Okay, so how does Merlin work within a traditional network?
The Merlin framework consists of the Merlin server and the
Merlin agent that runs on the victim's machine.
The server is hosted outside the victim's network. On this slide, this is
depicted in red. To minimize potential alarms, the server's hosting provider
should be in the same geographic region as the victim.
This can usually be done through cloud providers.
The Merlin server is used by you, the red team,
to control the agent and ultimately, the victim's machine.
After exploitation of the victim,
the agent is installed. Soon after, the agent tries to connect to the server.
In this course,
you will be leveraging an encrypted HTTP version 3 connection to mimic
traffic that could be coming from the web browser.
After a foothold is established,
the red team can use Merlin's command execution ability to
start pivoting to other hosts on the network.
In this course, we will use a Docker Compose environment,
also known as the simulation environment, to mount Merlin attacks.
Even better, we'll emulate the blue team by mounting our Merlin
attacks on two intrusion detection systems. In the next few slides,
we'll explore how the simulation environment maps to the diagram
that's right in front of you.
The victim will be emulated by the victim Docker container. Makes sense,
right? This container will contain three agents.
First off is the Wazuh agent. Wazuh is a relatively popular
host‑based intrusion detection system.
This agent will monitor the underlying hosts for anomalous behavior.
This includes monitoring file system operations, and as
we'll soon see, many other properties.
Alright, a little bit of a shameless plug here. If you'd
like to learn more about Wazuh, I recommend a course that I
recently created on Pluralsight.
This course titled OS Analysis with Wazuh can give you
more details about this powerful tool.
And also, for a link to this course, check out course notes number 3.
The second agent is the Suricata agent.
Suricata is a very popular network‑based intrusion detection system,
otherwise known as NIDS. Suricata taps network interfaces and monitors
them for suspicious activity. In this course, we'll use Suricata
version 5.0.3 with a default ruleset.
The third agent is the Merlin agent. As we'll learn a lot
about the Merlin agent in this course, I'll keep the intro here pretty brief.
Okay, so we see a few services by the blue team.
But where do these services send their telemetry to? In our simulation
environment, we can imagine the blue team is operating out of the
company's data center or cloud environment.
First up is the Wazuh server.
This server will receive telemetry from the Wazuh and Suricata
agents. In this course, we'll be leveraging Wazuh 4.0, so this
includes the server and the agent. And also, we'll be leveraging the
default Wazuh ruleset. For visualizing and persisting the alerts,
Wazuh includes an ELK stack.
For the purposes of this tutorial, we'll be primarily interacting with Kibana to
investigate any IDS alerts that Merlin creates. To note, Wazuh and Suricata
aren't required to use Merlin. We're only using these services to simulate the
blue team and enhance our red team tactics.
As you might expect,
the simulation environment wouldn't be complete
without the Merlin server container.
Alright,
whooo! That was a lot of diagrams, and I'm starting to get a
little bit of some PowerPoint fatigue here.
Okay, so from here on out, we'll be in a simulation
environment getting some hands‑on experience.
Next up is installing the simulation environment.
Come on and join me.