Practical Linux Attack Paths and DFIR/Hunting v2.0

• Get to know the newest Linux attack paths and offensive techniques seen in the real intrusions vs active detection, hunting, and live forensics
• Learn current trends, techniques, and offensive approaches for Persistence, Evasion, Exfiltration, C2, Discovery, Lateral Movement, Execution, and Credential Access against Linux machines ← Linux Matrix ATT&CK Framework in hands-on format (400+ techniques included)
• Learn ways to improve detection and sharpen your event correlation skills across many different Linux/network data sources
• Get to know visibility/detection methods and capabilities of well-recognized Hunting and Detection tools, including Velociraptor, Elastic Security Agent, Splunk, OSquery Fleet, Wazuh, and Sandfly Security
• Understand real-time telemetry, find the malicious Linux activities, and identify threat details on the network by actively playing with Falco, Kunai, Tetragon, Jibril, and Tracee Runtime Security Engines
• Prepare your SOC team for fast filtering out Linux network noise and allow for better incident response handling
• Find out how Detection / DFIR Open Source Software can support your SOC infrastructure
• Understand the values of proactive Linux forensics scans vs manual and automated approaches to simulate attackers and generate anomalies
• Identify Linux blind spots in your network security posture
• Understand the value of the purple teaming approach, where you hunt for yourself and your teammates Benefits For Red/Blue/SecOps Teams:
• Understand the advantages and values of the purple teaming approach in the Linux red/blue ecosystem
• Learn about the full scope of Linux offensive techniques, tools, and the newest community research 2024/2025/2026
• Learn how to hide effectively in the Linux OS and how to exfiltrate data in stealthy ways
• Learn how to deploy and use C2, low-level rootkits, and see this reflected in the detection/DFIR tooling
• Get code and command snippets ready to use during your red team and adversary operations/emulations
• Discover recommended Open Source Security solutions and see the effectiveness of the Detection tooling vs attack emulations
• Learn about the full scope of Linux Detection/Forensics techniques, tools, and the newest community research
• Get experience with Sigma Rules/Protections Artifacts for staying stealthier and improving your defense evasion skills at scale
• Recognize security-related enhancements in the modern Linux kernel
• Understand current kernel components and programming interfaces used to compromise a system
• This knowledge will change the way you look at hardening and monitoring your Linux ecosystems

Day 1

1. Current Linux threat landscape.

2. Purple teaming approach and Active Defense.

3. Linux MITRE ATT&CK Framework.

4. Understanding Linux EDR/Runtime Security Architecture:

○ Core functionalities and key features

○ Visibility events/indexes/data sources

○ Detection logic/rulesets

○ Analytics / Query language

○ Triage and Forensics collections

○ Deployment and Integrations

5. Hands-on Blue / DFIR components:

○ HOST:

i. Syslog, Auditd, Falco, Kunai, Jibril, Tetragon, Tracee, Sysmon4Linux, Velociraptor, OSQuery/Sunlight, Sandfly Security, Linux IR Scripts, UAC, Yara, LKRG, SELinux, and more.

○ NETWORK:

i. Zeek, Suricata, Arkime/Moloch FPC, Modsecurity

○ SIEM:

i. Elastic Security, Splunk, Wazuh

○ MEMORY:

i. Volatility3 Framework, process dumping, gdb

6. Linux Baseline Profiling vs Offensive point of view.

Day 2

7. Local / Remote Exploitation vs Detection and DFIR Artifacts

8. C2 Frameworks / C2 shells / implants / SOCKS / Tunnelling.

9. Fileless / in-memory / BOF executions.

10. Process Injection techniques.

11. Persistence and Defense Evasion techniques.

12. User space rootkits.

13. Kernel space rootkits.

14. eBPF rootkits.

15. Creating Custom Attack Paths with ATT&CK Flow Builder and EDRmetry Linux Playbook.

• Fundamentals of how Linux Architecture works are required
• An intermediate level of Linux command-line syntax experience
• Basic knowledge of TCP/IP network protocols
• Offensive Security/Penetration testing experience will be beneficial, but is not required
• Basic programming skills are a plus and are essential

Laptop → This training is based on dedicated PurpleLABS virtual infrastructure, so there are no special student desktop requirements. No more initial setup issues, just a pure training experience.

Every student will gain full access to the PurpleLabs Cyber Range environment for 30 days post-training.