The primary goal of this training is to show and teach you how to generate offensive attack events/symptoms against Linux boxes that you will detect in parallel by using PurpleLABS SOC stack powered by Sigma Rules – the open standard event description ruleset – and the rest of the dedicated, Open Source security solutions in use.
Participants will thoroughly familiarize themselves with the content of the available Sigma detection rules and their structure, better understand the essence of offensive actions in Linux subsystems, learn the low-level relationships between data sources, and thus achieve knowledge in creating their own detection rules (and eventually bypassing them).
$2,299.00
| Date | Day | Time | Duration |
| 21 Nov | Sunday | 0900-17:00 GST/GMT+4 | 8 Hours |
| 22 Nov | Monday | 0900-17:00 GST/GMT+4 | 8 Hours |
Make sure you’re choosing the right course. This is the Linux version. The Windows version is HERE. Or do both as a COMBO 4-day HERE!
The primary goal of this training is to show and teach you how to generate offensive attack events/symptoms against Linux boxes that you will detect in parallel by using PurpleLABS SOC stack powered by Sigma Rules – the open standard event description ruleset – and the rest of the dedicated, Open Source security solutions in use.
Participants will thoroughly familiarize themselves with the content of the available Sigma detection rules and their structure, better understand the essence of offensive actions in Linux subsystems, learn the low-level relationships between data sources, and thus achieve knowledge in creating their own detection rules (and eventually bypassing them).
This course takes on an “Adversary Simulations vs Hunting” approach in a condensed format. This will allow a gradual escalation of the level of knowledge in the scope of red / blue / purple teaming to both experienced specialists and beginners while maintaining the attractiveness and pleasure of performing tasks. Linux detection and hunting does not have to be boring and tedious!
● Realistic 100% pure lab-oriented Linux offensive and defensive security use cases.
● Minimum theory, maximum hands-on with high level of expertise.
● A lot of accumulated knowledge in one place with a focus on high priority elements.
● Focused on Open Source Security
• Initial Access (TA001) • Execution (TA002) • Persistence (TA003) • Privilege Escalation (TA004) • Defense Evasion (TA005) • Credential Access (TA006) • Discovery (TA007) • Lateral Movement (TA008) • Collection (TA009) • Command and Control (TA0011) • Exfiltration (TA0010) • Impact (TA0040) • Breach and Attack Simulations • Forensics
● Introduction to PurpleLabs ● Current state of Linux malware / APT campaigns ● Analysis of Linux C2 implants and interesting post-exploitation modules ● Linux LOLbins / one-liners for bind & reverse shells, download/upload, file compression ● Linux Network / Service / User / Local Enumeration ● /proc exploration ● Linux ELF in-memory code execution vs live process analysis ● Linux syscall faulting for C2 agent execution ● Injecting an ELF file into a remote Linux process ● Linux GDB Shared Library Injection ● Linux sshd Injection + password extraction ● Linux Apache rootkit + command execution over HTTP ● Linux kernel space rootkits and backdoors vs LKRG ● Building Linux custom payloads ● Linux Runtime Security / syscall filtering / kernel instrumentation using falco, tracee and systemtap ● Linux persistence and hunting methods ● Linux process hiding and in-memory code injection techniques ● Linux buffer overflow / privilege escalation artifacts ● Linux hardening best practices / OpenSCAP ● Chroot / nsjail / SELinux / caps / seccomp vs exploitation ● Socket command execution ● Auditd vs Falco vs Tracee vs local adversary simulations ● Invoking Linux Reverse shell from kernel space in response to ICMP ● Linux shells over hidden ICMP channel ● Data exfiltration over DNS vs detection ● Pwn remote docker host over DNS rebinding ● Escaping Docker containers ● In-memory DNS AAAA implant for Linux ● DNS AXFR Payload Delivery ● SSH tunneling, lateral movement and pivoting vs HASSH ● HTTP2 Exfiltration and DNS over HTTPS C2 ● Playing with LDAP as payload delivery channel / hidden storage ● Tunneling traffic into internal networks ● Port Knocking vs Full Packet Capture Analysis ● Mutual TLS / SSL C2 communication vs JA3 / JARM ● SNI-based TLS data exfiltration ● The world of web shells vs Yara / OSquery / Velociraptor detection at scale ● Threat Hunting and Detection with Web Proxy Logs ● Linux Memory Forensics using Volatility Framework ● The importance of Linux Process trees ● HTTP exfiltration and covert channels based on UA, cookies / encrypted cookies, WebDAV, WebSockets ● Youtube-based command delivery and execution ● Google Translator as a C2 Proxy ● Overview of Linux Security Benchmarks / Linux Hardening guides vs PurpleLabs offensive content ● Introduction to Fapolicyd framework ● Introduction to FreeIPA - a “domain controller” for Linux clusters ● Linux Tips and Tricks for Rapid Triage ● and more
