This lab draws its inspiration from Eric Capuano’s original blog post which is not now unavailable, but you can still follow the concepts by watching Gerald Auger’s detailed video walkthrough on his YouTube channel. The link to the video will be referenced below. This lab simulates a blue team exercise focused on detecting Command & Control (C2) activity and monitoring suspicious process behavior (e.g., LSASS memory dumping). The objectives include:
- Deploying a C2 framework (Sliver) to emulate adversary tactics.
- Configuring LimaCharlie for real-time detection of credential extraction attempts.
- Analyzing alerts and refining detection rules.
Virtual Machines
- Attacker VM (Ubuntu):
10.0.2.3- Tools: Sliver C2 server.
- Target VM (Windows):
10.0.2.5- Tools: LimaCharlie agent, simulated user activity.
Network Configuration
- Both VMs are on the same subnet (
10.0.2.0/24) with bidirectional communication.
-
Start the Sliver Server
-
Generate and Deploy Implant
-
Start HTTP Listener
- Deploy LimaCharlie Agent
- Install the agent on the Windows VM and link it to your LimaCharlie dashboard.
- Create Detection Rule
-
Rule logic: Trigger an alert if
lsass.exeis accessed or dumped.
-
-
Run the Implant
-
Execute the Sliver payload on the Windows VM from the C2 server.
-
-
Dump LSASS Memory
- LimaCharlie generates an alert:
- Review Alerts
-
Investigate the LimaCharlie dashboard for process details (command line, memory usage, hash).
-
We saw how an attacker might use a tool like Sliver to gain control of a machine and why it’s so important to monitor critical system processes. By setting up detection rules in SIEM tools like LimaCharlie, we learned how to catch suspicious activities early. The exercise emphasizes that cybersecurity isn’t just about preventing attacks, it’s also about being ready to detect and respond to them quickly.
Gerald Auger Walkthrough Video: https://youtu.be/oOzihldLz7U