Ravindra BagaleCourses & study guides

42. Evading IDS, Firewalls and Honeypots – Detection Games

42.7 Covering Tracks vs Log Integrity – Blue Wins

By Last updated:

CEH phase "covering tracks" = delete logs, change timestamps, stop syslog. Blue answer is not "hope they forget". Blue answer:

  1. Logs leave the box (rsyslog/SIEM/Wazuh) the moment they are born
  2. NTP / chrony so timestamps match across Kali demo + Suricata + firewalld
  3. Append-only / WORM or at least remote write-only
  4. File integrity (AIDE/auditd) on /var/log and suricata.yaml
  5. Restricted root; sudo I/O logs

Red can wipe a local fast.log. Red cannot un-send the copy already on the SIEM in Nagpur.

# Amazon Linux lab – time + audit + syslog (illustrative)
sudo yum install chrony audit rsyslog
sudo service chronyd start
sudo systemctl enable chronyd
sudo service auditd start
sudo service rsyslog start
date
# Integrity idea: after hardening, initialise AIDE (package name may vary)
# sudo yum install aide && sudo aide --init
Red team (attacker) does Blue team (defender) detects / stops
rm / truncate local IDS log Remote syslog; alert on log volume drop to zero
Sets clock back to confuse IR chrony + alert on time step; compare SIEM ingest time
Stops suricata service systemd/service monitor; missing-heartbeat in SIEM

Ravindra Bagale's Tip

Students say "local logs are enough". The first command a Red actor learns = clear the logs. Interview: "My IDS alert is not real until it is off-box." Got it?

Lab

On .40, sudo service suricata stop (lab only) then start again. Write an alert pseudo-rule: suricata heartbeat missing 2 minutes → ticket. Prove chronyd is running (sudo service chronyd status). Don't practise log wiping – practise detecting absence.