WEBVTT 00:00:01.840 --> 00:00:05.260 Okay, so how does Merlin work within a traditional network? 00:00:08.240 --> 00:00:11.480 The Merlin framework consists of the Merlin server and the 00:00:11.480 --> 00:00:13.850 Merlin agent that runs on the victim's machine. 00:00:14.240 --> 00:00:18.790 The server is hosted outside the victim's network. On this slide, this is 00:00:18.790 --> 00:00:23.940 depicted in red. To minimize potential alarms, the server's hosting provider 00:00:23.940 --> 00:00:26.650 should be in the same geographic region as the victim. 00:00:26.840 --> 00:00:29.160 This can usually be done through cloud providers. 00:00:30.540 --> 00:00:33.320 The Merlin server is used by you, the red team, 00:00:33.470 --> 00:00:37.370 to control the agent and ultimately, the victim's machine. 00:00:41.140 --> 00:00:43.060 After exploitation of the victim, 00:00:43.070 --> 00:00:47.560 the agent is installed. Soon after, the agent tries to connect to the server. 00:00:48.440 --> 00:00:49.370 In this course, 00:00:49.380 --> 00:00:53.650 you will be leveraging an encrypted HTTP version 3 connection to mimic 00:00:53.650 --> 00:00:56.360 traffic that could be coming from the web browser. 00:00:59.240 --> 00:01:00.980 After a foothold is established, 00:01:01.130 --> 00:01:04.470 the red team can use Merlin's command execution ability to 00:01:04.470 --> 00:01:06.770 start pivoting to other hosts on the network. 00:01:09.840 --> 00:01:12.500 In this course, we will use a Docker Compose environment, 00:01:12.510 --> 00:01:16.260 also known as the simulation environment, to mount Merlin attacks. 00:01:16.510 --> 00:01:20.040 Even better, we'll emulate the blue team by mounting our Merlin 00:01:20.040 --> 00:01:25.380 attacks on two intrusion detection systems. In the next few slides, 00:01:25.390 --> 00:01:29.580 we'll explore how the simulation environment maps to the diagram 00:01:29.590 --> 00:01:30.560 that's right in front of you. 00:01:33.540 --> 00:01:37.790 The victim will be emulated by the victim Docker container. Makes sense, 00:01:37.790 --> 00:01:41.260 right? This container will contain three agents. 00:01:41.940 --> 00:01:46.490 First off is the Wazuh agent. Wazuh is a relatively popular 00:01:46.500 --> 00:01:48.960 host‑based intrusion detection system. 00:01:49.440 --> 00:01:52.950 This agent will monitor the underlying hosts for anomalous behavior. 00:01:53.740 --> 00:01:57.870 This includes monitoring file system operations, and as 00:01:57.870 --> 00:02:00.160 we'll soon see, many other properties. 00:02:00.640 --> 00:02:03.770 Alright, a little bit of a shameless plug here. If you'd 00:02:03.770 --> 00:02:06.940 like to learn more about Wazuh, I recommend a course that I 00:02:06.940 --> 00:02:08.550 recently created on Pluralsight. 00:02:08.870 --> 00:02:12.660 This course titled OS Analysis with Wazuh can give you 00:02:12.660 --> 00:02:14.560 more details about this powerful tool. 00:02:15.140 --> 00:02:18.810 And also, for a link to this course, check out course notes number 3. 00:02:19.440 --> 00:02:21.200 The second agent is the Suricata agent. 00:02:21.210 --> 00:02:26.240 Suricata is a very popular network‑based intrusion detection system, 00:02:26.240 --> 00:02:31.920 otherwise known as NIDS. Suricata taps network interfaces and monitors 00:02:31.920 --> 00:02:36.020 them for suspicious activity. In this course, we'll use Suricata 00:02:36.020 --> 00:02:39.960 version 5.0.3 with a default ruleset. 00:02:42.740 --> 00:02:46.020 The third agent is the Merlin agent. As we'll learn a lot 00:02:46.030 --> 00:02:49.760 about the Merlin agent in this course, I'll keep the intro here pretty brief. 00:02:50.640 --> 00:02:53.520 Okay, so we see a few services by the blue team. 00:02:53.530 --> 00:02:59.920 But where do these services send their telemetry to? In our simulation 00:02:59.920 --> 00:03:02.750 environment, we can imagine the blue team is operating out of the 00:03:02.750 --> 00:03:04.950 company's data center or cloud environment. 00:03:06.740 --> 00:03:08.360 First up is the Wazuh server. 00:03:08.940 --> 00:03:12.580 This server will receive telemetry from the Wazuh and Suricata 00:03:12.590 --> 00:03:17.100 agents. In this course, we'll be leveraging Wazuh 4.0, so this 00:03:17.100 --> 00:03:21.370 includes the server and the agent. And also, we'll be leveraging the 00:03:21.370 --> 00:03:27.500 default Wazuh ruleset. For visualizing and persisting the alerts, 00:03:27.640 --> 00:03:29.270 Wazuh includes an ELK stack. 00:03:29.740 --> 00:03:34.320 For the purposes of this tutorial, we'll be primarily interacting with Kibana to 00:03:34.320 --> 00:03:40.030 investigate any IDS alerts that Merlin creates. To note, Wazuh and Suricata 00:03:40.040 --> 00:03:44.180 aren't required to use Merlin. We're only using these services to simulate the 00:03:44.180 --> 00:03:46.950 blue team and enhance our red team tactics. 00:03:49.440 --> 00:03:50.560 As you might expect, 00:03:50.570 --> 00:03:52.650 the simulation environment wouldn't be complete 00:03:52.650 --> 00:03:54.270 without the Merlin server container. 00:03:54.640 --> 00:03:55.470 Alright, 00:03:55.480 --> 00:03:59.730 whooo! That was a lot of diagrams, and I'm starting to get a 00:03:59.730 --> 00:04:01.790 little bit of some PowerPoint fatigue here. 00:04:01.800 --> 00:04:05.320 Okay, so from here on out, we'll be in a simulation 00:04:05.320 --> 00:04:07.680 environment getting some hands‑on experience. 00:04:07.690 --> 00:04:10.500 Next up is installing the simulation environment. 00:04:10.510 --> 00:04:11.470 Come on and join me.