5 ms·
I thought the same. Wouldn't it be trivial to just replace 'whoami' or 'sudo' with a script that silently fires some kind of alarm and still gives the expected
by Cockbrand 3y ago
I thought the same. Wouldn't it be trivial to just replace 'whoami' or 'sudo' with a script that silently fires some kind of alarm and still gives the expected output? Or am I missing something here?
- frzen 3y agoI use security onion for this, sysmon generates events and they are shipped to security onion using winlogbeats. Stuff like whoami execution shows up on my alerts. I wouldn't mind making some canary tokens for files inside shares with sensitive information as a warning for me to be prepared to be fired.
- mdhb 3y agoGot to be honest as someone trying not to get caught it’s probably something I would look to check before I ran that command. In that kind of environment making assumptions like that could often mean the difference between jail or not in some cases. If it were me… I’d certainly see what I could find out about the binary before I ran it. However I do think trying to make the sha256sum and or strings binary to both work and log (ideally silently and externally) would be a neat idea.