Skip to content
Pluralsight Logo
  • Pluralsight
  • Skills
  • Flow
  • Blog
    • Sign in to

      Sign in to Pluralsight Skills
    • Sign in to

      Sign in to Pluralsight Flow
Logo for Pluralsight Skills
Pluralsight Logo
  • Sign in
  • Menu
  • Sign in to Pluralsight Skills

    Sign in to Skills

  • Sign in to Pluralsight Flow

    Sign in to Flow

  • Pluralsight
  • Skills
  • Flow
  • Blog
  • Why Skills?
    • Ways to upskill
    • Icon for Courses Courses
    • Icon for Skills assessments Skill assessments
    • Icon for Labs Labs
    • Icon for Hands-on learning Hands-on learning
    • Icon for Certification prep Certification prep
    • See our entire course library
    • Skills for
    • Icon for Software development Software development
    • Icon for IT ops IT Ops
    • Icon for Info & cyber security Info & cybersecurity
    • Icon for Cloud computing Cloud computing
    • Icon for Machine learning Machine learning
    • Icon for Data professional Data professional
    • For individuals
    • Top trending paths
    • Microsoft Azure Deployment
      Microsoft Azure
    • Cleaning Data with R
      Cleaning data with R
    • Ruby Language Fundamentals
      Ruby Language Fundamentals
    • AWS Operations
      AWS Operations
    • Core Python
      Core Python
  • View plans
  • For individuals
  • Contact Sales
  • Try for free

Contact Sales

1020 Redirect Link
Thank you!
Our team will be in touch shortly.

Loading form...

If this message remains, it may be due to cookies being disabled or to an ad blocker.

Close button
✖
Pluralsight Skills
Pluralsight Skills

50% off

50% off

Annual Standard and Premium plans

Annual Standard and Premium plans

For a limited time

For a limited time

Save now
Save now
Pluralsight Skills
Pluralsight Skills

50% off

50% off

Annual Standard and Premium plans

Annual Standard and Premium plans

For a limited time

For a limited time

Save now
Save now
pluralsight skills logo

50% off

Annual Standard and Premium plans

For a limited time

Save now
✖
Pluralsight Skills
Pluralsight Skills

50% off

50% off

Annual Standard and Premium plans

Annual Standard and Premium plans

For a limited time

For a limited time

Save now
Save now
Pluralsight Skills
Pluralsight Skills

50% off

50% off

Annual Standard and Premium plans

Annual Standard and Premium plans

For a limited time

For a limited time

Save now
Save now
pluralsight skills logo

50% off

Annual Standard and Premium plans

For a limited time

Save now
×
AWS Labs
Labs badge iconLAB

Existing Security Appliances: CookieMiner Analysis

At Globomantics, an employee in the Marketing Department stated they’re receiving “unusual Sign In” alerts from various websites. You (the Security Analyst) must investigate their endpoint through Host-based (and Network-based) Intrusion Detection Systems. In this lab, you’ll investigate Tactics, Techniques, and Procedures (TTPs) that are inspired by the “CookieMiner” malware.

* Our Labs are Available for Enterprise and Professional plans only.
Terms and conditions apply.
Contact sales
Labs - Existing Security Appliances: CookieMiner Analysis

Lab info

Level
Beginner
Duration
2h 5m
Released
Dec 13, 2022

Lab author

Lab Author: Zach Roof
Zach Roof
Zach describes himself as “an ordinary guy who’s extraordinarily curious about technology.” This curiosity has led to roles in Software Development, Application Security, DevOps, and Security Engineering. Currently, Zach is the Lead Security Engineer at Credible where he helps lead the security vision of a highly sensitive Fintech product. Outside of his day job, Zach has spoken at SyntaxCon, created cybersecurity tutorials through Securing The Stack, led an AWS Meetup group, and has provided cy... morebersecurity consulting services. When not hitting the keyboard, Zach is hitting the trails! He is an avid hiker and enjoys the simplicity of nature. In fact, Zach’s favorite quote is “Simplicity is the ultimate sophistication” by Leonardo Da Vinci. Zach’s fondness of simplicity has manifested in his tutorials, where he aims to simplify complex topics in the areas of Software Development, DevOps, and Security.
  • Table of contents
  • What's a lab?
  • Prerequisites
Challenge

Getting Started in the Lab Environment

Here are the initial instructions and explanation of the lab environment. Read this while your environment is busy creating itself from nothing. Yes, this violates physics; we know. How fun!

Challenge

Malware: Initialization

In this challenge, you'll learn the core tenants of Intrusion Detection Systems: event collection, event analysis, and event visualization. You'll also deploy a piece of malware that you'll investigate in subsequent challenges.

Challenge

Malware: FIM Alert

In this challenge, you'll learn the basics of File Integrity Monitoring (FIM). Through this process, you'll leverage a FIM alert to inform a threat hunting session.

Challenge

Malware: Analysis

In this challenge, you'll do a deep dive into what triggered the FIM alert (i.e., malware.sh). Through this deep dive, you'll learn of a real-world attack that attempts to subvert Multi-Factor Authentication. You'll also learn how malware can evade detection mechanisms.

Challenge

HIDS Limitations

In this section, you'll learn the limitations of Host-based Intrusion Detection Systems.

Challenge

Suricata: Introduction

In this challenge, you'll shift your focus from host-based monitoring to network-based monitoring. In particular, you'll interface with Suricata, with a popular network monitoring tool. Earlier in the lab, you learned about Intrusion Detection Systems (IDS) and Intrusion Prevention Systems (IPS). Suricata is a tool that can act as an IDS and an IPS.

Challenge

Suricata: SimpleHTTP Alert

In this challenge, you'll review the Suricata rule that triggered the SimpleHTTP alert. You'll also understand how this alert could correlate to malware hosting activity!

Challenge

Suricata: Rule Creation

In this challenge, you'll learn how to leverage network events to create network-based rules. You'll then leverage this knowledge to create a rule that alerts on curl-based data exfiltration! Once you're done, you'll rerun the CookieMiner malware and see if the rule works!

Challenge

Suricata: Subverting Rules

In this challenge, you will learn how rules can be subverted.

Challenge

The Last Challenge

This is the last challenge of this lab, and your last chance to experience the environment before clicking finish lab, ending this small little world that flittered into existence just for you.

Labs - code icon

Provided environment for hands-on practice

We will provide the credentials and environment necessary for you to practice right within your browser.

Labs - list icon

Guided walkthrough

Follow along with the author’s guided walkthrough and build something new in your provided environment!

Labs - analytic icon

Did you know?

On average, you retain 75% more of your learning if you get time for practice.

Recommended prerequisites

  • Basic Linux knowledge

Start learning by doing today

Contact sales

Contact Sales

1020 Redirect Link
Thank you!
Our team will be in touch shortly.

Loading form...

If this message remains, it may be due to cookies being disabled or to an ad blocker.

Close button

Ready to skill up
your entire team?

10
Subscriptions
Need more subscriptions? Contact sales.
Continue to checkout Continue to checkout
Cancel

With your Pluralsight plan, you can:

With your 30-day pilot, you can:

  • Access thousands of videos to develop critical skills
  • Give up to 10 users access to thousands of video courses
  • Practice and apply skills with interactive courses and projects
  • See skills, usage, and trend data for your teams
  • Prepare for certifications with industry-leading practice exams
  • Measure proficiency across skills and roles
  • Align learning to your goals with paths and channels

Ready to skill up
your entire team?

10
Subscriptions
Need more subscriptions? Contact sales.
Continue to checkout
Cancel

With your Pluralsight plan, you can:

With your 30-day pilot, you can:

  • Access thousands of videos to develop critical skills
  • Give up to 10 users access to thousands of video courses
  • Practice and apply skills with interactive courses and projects
  • See skills, usage, and trend data for your teams
  • Prepare for certifications with industry-leading practice exams
  • Measure proficiency across skills and roles
  • Align learning to your goals with paths and channels
  • Support

    • Contact
    • Help Center
    • IP Allowlist
    • Site Map
    • Download Pluralsight
    • Skills Plans
    • Flow Plans
  • Community

    • Guides
    • Teach
    • Partner with Pluralsight
    • Affiliate Partners
    • Pluralsight One
    • Authors
  • Company

    • About Us
    • Careers
    • Newsroom
    • Resources
  • Industries

    • Public Sector
    • Non-Profit

Newsletter

Sign up with your email to join our mailing list.

1041 Redirect Link Form Submitted Successfully!

Loading form...

If this message remains, it may be due to cookies being disabled or to an ad blocker.

  • Facebook Logo Icon
  • Twitter Logo Icon
  • Instagram Logo Icon
  • LinkedIn Logo Icon
  • Youtube Logo Icon
Pluralsight Logo Copyright © 2004 - 2023 Pluralsight LLC. All rights reserved
  • Terms of Use
  • Privacy Notice
  • Modern Slavery Statement