Detecting process-level and file-level attacks can be challenging. Additionally, many tools are “alert factories” that don’t have the ability to remediate in-progress attacks. Luckily, Wazuh solves these problems! In this course, OS Analysis with Wazuh, you’ll cover how to utilize Wazuh to respond to data exfiltration in an enterprise environment. First, you’ll create a rule to detect malicious filesystem operations. Next, you’ll uncover a rootkit through Wazuh by using a Python script. Finally, you’ll leverage Wazuh’s Active Response functionality to automatically quarantine the host (and prevent it from exfiltrating data). In this course, you will simulate all attacks through Merlin (a popular C2 service) so we can emulate real-world scenarios! (No prior Merlin experience is needed). When you’re finished with this course, you’ll have the skills and knowledge to detect these techniques: Scheduled Task/Job (T1053), Hijack Execution Flow (T1574), and Exfiltration Over C2 Channel (T1041).
Author Name: Zach Roof
Author Description:
Zach describes himself as “an ordinary guy who’s extraordinarily curious about technology.” This curiosity has led to roles in Software Development, Application Security, DevOps, and Security Engineering. Currently, Zach is the Lead Security Engineer at Credible where he helps lead the security vision of a highly sensitive Fintech product. Outside of his day job, Zach has spoken at SyntaxCon, created cybersecurity tutorials through Securing The Stack, led an AWS Meetup group, and has provided cy… more

Table of Contents

• Course Overview
  1min
• Detecting Process-level and File-level Attacks with Wazuh
  33mins
• Resources
  2mins