Endpoint threat hunting: Sysmon and auditd
Starting from a hypothesis, you search Sysmon data on Windows and auditd data on Linux for attacker traces that have not yet raised an alert, and turn your findings into lasting detection rules.
Level 401 · 15 lessons · 12 practice labs
Lessons
Hunting method
- The hunting loop: hypothesis, data, analysis, outcome
- Building hypotheses from ATT&CK techniques
- What data do I have: a telemetry coverage map
- Short task: write three hypotheses and match the data they need
Windows hunts
- Sysmon configuration: what to log and how much
- Abuse of built-in tools: rundll32, regsvr32, certutil
- Odd parent-child process relationships
- Short task: hunt for shells launched by Office
Linux hunts
- auditd rules: execve, file and privilege events
- Hunting Linux persistence: cron, systemd, SSH keys
- Rarely run binaries and odd directories
- Short task: find a shell opened by the web user in auditd data
From finding to rule
- From hunt to detection: making it permanent with Sigma
- The hunt report: why an empty hunt still counts
- Capstone: hunt down a quiet intrusion that began two weeks ago
Practice labs
- Produce a hypothesis from an ATT&CK technique: Write a testable hunt hypothesis from a given technique.
- Three hypotheses and the data needed: Write three hypotheses and match each to an available telemetry source.
- Draw a telemetry coverage map: Map the data collected on endpoints against techniques and report five that cannot be seen.
- List odd parent-child process relations: Count parent-child process pairs in prepared Sysmon data and produce the ten rarest.
- Hunt shell processes started from Office: Find the command-line processes spawned by a document application and list their commands.
- Hunt misuse of system tools: Separate rundll32, regsvr32 and certutil uses from normal use and justify the three suspicious ones.
- Write an auditd rule: Add two rules logging execve calls and changes to a critical file and verify the log.
- Find the shell opened by the web user: Find the shell processes running as the web server user in auditd data.
- A persistence hunt on Linux: Sweep cron, systemd and SSH keys on five lab servers and find the rare binary running from an odd directory.
- Write a hunt report: Report a hunt that came up empty under hypothesis, data, method and outcome.
- Turn the hunt into a Sigma rule: Write the process relationship you found as a Sigma rule and test it on prepared logs.
- Hunt the quiet intrusion that began two weeks ago: Find the quiet intrusion in Ayçiçeği Gıda's prepared endpoint data through three different hypotheses and prove the findings.
About this course
Starting from a hypothesis, you search Sysmon data on Windows and auditd data on Linux for attacker traces that have not yet raised an alert, and turn your findings into lasting detection rules.
What you will learn
- Hunting method
- Windows hunts
- Linux hunts
- From finding to rule
Prerequisites
You should have practised the topics of the same path up to level 301.
Lab environment
Lessons run in your own Kali Linux terminal in the browser, connected to a private lab network. Nothing to install.
Frequently asked questions
- Is this course right for my level?
- The course is at level 401; it assumes you know the topics of the lower-level courses.
- Is there anything to install?
- No. Every lesson runs in your own lab environment that opens in the browser.
- How do lessons work?
- Each lesson has 8 to 10 steps and a short quiz. Early steps show the command to type, later steps give less help; if two attempts fail, the solution opens.
- Can I try it for free?
- Yes. The first three lessons of every course are free.