FOR577: LINUX Incident Response and Threat Hunting

Section one introduces the fundamentals of incident response with a focus on Linux environments. It covers the SANS six-step methodology, the Unified Kill Chain and attacker behaviors, and a hands-on intrusion scenario, while building the Linux command-line and forensic skills used throughout the course.

This section covers system analysis and the foundations of threat hunting. You will collect and analyze disk evidence with The Sleuth Kit across the ext4, XFS, and Btrfs file systems, examine Linux package data and executables, and see how cyber threat intelligence supports hypothesis- and intelligence-led hunting.

This section covers Linux log analysis for incident response. It begins with device profiling and logging fundamentals, then covers syslog, the systemd journal, authentication, and Auditd logs. It also covers application logs from web servers, databases, file-sharing services, and firewalls, where evidence of attacks is often found.

This section covers investigation of AI and large language model (LLM) systems across local and hybrid deployments, including AI coding assistants and self-hosted platforms. It addresses LLM-specific issues such as prompt injection, data exfiltration, and supply chain attacks, and closes with Linux anti-forensics and guidance on improving incident response.

This section emphasizes rapid triage techniques and timeline analysis to enhance large-scale incident response. It introduces tools for quickly assessing systems, teaches methods for building and analyzing timelines, explores common anti-forensic tactics used by attackers, and concludes with strategies for improving Linux-based IR workflows.

This capstone exercise will enable you to leave the course with hands-on experience investigating realistic attacks, curated by a cadre of instructors with decades of experience fighting advanced threats from attackers ranging from nation-states to financial crime syndicates and hacktivist groups.