Covering Your Tracks

Question 1

Covering Tracks Methods

Answer 1

Disable auditing
Turn off hibernation file
Clear logs

Question 2

Disabling Auditing

Answer 2

(Ubuntu/Debian) export HISTSIZE=0
(Fedora/RHEL) systemctl auditd disable
(Windows) auditpol /set /category “System”,”Account logon” /success:disable /failure:disable
(Windows) fsutil behavior set disableastaccess 1

Question 3

Clearing Logs

Answer 3

(Windows PowerShell) clear-eventlog “WIndows PowerShell”
(Windows PowerShell) wevtutil -cl Security
cipher.exe
(Linux) echo “ “ > /var/log/auth.log
(Linux) shred file1.txt

Question 4

Defenses

Answer 4

• syslog
• SIEM
• Windows event viewer subscriptions