Home / Paths

Learning Paths

Three learning paths that build Linux server skills in order: the command line fundamentals, an investigation workflow, and the full threat hunting lifecycle.

Linux Fundamentals

The entry-level command line: moving around, files and folders, permissions, users, text searching, processes, ports and reading logs. One idea per lab.

Linux Defender

Working a host that someone else has been inside: baseline it, hunt weak permissions and odd processes, read the login log, find the account that should not exist, and write the finding up.

Threat Hunter

The full incident response lifecycle: reconnaissance, detection, deep analysis, containment, eradication and reporting.

Every lab

• Creating EvidenceSet up an evidence workspace and record your first discovery for the incident report.
• The FilesystemYou have landed on a compromised server.
• File HuntThe attacker planted files across the system.
• Opening the CaseYou have been paged for case 2291 on a web server.
• Triage the DropA scanner flagged this web root.
• Log AnalysisSOC flagged suspicious SSH activity.
• Look InsideMove into a folder and read a file to find what the attacker left behind.
• Outbound ConnectionsYou captured a connection snapshot from the host before you touched it.
• Write the EvidenceFindings you cannot quote are findings you cannot act on.
• Permission AuditThe attacker may have loosened file permissions.
• Weak PermissionsPermissions are the quiet way an attacker keeps their access.
• Processes in Odd PlacesYou saved a process snapshot from the host.
• Reading FilesYou found a suspicious configuration file.
• Scattered EvidenceThe attacker scattered scripts and config files.
• Baseline the HostA finding means nothing without context.
• Correlate the Login LogAuth log exported from the host.
• Suspicious AccountsAudit the account list for anything that should not be there.
• What's Here?You're in.
• Crack the Auth LogThe auth.log is massive from a sustained attack.
• Crack the Brute Force3:12 AM, repeated SSH failures.
• Contain the Breach192.168.1.50 has root and is still inside.
• Cross-Reference SourcesThree log files, same time window.
• Eradicate PersistenceThe attacker is locked out but backdoors remain.
• Escalate and NotifyYou have 10 minutes to brief the CISO.
• Find File AnomaliesRoot-level attackers hide things in the filesystem.
• Uncover Hidden FilesThe attacker had root for hours.
• The First Five MinutesSOC alert at 04:00 AM.
• Forensic Disk CaptureThe attacker is out.
• Crack the Full InvestigationFour log files, multiple attackers.
• Verify Against Threat IntelYou found malware in /tmp.
• Threat Hunter: Incident ReportThe investigation is over.
• Build the IOC ListThe investigation is done.
• Protect the LogsRoot breach caught.
• Connect the DotsThree log sources, two attackers.
• Correlate the LogsOne log tells part of the story.
• Triage the LogsSOC alert at 3 AM.
• Hunt the MalwareThe attacker had root for 5 hours.
• Isolate the HostReverse shell detected.
• Map the Network FootprintA reverse shell on port 4444 calls back to 192.168.1.50.
• Separate Signal from NoiseThe auth.log is massive with legitimate traffic mixed with attacks.
• Expose the BackdoorsRoot was obtained 5 hours ago.
• Deep Port ScanPort scan results are in /evidence.
• Preserve EvidenceThe attacker is still logged in.
• Catch the Rogue ProcessesThe attacker is still inside.
• Hunt Rogue ProcessesRoot for 5 hours.
• Discover Open ServicesShell access to a compromised server.
• Read the System LogSyslog shows what the kernel saw.
• Fingerprint the TargetSOC alert fired.
• Rebuild the TimelineSomething happened between midnight and 4 AM.
• Threat Hunter: Timeline ReconstructionUse file timestamps to reconstruct the attacker's actions in chronological order.
• Map the User SessionsYou just SSH'd into a possibly compromised server.
• Enumerate the UsersThe attacker had root.
• Trace the Web AttackThe attacker attacked the web app too.
• Write the ReportThe breach is contained.
• Creating FilesMake the folders you actually want, then write down what you did so you remember it tomorrow.
• The FilesystemExplore the filesystem and learn what each top level folder is for.
• Finding FilesYou have lost a download somewhere under /home/student.
• First ContactOpen a shell on the practice machine and run your first commands.
• Listing FilesA practice folder full of files, including one you have to look closely to see.
• Reading LogsEvery machine keeps a diary.
• Moving AroundMove between folders and read a file to find the configuration.
• Ports and ConnectionsRun a web server for a day and you meet four ports before lunch.
• Who Can Open WhatLinux decides who can open a file using nine characters.
• PermissionsUnderstand how rwx works before you change anything.
• Running ProcessesEverything on Linux is a process, including the ones you never see.
• Reading FilesA configuration file is sitting in your home folder.
• Writing to FilesSend command output into files.
• Searching a Whole TreeA whole tree of files, and you need three things from it.
• System InformationGet to know the machine you are sitting at: kernel, architecture, disk usage and uptime.
• Searching Textgrep is the tool you will reach for most often.
• Users and GroupsRead /etc/passwd and sort real user accounts from system ones.
• Where Am I?You are logged in.