Analyst Tools
These appear on more than one machine, and in several cases the path differs by platform. Where a distribution-specific difference exists, both forms are listed. Python 3.13 paths below are examples, not a guarantee of the installed interpreter version. Check python3 --version and python3 -m site; distribution and virtual-environment paths vary.
| Tool | Path / Command | What It Does |
|---|---|---|
| OpenSSH | /etc/ssh/sshd_config |
Server settings: allowed authentication methods, whether root may log in, listening port. |
/etc/ssh/ssh_config |
Client defaults for outbound connections. | |
/etc/ssh/sshd_config.d/*.conf |
Ubuntu includes these snippets near the start of sshd_config. For most directives, the first obtained value applies. Check Include placement and effective settings. | |
~/.ssh/authorized_keys |
Public keys allowed to log in as this user. A favorite persistence location for attackers. | |
~/.ssh/known_hosts |
Fingerprints of servers you have connected to before. | |
~/.ssh/config |
Per-host client shortcuts: aliases, usernames, keys, and ports. | |
/etc/ssh/ssh_host_*_key |
The server’s own identity keys. Replacing these triggers client warnings. | |
/var/log/auth.log |
Common Ubuntu authentication-log destination when rsyslog is configured. Check the actual logging service and journalctl -u ssh as well. | |
/var/log/secure |
Present when rsyslog is installed and configured to write authentication records. Amazon Linux 2023 defaults to the systemd journal; inspect journalctl -u sshd. | |
C:\ProgramData\ssh\sshd_config |
Windows server config when the OpenSSH optional feature is installed. | |
Wazuh rule 5710 |
Fires on an SSH attempt using a non-existent username. | |
Wazuh rule 5712 |
Fires when repeated failures cross the brute-force threshold. | |
| curl | /usr/bin/curl |
The Linux binary. |
C:\Windows\System32\curl.exe |
Built into Windows 11 — no install required. | |
~/.curlrc |
Default options applied to every run for this user. | |
/etc/ssl/certs/ca-certificates.crt |
Ubuntu’s trusted CA bundle, used to validate HTTPS certificates. | |
/etc/pki/tls/certs/ca-bundle.crt |
The same thing on Amazon Linux 2023. The different path is a common stumbling block. | |
curl -k |
Disables certificate verification. Prefer the trusted lab CA with –cacert and a matching hostname. Restrict -k to explicitly approved diagnostic use. | |
curl http://testmyids.com |
Fetches a harmless string that ET rules deliberately alert on. The standard is-my-sensor-alive test. | |
| Python 3.13 + pip | /usr/bin/python3 |
The interpreter. |
/usr/lib/python3.13/ |
The standard library. | |
/usr/lib/python3/dist-packages/ |
Packages installed by apt and managed by the distribution. | |
~/.local/lib/python3.13/site-packages/ |
Packages installed for your user only. | |
/usr/lib/python3.13/EXTERNALLY-MANAGED |
Example marker location; the versioned directory varies. Outside a virtual environment, this marker tells compatible installers to leave the distribution-managed environment unchanged. | |
python3 -m venv ~/.venvs/ata |
Creates an isolated environment. The correct answer to the error above. | |
source ~/.venvs/ata/bin/activate |
Switches your shell into that environment. | |
pip install --break-system-packages |
Overrides the protection. Works, but can break apt-managed packages — avoid it in this lab. | |
~/.config/pip/pip.conf |
Per-user pip settings such as index URL and trusted hosts. | |
| Osquery | /etc/osquery/osquery.conf |
Which queries run, how often, and which packs are enabled. |
/etc/osquery/osquery.flags |
Startup options for the daemon. | |
/etc/osquery/osquery.example.conf |
A working template shipped with the package. Copy it; don’t edit in place. | |
/var/log/osquery/osqueryd.results.log |
Output of scheduled queries, one JSON line per result. Wazuh can read this file. | |
/var/osquery/osquery.db/ |
Internal database of prior results, so osquery can report only what changed. | |
/usr/bin/osqueryi |
Interactive SQL shell against the live machine. Where you develop and test queries. | |
/usr/bin/osqueryd |
The background service that runs your scheduled queries. | |
C:\Program Files\osquery\ |
Windows install location. | |
ossec.conf → <wodle name="osquery"> |
Tells the Wazuh agent to launch osquery and collect its results. | |
| Wireshark / tshark | C:\Program Files\Wireshark\Wireshark.exe |
The GUI. Best for exploring an unfamiliar capture. |
C:\Program Files\Wireshark\tshark.exe |
The command-line version. Best for scripted extraction and large files. | |
/usr/bin/tshark |
Linux command-line version. | |
/usr/bin/dumpcap |
The small privileged helper that does the actual capturing, so Wireshark itself can run unprivileged. | |
/usr/share/wireshark/ |
Dissectors and lookup data, including the manuf file mapping MAC prefixes to vendors. | |
~/.config/wireshark/ |
Your profiles, display filters, and column layouts. | |
%APPDATA%\Wireshark\ |
The same, on Windows. | |
usermod -aG wireshark <user> |
Grants capture rights without running the GUI as root. | |
setcap cap_net_raw,cap_net_admin+eip /usr/bin/dumpcap |
Gives the capture helper exactly the privileges it needs and nothing more. | |
tshark -r cap.pcap -Y "http.request" |
Reads a saved capture and displays only HTTP requests. | |
| YARA | /usr/local/bin/yara |
The scanner binary when built from source. |
/usr/bin/yara |
The binary when installed from the distribution package. | |
/opt/yara/rules/ |
Where the lab keeps its rule library. | |
/var/ossec/active-response/bin/yara.sh |
The script Wazuh runs on a Linux agent when a watched file changes. | |
...\active-response\bin\yara.bat |
The Windows equivalent of the same script. | |
ossec.conf → <command> / <active-response> |
Wires the script to a triggering rule so scanning happens automatically. | |
local_rules.xml |
Rules that interpret the scanner’s output and raise a proper alert from it. | |
yara -w rules.yar <target> |
Runs a rule file against a file or folder, suppressing warnings. Always test before deploying. |
Authentication records depend on the installed logging stack and routing configuration. /var/log/auth.log and /var/log/secure are common conventions, not guaranteed files or identical data sets. Amazon Linux 2023 defaults to the systemd journal. Verify the active source and its Wazuh collection settings before interpreting missing file-based logs as missing events.