Shellshock to SIEM

Introduction

This three-part series serves as my comprehensive 'Full-Stack' security masterclass, taking you from the initial construction of a vulnerable environment to the high-stakes world of real-time threat detection and remediation. By bridging the gap between Offensive Exploitation (Red Team) and Defensive Monitoring (Blue Team), I explored not just how systems are broken, but how they are watched and eventually 'healed'.

Key Takeaways

• Layered Security is Mandatory: No single tool (Wazuh) is a silver bullet; defence-in-depth requires both host and network visibility.

• Visibility Gaps are Stealth’s Best Friend: If your logs aren't reaching your SIEM (like the initial Shellshock logs), the attack effectively didn't happen in the eyes of the security team.

• The Power of Customisation: Whether it is an attacker writing a custom script or a defender writing a custom decoder/rules, the most effective security work happens outside the 'default' settings.