Linux Threat Detection 3

Not all Linux attacks are simple SSH brute force or cryptomining - some are carefully planned, targeted campaigns comparable to most advanced Windows breaches. In this room, you'll delve into more complex, manual Linux attack techniques commonly seen in targeted intrusions and learn how to detect them using system logs.

Learning Objectives

• Learn how reverse shells are used in Linux intrusions
• Understand how the attackers escalate their privileges
• Explore the five most common techniques to persist on Linux
• Uncover the learned techniques through the system logs 

Prerequisites

• Complete the Linux Threat Detection 2 room
• Recall the second half of the MITRE tactics
• Be familiar with Bash and Linux administration

Lab Access

Before moving forward, start the lab by clicking the Start Machine button below. The machine will start in split view and will take about two minutes to load. In case the machine is not visible, you can click the Show Split View button at the top of the task. You may need to work as the root user for some tasks. To switch to root on the VM, please run sudo su.

Set up your virtual environment

To successfully complete this room, you'll need to set up your virtual environment. This involves starting the Target Machine, ensuring you're equipped with the necessary tools and access to tackle the challenges ahead.

Target machine

Status:Off

Start Machine