Lesson 7.3: Capstone: from one alert to a full picture
The last lesson puts the course's tools together on one host. The payments gateway api09 raised a single alert: a process running from a deleted file. You confirm it with osquery, find the persistence that keeps bringing it back, watch it re-download itself with eBPF tracing, take and hash a memory image, recover the attacker's commands from memory to learn how they got in and became root, check that the kernel is clean, remove the persistence, prove it stays gone, and write the incident summary.
30 min
You will learn to
- Run a full investigation without step-by-step help
- Combine osquery, eBPF tracing and memory forensics
- Decide the kernel's trust from memory evidence
- Remove persistence and prove it with tracing
- Write a short, factual incident summary
← Capstone: triaging a compromised server · All lessons · White, black and grey hats: what makes hacking ethical →