Endpoint threat hunting: persistence, process trees, legitimate tools
You search process, persistence and session data from Windows and Linux endpoints for attacker traces and tell legitimate admin work apart from abuse.
Level 301 · 15 lessons · 15 practice labs
Lessons
Processes
- Process baselines: which parent starts what
- Unusual parent-child relationships
- Hunting in command lines: encoding, obfuscation, long commands
- Unsigned programs in unusual locations
- Short task: stack unsigned programs running from user folders
Persistence
- Comparing autostart points across the fleet
- Hunting scheduled tasks and cron
- Hunting WMI subscriptions and new services
- Account anomalies: new admins, unusual logon times
- Short task: investigate a startup entry found on only two hosts
Legitimate tools
- Hunting the abuse of legitimate tools
- Remote admin tools: sanctioned or not
- Traces of credential access
- Short task: find downloads made with certutil and classify them
Capstone
- Capstone: find a quiet attacker among 200 endpoints
Practice labs
- Find the unusual parent–child process pair: Count parent–child pairs and show the pair seen only once with its command line.
- Stack unsigned programs running from user folders: Rank unsigned binaries running from AppData and Temp by number of hosts.
- Pick out very long and encoded command lines: Rank command lines by length and character mix and decode the obfuscated script.
- Catch a process name imitating a system tool: Compare names such as svchost with their expected paths and find the one running from the wrong folder.
- Validate a rare process against the fleet baseline: Examine a rare process’s hash, signature and first-seen time and decide whether it is malicious.
- Find the startup entry present on only two hosts: Compare autostart points across the fleet and write down the rare entry with its path.
- Hunt unusual cron jobs on Linux endpoints: Group every host’s cron entries by command and find the one downloading a script from an external address.
- Review newly created admin accounts with their logon times: List local admins added in the last week and flag the account used out of hours.
- Find hidden persistence in new services and WMI subscriptions: Review service and subscription records together, eliminate legitimate software installs and prove what remains.
- Find downloads made with certutil and classify them: Filter certutil calls by command line and separate admin work from the suspicious download.
- Find the unsanctioned remote admin tool: Compare remote access tools with the approved list and list the hosts where an unlisted tool is installed.
- Gather traces of credential access from three sources: Combine LSASS access, registry hive exports and searches for password files on one timeline.
- Separate data staging done with a legitimate archive tool: Review archive commands by target folder and size and find the call that shows staging for exfiltration.
- Find processes across the fleet whose name, path and signature disagree: Write a query comparing original file name, signer and path in process records, list renamed system tools and weed out the legitimate ones.
- Find archive files created out of hours: List archive-extension files created at night with host and user from file creation records.
About this course
You search process, persistence and session data from Windows and Linux endpoints for attacker traces and tell legitimate admin work apart from abuse.
What you will learn
- Processes
- Persistence
- Legitimate tools
- Capstone
Prerequisites
You should be comfortable with the level 101 and 201 topics of the same path.
Lab environment
Lessons run on your own Kali Linux desktop in the browser, with the tools ready in their windowed interfaces. Nothing to install; a computer screen is recommended.
Frequently asked questions
- Is this course right for my level?
- The course is at level 301; it assumes you know the topics of the lower-level courses.
- Is there anything to install?
- No. Every lesson runs in your own lab environment that opens in the browser.
- How do lessons work?
- Each lesson has 8 to 10 steps and a short quiz. Early steps show the command to type, later steps give less help; if two attempts fail, the solution opens.
- Can I try it for free?
- Yes. The first three lessons of every course are free.