Please enable JavaScript.
Coggle requires JavaScript to display documents.
🛡️ LAB 1 MITRE ATT&CK Enterprise Linux Defense & Attack…
🛡️ LAB 1 MITRE ATT&CK Enterprise Linux Defense & Attack Simulation Lab
🛡️ MITRE ATT&CK Enterprise Linux Security Lab
1️⃣ Lab Architecture
1.1 🎯 Lab Objective
Learn:
Attack lifecycle
Threat actor behavior
MITRE ATT&CK techniques
Detection engineering
Incident response
Linux hardening
Goal:
Attacker simulation
Log generation
Detection creation
Defense improvement
1.2 🖥️ Lab Environment
Attacker Machine
Kali Linux
Tools:
Metasploit
Nmap
Hydra
Gobuster
BloodHound
Impacket
CrackMapExec
Target Machine
Ubuntu Server 24.04
Services:
SSH
Apache Web Server
MySQL
Docker
FTP
Samba
Monitoring Machine
SIEM Server
Tools:
Elastic Stack
Elasticsearch
Kibana
Logstash
Wazuh
Splunk
2️⃣ MITRE ATT&CK Introduction
2.1 What is MITRE?
MITRE
A nonprofit organization
Creates cybersecurity frameworks
Provides:
Threat intelligence
Security research
Attack knowledge base
2.2 What is ATT&CK?
ATT&CK
Adversarial Tactics
Techniques
Common Knowledge
It describes:
How attackers operate
What commands they use
What evidence they leave
2.3 Enterprise ATT&CK
Covers:
Windows
Linux
macOS
Cloud
Network devices
3️⃣ MITRE ATT&CK Tactics
3.1 🎯 Initial Access
Purpose:
How attacker enters environment
Techniques:
Phishing
Exploit Public Application
Valid Accounts
3.2 🔍 Reconnaissance
Purpose:
Gather information
Commands:
whois
nslookup
nmap
Defense:
Monitor scanning
Firewall rules
3.3 🏗️ Resource Development
Attacker prepares:
Malware
Infrastructure
Accounts
3.4 🚪 Initial Access Lab
Technique:
T1190 Exploit Public-Facing Application
Example:
Vulnerable Web Application
Attack:
Scan server
nmap -sV target-ip
Defense:
Update packages
sudo apt update
sudo apt upgrade
Monitor:
/var/log/apache2/access.log
4️⃣ Execution Tactic
Purpose:
Run malicious code
4.1 Command and Scripting Interpreter
MITRE ID:
T1059
Linux Shell
Attack:
bash command execution
bash -c "id"
Evidence:
Process logs
auditd
Defense:
Install auditd
sudo apt install auditd
Check:
/var/log/audit/audit.log
4.2 Python Execution
Attack:
python3 -c "import os;os.system('id')"
Detection:
Monitor:
python3 process
unusual parent process
5️⃣ Persistence Tactic
Purpose:
Maintain access after reboot
5.1 SSH Authorized Keys
MITRE:
T1098 Account Manipulation
Location:
~/.ssh/authorized_keys
Attack:
Add attacker SSH key
Detection:
Monitor:
/home/*/.ssh/authorized_keys
Defense:
Disable password login
File:
/etc/ssh/sshd_config
Setting:
PasswordAuthentication no
5.2 Cron Persistence
MITRE:
T1053 Scheduled Task
Location:
/etc/crontab
/var/spool/cron/
Attack:
Create scheduled command
Detection:
Check:
crontab -l
Defense:
Monitor cron changes
6️⃣ Privilege Escalation
Purpose:
Normal user becomes root
6.1 Sudo Abuse
MITRE:
T1548 Abuse Elevation Control
Check:
sudo -l
Dangerous example:
user ALL=(ALL) ALL
Defense:
Use least privilege
Edit:
sudo visudo
6.2 SUID Abuse
Find SUID files:
find / -perm -4000 2>/dev/null
Defense:
Remove unnecessary SUID:
chmod -s file
7️⃣ Defense Evasion
Purpose:
Hide attacker activity
7.1 Clear Logs
MITRE:
T1070 Indicator Removal
Attack:
rm /var/log/auth.log
Detection:
Audit log deletion
Defense:
Forward logs to SIEM
7.2 File Modification
Monitor:
/etc/passwd
/etc/shadow
/etc/sudoers
Tools:
AIDE
OSSEC
8️⃣ Credential Access
Purpose:
Steal passwords
8.1 Password Files
Important files:
/etc/passwd
/etc/shadow
Defense:
Permissions:
ls -l /etc/shadow
chmod 640 /etc/shadow
8.2 SSH Credential Attack
Attack:
Hydra
hydra -l user -P passwords.txt ssh://target
Defense:
Fail2ban
MFA
SSH keys
9️⃣ Discovery
Purpose:
Learn environment
Commands:
User discovery:
who
w
id
Network discovery:
ip addr
ss -tulpn
Process discovery:
ps aux
System discovery:
uname -a
🔟 Lateral Movement
Purpose:
Move between systems
Techniques:
SSH
SMB
Remote services
Detection:
Monitor:
/var/log/auth.log
Look for:
Failed SSH login
New locations
1️⃣1️⃣ Collection
Purpose:
Gather valuable data
Examples:
Database dumps
Configuration files
Logs
Monitor:
Sensitive file access
1️⃣2️⃣ Command and Control
Purpose:
Attacker communicates with malware
Detection:
Network monitoring
IDS
Zeek
Suricata
1️⃣3️⃣ Exfiltration
Purpose:
Data theft
Detection:
Monitor:
Large outbound traffic
Unknown destinations
1️⃣4️⃣ Impact
Purpose:
Damage systems
Examples:
File encryption
Service shutdown
Defense:
Backup
Recovery plan
━━━━━━━━━━━━━━━━━━━━━━
🛠️ Linux Defense Stack
1️⃣ Logging
Files:
/var/log/auth.log
/var/log/syslog
/var/log/kern.log
Tools:
rsyslog
journald
2️⃣ Audit Monitoring
Install:
sudo apt install auditd
Configuration:
/etc/audit/audit.rules
Logs:
/var/log/audit/audit.log
3️⃣ File Integrity Monitoring
Tools:
AIDE
Install:
sudo apt install aide
Database:
/var/lib/aide
4️⃣ Endpoint Detection
Tools:
Wazuh
Elastic Agent
OSSEC
5️⃣ SIEM Integration
Pipeline:
Linux Logs
↓
Filebeat
↓
Logstash
↓
Elasticsearch
↓
Kibana Dashboard
━━━━━━━━━━━━━━━━━━━━━━
🎯 SOC Analyst Workflow
Step 1
Collect logs
Step 2
Detect MITRE technique
Step 3
Investigate
Step 4
Contain attacker
Step 5
Remove persistence
Step 6
Harden system
Step 7
Create detection rule
━━━━━━━━━━━━━━━━━━━━━━
🏆 Enterprise Skills Developed
Linux Administration
Threat Hunting
SIEM Engineering
Detection Engineering
Incident Response
Vulnerability Management
MITRE ATT&CK Mapping
SOC Analyst Skills
Blue Team Operations