4 ms·
> Covering your tracks is red team 101 right? Yes, but surprisingly few adversaries actually do this so if it's being observed in the wild, it's a notable deve
by jstarfish 3y ago
> Covering your tracks is red team 101 right?
Yes, but surprisingly few adversaries actually do this so if it's being observed in the wild, it's a notable development.
- sonicanatidae 3y agoYes and no. Logging is getting better and can be shipped off-site. Additionally, they would usually have to crack multiple passwords, to gain the access needed to all the devices that log. The firewall, for example, should NOT be Radius and should local auth, so if someone gains AD creds, they don't have access to the firewall, too. In IT there are 1000s of ways to skin a specific cat, and everyone has their own, so I'm not touting mine as "The way". I'm simply stating that "cleaning up logging" isn't as simple as it sounds, when it really comes down to it.