cr0@Defensive-Security.com / EDRmetry / PurpleLabs

💥 2026 - here we go! I am excited to announce the release of "Linux Attack, Detection, and Live Forensics v2.0 - Hands-on Purple Teaming Playbook"! In this fully hands-on guide, I've leveled up the Linux-oriented purple teaming experience to bridge the gap between red and blue teams like never before:
- 💙 Focus on cutting-edge research and development of Linux offensive techniques -> empowering blue teams to understand and anticipate real-world Linux threats.
- ❤️ Dive into the detection perspective, explore corresponding events, telemetry, evidence, and chained detections -> giving red teams the insights to refine their Linux evasion strategies.
- 💜 Map it all to expected EDR/Runtime functionalities and DFIR processes, fostering true collaboration for purple teaming excellence.

The link is here: edu.defensive-security.com/linux-attack-d…

Things are moving fast, and I'm getting a lot of questions about training content and upcoming events. As always, all my live sessions are built on PurpleLabs and the companion Linux Attack, Detection, and Live Forensics v2.1 - Hands-on Purple Teaming Playbook. If you prefer to learn at your own pace, the full course is available here, and it's massive:
👉 edu.defensive-security.com/linux-attack-d…

20 Linux hackers in my @BruCON Practical Linux Attack Paths and DFIR/Hunting v2.0 classroom => red team, blue team, many skilled DFIR experts. Tons of questions and discussions about the stuff. #BruCON0x12 - thank you for having me! When you get a big round of applause after 3 days of hands-on training, then you know you've done your job! => "It wasn't what I expected; it was something more" => this is dope! Proud inside and happy - let's go! :D And the magic number of this trip is 42 :D🎂#CyberSecurityTraining #CyberSecurity #linux #purplelabs

Solid stuff for Zeek lovers => Matchy - plugin for high-performance threat intelligence: 7M+ queries/sec, shared memory across workers, hot-reloadable, no libmaxminddb dependency. github.com/matchylabs/zee…

New, stealthy (no memfd_create-based) way for Linux Fileless ELF execution via O_TMPFILE + execveat(AT_EMPTY_PATH). Great stuff from @MatheuzSecurity as always! To keep the hamster wheel spinning :> (#Linux #redteam vs #blueteam), I tried to detect/block this behaviour via hooking into execveat() using the Tetragon Runtime Security Engine. The detection trigger/primitive is, in this case, 4096/0x1000/AT_EMPTY_PATH. Another policy added to my SHIELD Tetra collection, which already contains almost 130 validated policies. In the screenshot, in combination with darkcloak, for which I have a separate set of tracing policies. Links to the projects:
- Dntry - Fileless ELF execution via O_TMPFILE + execveat(AT_EMPTY_PATH): github.com/MatheuZSecurit…
- DARKCLOAK - Linux process identity cloaking: github.com/0x574R/Darkclo…