Skip to content

Learn DevSecOps

Advanced Linux security

A defensive course for engineers who already harden Linux servers. It explains how attackers work on a Linux host, only as deeply as detection needs: the intrusion chain, privilege escalation paths, and containers seen from the host. Then it builds the visibility to catch them with the audit pipeline, osquery, eBPF and Falco, writes detections that survive contact, hunts, and finishes with live triage, forensic artefacts and incident response. Commands were run on Ubuntu Server 26.04 LTS with RHEL 10 differences noted. Fifteen lessons across five sections, each with a self-test, and a final exam.

Advanced5 sections · 15 lessons · ~6h total · 53-question self-test

01

The attacker on the host

2 lessonsTest yourself

01The host threat modelAttack surface of a default server, and assume-breach.14 min 02The intrusion chain on LinuxInitial access to lateral movement, and its traces.16 min

02

Privilege escalation

4 lessonsTest yourself

01Local privilege escalation: SUID, sudo and capabilitiesHow the paths work and what they leave behind.16 min 02Kernel exploits and credential discoveryUnpatched kernels, weak jobs and leaked secrets.14 min 03Finding escalation paths before an attacker doesBaseline and diff the risky surfaces.14 min 04Containers and namespaces from the hostMap container processes and spot escapes.16 min

03

Detection engineering

4 lessonsTest yourself

01The audit pipelineFrom kernel events to a SIEM, with auid.16 min 02osquery for fleet visibilityQuery the host as tables, schedule differentials.14 min 03eBPF for security visibilityProbes, the verifier and bpftrace on real events.16 min 04Falco on a hostRules, drivers and tuning alerts.14 min

04

Hunting and detections

2 lessonsTest yourself

01Detections that survive contactBehaviour over indicators, and testing rules.14 min 02Threat hunting on LinuxHypotheses, queries and closing the loop.14 min

05

Forensics and incident response

3 lessonsTest yourself

01Live triage: contain without destroying evidenceOrder of volatility and network quarantine.16 min 02Linux forensic artefactsTimestamps, logins, logs and shell history.18 min 03The incident response loopContain, eradicate, recover and learn.14 min

Progress is saved in this browser only — no account required.

Quick reference

Linux command cheat sheetCheat sheet Linux interview questionsInterview guide

Final exam

Test yourself on everything

53 questions drawn from all 5 sections — every answer explained as you pick.

Start final exam