Module 4: Network and Endpoint Hunting

Expand beyond the SIEM. Hunt with Suricata network signatures and Velociraptor endpoint forensics.

4 lessons · 4 labs

Suricata + EveBoxVelociraptorWazuh

Path

  1. 01
    Lesson

    Network Beaconing and DNS Hunting

    Detecting C2 beaconing patterns, DNS tunneling, protocol abuse, and anomalous traffic using Suricata/EveBox alert data.

  2. 02
    Lab

    Lab 4.1 — Beaconing Detection

    Use Suricata/EveBox to detect C2 beaconing, DNS stacking for tunneling, and protocol anomalies in fresh PCAP data.

  3. 03
    Lesson

    Endpoint Stacking with VQL

    Using Velociraptor Query Language to stack processes, services, scheduled tasks, and autoruns across endpoints — finding the one anomaly in hundreds of legitimate entries.

  4. 04
    Lab

    Lab 4.2 — Hypothesis-Driven Endpoint Hunt

    Use Velociraptor to test a hypothesis: 'The Linux endpoint has persistence mechanisms.' Collect artifacts, analyze, confirm or refute.

  5. 05
    Lesson

    Fleet-Wide Anomaly Detection

    Baseline profiling across multiple endpoints. What's normal for your fleet? What deviates? Techniques for scale-aware hunting.

  6. 06
    Lab

    Lab 4.3 — Fleet Stacking

    Stack 5 artifact categories across the endpoint fleet using Velociraptor. Identify outliers by frequency, naming conventions, and installation patterns.

  7. 07
    Lesson

    Cross-Tool Correlation

    Pivoting between SIEM, network, and endpoint data. Building unified timelines. The art of connecting evidence from different tools into a single narrative.

  8. 08
    Lab

    Lab 4.4 — Cross-Tool Campaign Trace

    Trace an entire attack campaign across all 12 Wazuh agents using the fresh scenarios. Build a unified timeline from SIEM data alone — then identify what the SIEM missed.