Containment and eradication: network, accounts and hosts
You stop an attack while it spreads: network-level isolation, revoking accounts and sessions, cleaning up persistence and returning systems safely to service.
Level 301 · 15 lessons · 12 practice labs
Lessons
Network
- Network-level isolation: VLANs, ACLs, firewall
- Blocking C2 domains and IPs: DNS and proxy
- Building a quarantine network
- Emergency egress lockdown
- Short task: isolate an infected host without losing management access
Accounts
- The order of credential resets: which first
- Revoking sessions and tokens
- Cleaning up SSH keys and authorised key files
- Short task: cut off all access for three compromised accounts
Hosts
- Removing persistence: cron, services, web shells
- Rebuild or clean: decision criteria
- Restoring from a clean image and patching
- Watching for reinfection
- Short task: remove every attacker trace from a web server and prove it
Capstone
- Capstone: contain and clean up an attack spread across four hosts
Practice labs
- Map the infected host’s connections and neighbours: List the host’s open connections, its subnet and the internal servers it talks to.
- Isolate an infected host without losing management access: Use firewall rules so the host accepts only SSH from the management address, cut all other traffic and test from both directions.
- Build a quarantine network and move infected hosts into it: Create a separate segment that reaches only the forensics server, move two hosts into it and prove by measurement that nothing leaks out.
- Block a C2 domain at the DNS level: Sinkhole the domain on the lab DNS server and show a query from an internal host no longer resolves.
- Find from the logs the hosts still trying to get past the block: Count attempts to the sinkhole and the blocked IP in DNS and firewall logs and identify an infected host not yet known.
- Apply an emergency egress lockdown without halting the business: Allow-list payment and update destinations, cut all other egress, measure the effect and write the conditions for lifting the lockdown.
- List the open sessions of a compromised account: Find the account’s active SSH sessions, running processes and recent login sources across the servers.
- Clean the foreign SSH key out of the authorised key files: Scan every user’s authorized_keys file, find and remove the unrecognised key and check whether the same key exists on another server.
- Cut off all access for three compromised accounts in the right order: Starting with the admin account, reset passwords, revoke sessions and API tokens, replace keys and prove the old credentials are refused.
- Sweep a server’s persistence points with a checklist: Check cron, systemd units, startup scripts and shell profile files and list those changed in the last week.
- Decide between rebuild and clean using set criteria: Score three hosts’ findings by privilege level, depth of persistence and backup state, and justify the decision for each.
- Restore from a clean image, patch and watch for reinfection: Restore the server from a clean image, apply the patch that closes the way in, bring data back with verification and set a watch rule for the old indicators.
About this course
You stop an attack while it spreads: network-level isolation, revoking accounts and sessions, cleaning up persistence and returning systems safely to service.
What you will learn
- Network
- Accounts
- Hosts
- Capstone
Prerequisites
You should be comfortable with the level 101 and 201 topics of the same path.
Lab environment
Lessons run in your own Kali Linux terminal in the browser, connected to a private lab network. Nothing to install.
Frequently asked questions
- Is this course right for my level?
- The course is at level 301; it assumes you know the topics of the lower-level courses.
- Is there anything to install?
- No. Every lesson runs in your own lab environment that opens in the browser.
- How do lessons work?
- Each lesson has 8 to 10 steps and a short quiz. Early steps show the command to type, later steps give less help; if two attempts fail, the solution opens.
- Can I try it for free?
- Yes. The first three lessons of every course are free.