FOR577: LINUX Incident Response and Threat Hunting

Section one introduces the fundamentals of incident response, with a focus on threats in Linux environments. It covers the SANS six-step methodology, introduces a hands-on intrusion scenario for practical learning, and emphasizes the use of Linux tools for forensic analysis, threat hunting, and the development of actionable cyber threat intelligence.

This section focuses on the essential skills and tools needed for collecting and analyzing disk evidence. It teaches how to acquire and examine data from storage devices to uncover attack details, understand adversary behavior, and extract forensic artifacts using tools like The Sleuth Kit and disk imaging techniques across various Linux file systems.

This section looks at how to use the data logged by the operating system to profile the device and analyze boot sequences, kernel activity, logins and user events. We’ll also cover default log data, Auditd, and the Operating System Journal.

This section focuses on scaling incident response for enterprise environments, introducing practical tools like OSSEC and Velociraptor as cost-effective Linux EDR solutions. It also explores Linux memory analysis, emphasizing volatile data collection and live response techniques to efficiently investigate intrusions without full memory dumps.

This section emphasizes rapid triage techniques and timeline analysis to enhance large-scale incident response. It introduces tools for quickly assessing systems, teaches methods for building and analyzing timelines, explores common anti-forensic tactics used by attackers, and concludes with strategies for improving Linux-based IR workflows.

This capstone exercise will enable you to leave the course with hands-on experience investigating realistic attacks, curated by a cadre of instructors with decades of experience fighting advanced threats from attackers ranging from nation-states to financial crime syndicates and hacktivist groups.