5 ms·
Covering your tracks is red team 101 right? How is this notable?
by pdntspa 3y ago
Covering your tracks is red team 101 right?
How is this notable?
- chankstein38 3y agoMy thoughts exactly. I'm confused how this is news
- lancesells 3y agoI didn't know about this so it's news to me.
- _8j50 3y agoIt shouldn't be, what the GP commentsr said isn't correct. You should be stealthy not break your stealth and create a mess cleaning up after yourself.
- lancesells 3y agoWhy not? This isn't my area of expertise or knowledge. Articles like this inform me. Sure, it's maybe logical when you have time to think about this but this would be news to more people than not.
- _8j50 3y agoBecause defenders also look for attempts to clear your tracks and catch you. Normal things don't clear their tracks. And by defenders that includes antivirus/malware software.
- jstarfish 3y ago> Covering your tracks is red team 101 right? Yes, but surprisingly few adversaries actually do this so if it's being observed in the wild, it's a notable development.
- sonicanatidae 3y agoYes and no. Logging is getting better and can be shipped off-site. Additionally, they would usually have to crack multiple passwords, to gain the access needed to all the devices that log. The firewall, for example, should NOT be Radius and should local auth, so if someone gains AD creds, they don't have access to the firewall, too. In IT there are 1000s of ways to skin a specific cat, and everyone has their own, so I'm not touting mine as "The way". I'm simply stating that "cleaning up logging" isn't as simple as it sounds, when it really comes down to it.
- _8j50 3y agoNot really. If you have good opsec you don't need to. A well defended system will detect attempts to tamper logs or disable defenses. It is so difficult to do this without being detected to the point where attackers are exploiting driver vulns firsr and then disabling security tools from the kernel.