [US] Rootkits: sshd dummy cipher suite
    15. [US] PAM-based Rootkits #1
    16. [US] PAM-based Rootkits #2
    17. [US] PAM-based Rootkits #3
    18. [US] Yum/RPM Persistence
    19. [US] Rootkits: Apache mod_authg
    20. [US] Rootkits: HTTPD mod_backdoor
    21. [US] Webshells: SOCKS from JSP
    22. [US] Webshells: meterphp
    23. [US] Webshells slopshell
    24. [US] Linux Process Snooping
  14. Kernel space rootkits:
    1. [KS] Rootkits: User mode Helper on ICMP
    2. [KS] Rootkits: In-Memory LKM Loading
    3. [KS] Rootkits: Diamorphine
    4. [KS] Rootkits: Reptile Analysis
    5. [KS] Rootkits: Suterusu Analysis
    6. [KS] Rootkits: Reveng_rtkit Analysis
    7. [KS] Rootkits: iptables evil bit
    8. [KS] Rootkits: systemtap creds() upgrade
    9. [KS] Rootkits: Netfilter hooking #1
    10. [KS] Rootkits: xt_conntrack.ko Infection
    11. [KS] Rootkits: Ftrace Hooking #1
    12. [KS] Rootkits: bad-bpf trip
    13. [KS] Rootkits: XDP-UDP-Backdoor
    14. [KS] Rootkits: eBPF hooking / TripleCross
    15. [KS] Rootkits: eBPF SSL/TLS text capturing
    16. [KS] Rootkits: eBPF Raw Tracepoint Interception
    17. [KS] Rootkits: eBPF PAM creds stealing
    18. [KS] Rootkits: eBPF KoviD Analysis
    19. [KS] Rootkits: eBPF bpfdoor
    20. [KS] Rootkits: ebpfkit Analysis
    21. [KS/US] Backdooring Initramfs
  15. Linux Memory Forensics:
    1. Linux Report Sections
    2. Building Volatility 2 Linux Profiles
    3. Building Volatility 3 ISF JSON
    4. Memory Acquisition
    5. Forensics with Volatility2
    6. Forensics with Volatility 3
    7. Fileless plugin
  16. Linux Incident Response Playbooks
  17. Create your own custom Linux attack path and hunting/IR procedure

The training content focuses on the complete material of the “Linux Attack and Live
Forensics At Scale” course: https://edu.defensive-security.com/linux-attack-live-forensics-at-scale

  • Get to know the newest Linux attack paths and hiding techniques vs proactive detection
  • Learn current trends, techniques, and offensive tools for Persistence, Evasion, Exfiltration, C2, Discovery, Lateral Movement, Execution, and Credential Access against Linux machines ← Linux Matrix ATT&CK Framework
  • Learn ways to improve detection and sharpen your event correlation skills across many different Linux/network data sources
  • Get to know visibility/detection methods and capabilities of well-recognized Hunting and Detection tools including Velociraptor, Elastic Agent+Linux Sigma, Splunk, Moloch/Arkime, OSquery Fleet, Wazuh, Graylog, Sandfly Security
  • Find the malicious Linux activities and identify threat details on the network
  • Prepare your SOC team for fast filtering out Linux network noise and allow for better incident response handling
  • Find out how Detection / DFIR Open Source Software can support your SOC infrastructure
  • Understand the values of proactive Linux forensics scans vs manual and automated approaches to simulate attackers and generate anomalies
  • Identify Linux blind spots in your network security posture
  • Understand the value of the purple teaming approach where you hunt for yourself and your teammates

  • Understand the advantages and values of the purple teaming approach in the Linux red/blue ecosystem
  • Learn about the full scope of Linux offensive techniques, tools, and the newest community research 2023/2024
  • Learn about different detection/response tools and techniques vs attacks
  • Learn how to hide effectively in the Linux OS and how to exfiltrate data in stealthy ways
  • Learn how to deploy and use C2, low-level rootkits and see this reflected in the detection/DFIR tooling
  • Get code and command snippets ready to use during your red team and adversary operations/emulations
  • Get experience with Sigma Rules/Protections Artifacts for staying stealthier and improving your defense evasion skills at scale

  • Understand the advantages and values of the purple teaming approach in the Linux ecosystem
  • Learn about the full scope of Linux Detection/Forensics techniques, tools, and the newest community research
  • Understand the structures of advanced Linux attack paths, how they really work, and how to protect
  • Learn about different offensive tools that you can use against hackers
  • See the effectiveness of Detection tooling vs attack emulations
  • Get experience with Yara/Sigma Rules for a better understanding of the logic behind attacks and needed telemetry

  • This knowledge will change the way you look at hardening and monitoring your Linux ecosystems
  • Recognize security-related enhancements in the modern Linux kernel
  • Understand current kernel components and programming interfaces used to compromise a system
  • Discover recommended Open Source Security solutions against actual hands-on attacks
  • Learn about the full scope of Linux Detection/DFIR techniques, tools, and the newest community research
  • Understand the advantages and values of the purple teaming approach in the Linux red/blue scope
  • Gain experience in managing many different detection and visibility layers

  • Fundamentals of how Linux Architecture works is required
  • An intermediate level of Linux command-line syntax experience
  • Basic knowledge of TCP/IP network protocols
  • Offensive Security/Penetration testing experience will be definitely beneficial,
    but not required
  • Basic programming skills are a plus and are essential

  • This training is based on dedicated PurpleLABS virtual infrastructure so there are no special student desktop requirements. No more initial setup issues, just a pure training experience. Every student will gain full access to the PurpleLabs environment for 30 days post-training.
  • VPN client installed according to VPN Setup instructions or just a browser
  • Discord account as an invite to a dedicated training channel will be delivered
  • Stable internet connection

Leszek Miś is a highly experienced Security Researcher with over 20 years of experience in the industry. He is the Founder of Defensive Security, a company that provides Open Source Security Services including Red Team adversary emulations, Blue Team detection coverage testing, DFIR/Live Forensics, and high-quality knowledge transfer and training.


He has worked in various positions within the infosec field, including as a Linux Administrator, System Developer, DevOps Engineer, Penetration Tester, Security Consultant, and VP Of Cyber Security. He has extensive knowledge of Linux internals and has deep experience in Linux malware hands-on analysis from the perspective of the red and blue team.


Leszek is a recognized speaker and trainer, having spoken at various industry events such as Black Hat USA, Hack In The Box, and OWASP Appsec US.


Leszek holds many certifications, including OSCP, RHCA, RHCSS, and Splunk Certified Architect. His areas of interest include the development of multi-stage attack paths with mappings to MITRE ATT&CK Framework, multi-layer defensive paths with mappings to MITRE D3FEND Framework, Linux/network ML feature extraction, Linux OS internals including eBPF, detection engineering, log behavior analysis, memory forensics, and exploration of new Linux offensive ttps vs DFIR/detection/protection techniques.

The three-day course will take place on 16 to 18 September 2024 at the Novotel London West.

The price is £3,000 (inc VAT/£2,500 ex VAT).

Conference and training tickets are non-refundable as per our Terms of Service.

This ticket is NOT transferable (i.e. you cannot use it one day and pass it to someone the other — you can however change the name on it if circumstances change and you can’t attend).

The course has been cancelled.

If you purchase a training course you get discounted rates for future training courses for one year and for the following 44CON conference.