Meterpreter and investigating a compromised system
After a compromise: process, network and file evidence, containment and recovery.
Level 301 · 16 lessons · 15 practice labs
Lessons
Understanding the breach
- Meterpreter: after a compromise, the defender's view: You will understand which questions a defender must answer after a remote-session tool such as Meterpreter has compromised a system, and where to start.
- First response: establishing the situation without spoiling evidence
- Meterpreter session artifacts: processes and connections: You will find and interpret the process and network connection traces that a suspicious Meterpreter session leaves on a machine.
- Spotting disguised Meterpreter process names: You will spot process names that look legitimate but are suspicious, such as those a Meterpreter session might use, by checking their path, parent process and behaviour.
- Which privileges Meterpreter runs with: user and root contexts: You will check whether a Meterpreter session runs with user or root privileges and notice unexpectedly high rights.
- Short task: find the processes and connections of a suspicious session on the lab server
Evidence
- What credentials can leak with Meterpreter and how to protect them: You will learn which credentials on a machine can leak during a Meterpreter session and which measures protect them.
- Meterpreter file and network evidence: You will collect the suspicious file changes and network connections left by a Meterpreter session as evidence and arrange them on a timeline.
- Taking a memory image and a first examination
- Network signatures: recognising session traffic with IDS rules
- Short task: place the file, network and memory evidence on a timeline
Containment and recovery
- Meterpreter containment: isolating and cutting sessions: You will learn the right order, and the points to watch, for isolating a machine with a Meterpreter session and cutting suspicious sessions.
- Eradication and recovery after Meterpreter: You will learn to clean out what an attacker left behind with tools like Meterpreter and bring the system back to a trusted state.
- Meterpreter: lessons learned and hardening: You will write down lessons from an incident involving Meterpreter and turn them into hardening steps that stop the same route being used again.
- Catching it next time: writing a detection rule
- Capstone: a Meterpreter compromise investigation report: In the capstone you will examine the evidence from a lab machine with Meterpreter traces at a fictional company and report the timeline, impact and fixes.
Practice labs
- Find the processes and connections of a suspicious session: List unusual processes and outbound connections on the pre-compromised lab server and write the first triage note.
- Spot a session hiding behind a fake process name: Find the suspicious process from mismatches in name, binary path and parent, and document it.
- Determine the privilege the suspicious session runs with: Extract the session's user, group and capability details and scope the impact in the report.
- Collect volatile data in order without spoiling evidence: Save connections, processes and open files to separate timestamped files and record their hashes.
- Capture a memory image and do a basic review: Capture the lab server's memory and list the traces the suspicious process left in memory.
- Build a timeline from file, network and memory evidence: Merge evidence from Lodoskaya Denizcilik's lab server into one timeline and identify the initial access time.
- Inventory exposed credentials on the breached server: List credentials in config and history files the session could reach and mark which must be rotated.
- Rotate possibly leaked accounts and end their sessions: Renew passwords and keys of affected accounts, end open sessions and confirm the old key is rejected.
- Identify files touched and network destinations in the breach: Report changed files and contacted addresses from file access times and connection logs.
- Enable an IDS rule that recognises the session traffic: Enable the relevant rule set on the lab sensor, replay the recorded traffic and confirm an alert fires.
- Write a host detection rule to catch a repeat: Write a detection rule from the suspicious process's behaviour, test it on the recorded event and check it has no false alarms.
- Tune a noisy detection rule to cut false alarms: Review the rule's false alarms over a week of lab logs, narrow its conditions and show it still catches the real event.
- Isolate the affected server and cut the sessions: Leave the server reachable only from the forensic host via firewall and confirm the suspicious connection dropped.
- Clean up persistence after the breach and verify: Find additions in scheduled jobs, service units and startup files, remove them and recheck after a reboot.
- Write the breach investigation report with lessons learned: Prepare the incident report covering timeline, impact, containment, recovery and hardening recommendations.
About this course
After a compromise: process, network and file evidence, containment and recovery.
What you will learn
- Understanding the breach
- Evidence
- Containment and recovery
Prerequisites
You should be comfortable with the level 101 and 201 topics of the same path.
Lab environment
Lessons run in your own Kali Linux terminal in the browser, connected to a private lab network. Nothing to install.
Frequently asked questions
- Is this course right for my level?
- The course is at level 301; it assumes you know the topics of the lower-level courses.
- Is there anything to install?
- No. Every lesson runs in your own lab environment that opens in the browser.
- How do lessons work?
- Each lesson has 8 to 10 steps and a short quiz. Early steps show the command to type, later steps give less help; if two attempts fail, the solution opens.
- Can I try it for free?
- Yes. The first three lessons of every course are free.