Hey everybody welcome to the first video of the module so we're gonna be talking about why you would
want to cover your tracks.
So the reason you would want to cover your tracks is maybe you want to hide your commands that you've
ran Loggins that you've done such as logging in as a weird user that's not only on the system elevation
of privileges such as when you use sudo or changes to files.
So this is just a small list but you but there's a large variety of things that you might want to hide
from a blue team or a Certs depending on the organization.
Now there are some clearing options that I want you to be aware of.
There's more than this but I'm just giving you two of the highest general options here.
So you have partial which is clearing specific log entries to hide specific actions such as removing
a single line or full log clearing you just whole file gone or files.
So when do you want to use partial log clearing.
This is when stealth is paramount.
So you want to avoid alerting monitoring systems like Splunk that pull the logs again and perform alerts
consistently at every system has some sort of timeframe between the time that you actually execute a
command to the time that it is alerted.
Now there's some systems on for for example like Carbon Black that actually will alert based on the
actions as they are passed through into CIS calls and in those type of systems you're not really looking
at logging you're looking at host based monitoring.
So we're not going to go over that in this particular course but just keep that in mind.
But when we're looking at logging systems specifically like Splunk there's a time zone or a time difference
between when the command is executed and in the next runtime of spotting what could be a second could
be a millisecond could be two minutes could be five minutes depending on how it's been configured.
So it's always going to take a look at that Splunk config file if you have it or the slug config file
now a tip for this as you could write a wrapper on your commands that you pass over that depending on
your command such as like common ones like class or sudo you could have it automatically go ahead and
wipe that entry from the respective log file on that system.
It's a nice little tool that you can just throw around to different machines that you never have to
worry about going in adding the log passcode as soon as it's written there's a remove written remove
written remove immediately takes a little time to build it because there's a lot of different variations
but in a general sense it's it's pretty good.
Pretty good tool that you might want to develop on your own.
Now when do we want to use a full clear.
Now we do this when stealth is of no importance at all because it's very obvious that a log has been
cleared completely.
And because of that it's not as commonly used as partial log clearing on a lot of red team engagements
you won't even law.
You won't even clear the logs because you're not trying to bypass alerting and logs but maybe your focus
is on actually attacking the machine and trying to find out what what can I do with this rather than
what they're learning.
But yes each engagement you should be mindful of what was alerted and what wasn't.
During your engagement in things that weren't alerted that you did that might be useful to alert on.
You can always bring that up and have detections built around that but one use case for full log clearing
is again when stealth does not really that important.
But you are using a pivot machine to hide your traffic so to hide your source your source IP if if a
machine you're pivoting to has its logs cleared or just or turned off you can do a lot of different
things on that machine without any traces being left.
Now that's just logging.
There's like for example done windows there's registry keys that get set there's different files that
hold different temp files based on.
So it's not a full clear of every possible footprint but it's a good place to start especially on systems
that are harder to reach from a legal perspective.
So for example if you're using a proxy and across a different country than clearing the logs would be
a much better way to do this.
But we're looking at this from a enterprise level so if you're pivoting to a machine and maybe you want
to hide the fact that you came through that machine once you get once you start attacking on the other
hot on the other side you can go ahead and clear the phone logs.