Detecting Linux attacks: auditd, Falco, eBPF
You catch web shells, persistence, privilege escalation and container escape attempts on Linux servers with auditd rules and Falco, using the visibility eBPF brings.
Level 401 · 13 lessons · 15 practice labs
Lessons
Telemetry
- Linux telemetry sources: auditd, journald, eBPF
- Detection-focused auditd rules
- Falco rules: condition, output, priority
- Short task: find a command’s trace in both auditd and Falco
Attack behaviours
- Web shells: the web server spawning a shell
- Reverse shells and unexpected outbound connections
- Persistence: cron, systemd, SSH keys, ld.so.preload
- Privilege escalation: SUID, sudo abuse, kernel exploits
- Cryptomining: CPU use and pool connections
- Signs of container escape
- Short task: catch the chain from a web shell to root with three rules
Capstone
- Tuning rules: admin work and backup noise
- Capstone: catch an attacker step by step on a compromised web server
Practice labs
- Find the same command’s trace in auditd and Falco: Run a command, find its records in both sources and note what each shows that the other does not.
- Write a detection-focused auditd rule for identity files: Watch writes to passwd, shadow and sudoers with a key and alert only on changes not made by the package manager.
- Find the shell a Falco rule misses and fix the rule: Show the rule watches bash only, widen the condition to cover sh and dash and test it.
- Catch the shell started by the web server: Find shell processes whose parent is the web server in the records and note the command that ran.
- Detect a reverse shell from an unexpected outbound connection: Catch the event where a shell process opens a network socket with Falco and report the destination address.
- Catch persistence through ld.so.preload: Add a rule watching writes to the file, trigger the change and find the path of the loaded library.
- Find cryptomining from its CPU and connection traces: Match the high-CPU process to a connection on a pool port and find the persistence that launches it.
- Catch a process becoming root through SUID abuse: Filter execve events where uid and euid differ and find the binary and the user that escalated.
- Catch a sign of container escape with Falco: Write and try a rule alerting on mounting the host file system and using nsenter from inside a container.
- Write an exception separating admin maintenance from attack: Exclude the alert raised by the backup script by user and path and show the attack test is still caught.
- Prove the chain from web shell to root with three records: Link the web request, the shell process and the escalation event to each other by process ID.
- Catch a newly added sudoers file from the audit record: Add an auditd watch on the sudoers.d directory, create a file and extract who added it and when from the record.
- Detect an interactive shell opened inside a container: Enable the stock Falco rule, open a shell in your own lab container and read the container name and user in the alert.
- List the child processes the web server process started: Extract in time order the commands run by the web server user from audit records.
- Match web access records to process records by time: Show on one timeline the request to the upload directory and the shell process that starts right after.
About this course
You catch web shells, persistence, privilege escalation and container escape attempts on Linux servers with auditd rules and Falco, using the visibility eBPF brings.
What you will learn
- Telemetry
- Attack behaviours
- Capstone
Prerequisites
You should have practised the topics of the same path up to level 301.
Lab environment
Lessons run in your own Kali Linux terminal in the browser, connected to a private lab network. Nothing to install.
Frequently asked questions
- Is this course right for my level?
- The course is at level 401; it assumes you know the topics of the lower-level courses.
- Is there anything to install?
- No. Every lesson runs in your own lab environment that opens in the browser.
- How do lessons work?
- Each lesson has 8 to 10 steps and a short quiz. Early steps show the command to type, later steps give less help; if two attempts fail, the solution opens.
- Can I try it for free?
- Yes. The first three lessons of every course are free.