Everybody welcome to next video.
So now that we've gone through and identified when we should and shouldn't modify logs on a Windows
Linux machine.
I want to take a step back and look at some common issues that you might run into or things that you
might see.
Now there are monitoring systems in place on most systems on at enterprise level and that just comes
with the territory.
Now these monitoring systems can do a few different things.
Normally it's an A tiered status.
So what I mean by that is for your logging you might have rotate log rotation or something like a Splunk
forward that pushes logs elsewhere or maybe CIS log is pushing logs elsewhere.
So you've got that one aspect then depending on which one you have such as we'll take Splunk as an example.
So when the log full or in the Splunk forward or pushes the logs out to the endpoint that endpoint then
processes the logs and runs through and alerts on anything that it happens to find.
Now that part's important cause it's normally pretty quick.
It's very very quick on the draw when you start going through that but when it comes to for example
this log normally it's on a specific time but we'll take Splunk as an example here.
Now when Splunk runs something called Splunk forehead or on each system that pulls logs from there's
a config file that tells it which location to pull these logs or which specific logs do we want to use.
And if you're route already you can in turn tell this config file to point anywhere else now.
Or you can just turn off the service.
But keep in mind that there's another layer of this.
So if there's host monitoring such as with a sense you or Nagi knows you're going to run into problems
where if you turn off the service long enough and there's a check on that service.
It'll go ahead and alert the knock about or the network operations that are about the fact that a service
is no longer running which is not forwarding logs.
And then on top of that if you take Splunk into consideration there might be an alert on Splunk.
And on the endpoint where the logs are being pushed to that this host suddenly stop pushing logs so
it's important to keep those things in mind when you're trying to fly under the radar and such as like
covering your tracks or just hiding your persistence in general however what smoke you got a few different
ways you can do this.
So if you're able to modify the config file you can have it point to a different file and then restart
the service and hopefully that restart doesn't happen at the same time the check is going on and even
if it does as long as it checks off and then checks back even not even from a NOx perspective they soldiers
dying come back up it and never had any other issue passed that point they might check it they might
not it depends on who is looking at the service.
But even if they did look at it real quick they might see that it was stopped for some reason as long
as the valid users logged in.
They're probably not even gonna look anything into it but if it stays off that's when someone's going
to actually take a look at it because it needs to be on.
But doing that.
Yeah.
You change your log location to slash temp.
Right.
And the problem is is that now Splunk is no longer getting getting any logs because unless there happens
to be logs of some kind with a dot log extension or whoever the config file set up for the Splunk endpoint
is going to notify the cert or the blue team that there is no longer any logs coming from this machine
and that can be a problem for you.
But there's a few ways you get around you can get a little crafty with you write a bash script that
automatically logs to a random log entries from let's say it reads from a standard log and starts pumping
random lines of that log into whatever dot log in the temp folder and then the Splunk forward or just
keeps grabbing that.
So it looks like it's the same or you can make exact copies of the whole var log folder dump it over
and a temp and have it have your badge file pull an ad in different lines do that to make it looks like
the logs are rolling when indeed they're not.
Then you can do whatever you want and then adjust either change the logs or don't from that point just
wipe them and then overwrite them back.
There's a lot of options you can go with this but always take that extra step of importance in understanding
where your logs are going.
So if you see a config file where sis log or log rotate or Splunk is being used for Sis log and Splunk
where are the endpoints.
Because that might be another attack vector if you're able to compromise a machine that's holding all
of the logs.
You then have control of the logs.
So it's always an important step to just understand where your logs are flowing what systems are in
place.
So an RPE is for Nargis and Splunk you just look up spunk first block and I'll leave it up to you guys
to figure out what the process is for sensitive and kind of what options you have for identifying these
honor system.