Linux Threat Detection 2

What happens next after threat actors enter the Linux system? What commands do they run, and what goals do they aim to achieve? In this room, you'll find out by exploring common attack techniques, detecting them in logs, and analyzing a real-world cryptominer infection from start to finish.

Learning Objectives

• Explore how to identify Discovery commands in logs
• Learn common threats endangering Linux servers
• Know how attackers upload malware onto their victims
• Practice your skills by uncovering a real cryptominer attack

Prerequisites

• Complete the Linux Threat Detection 1 room
• Remind yourself of MITRE tactics and techniques
• Know basic Linux commands like wget or grep

Lab Access

Before moving forward, start the lab by clicking the Start Machine button below. The machine will start in split view and will take about two minutes to load. In case the machine is not visible, you can click the Show Split View button at the top of the task. You may need to work as the root user for some tasks. To switch to root on the VM, please run sudo su.

Set up your virtual environment

To successfully complete this room, you'll need to set up your virtual environment. This involves starting the Target Machine, ensuring you're equipped with the necessary tools and access to tackle the challenges ahead.

Target machine

Status:Off

Start Machine