OS Analysis with Wazuh

It can be difficult to detect file-level and process-level attacks. Many tools are "alert factories", which don't have the ability of resolving in-progress attacks. Wazuh is the solution to these problems. This course, OS Analysis With Wazuh, will show you how to use Wazuh to detect data exfiltration in an enterprise environment. To detect malicious filesystem operations, you will first create a rule. You'll then use a Python script to uncover a rootkit using Wazuh. You'll then use Wazuh Active Response to automatically quarantine and prevent the host from exfiltrating data. This course will allow you to simulate real-world attacks using Merlin, a popular C2 service. No prior Merlin experience required. After completing this course, you will have the skills and knowledge required to identify these techniques: Scheduled Task/Job, Hijack Execution flow (T1574) and Exfiltration over C2 Channel (T1041).