Detecting Exploits - OMIGod (Linux Logging with Auditd)

Name: Detecting Exploits - OMIGod (Linux Logging with Auditd)
Uploaded: 2021-09-18T21:00:14Z
Channel: IppSec
Description: 00:00 - Intro, how to install and configure auditd 01:15 - Installing Auditd 02:30 - Downloading a good baseline ruleset from github 03:40 - Going over...

IppSec · Beginner ·🛡️ AI Safety & Ethics ·4y ago

00:00 - Intro, how to install and configure auditd 01:15 - Installing Auditd 02:30 - Downloading a good baseline ruleset from github 03:40 - Going over the baseline file to understand how logging works 05:00 - What the -p flag does with files. Logging read/write/execute/attribute change events 07:10 - If you want CWD in your logs, uncomment this line 13:20 - Logging priv_esc events 14:40 - Excluding system accounts from log captures 15:40 - Fun detections to find recon and suspicious activity 21:40 - Logging when users fail to access files in special directories 24:16 - Running the omigod exp…

Watch on YouTube ↗ (saves to browser)

Chapters (22)

Intro, how to install and configure auditd

1:15 Installing Auditd

2:30 Downloading a good baseline ruleset from github

3:40 Going over the baseline file to understand how logging works

5:00 What the -p flag does with files. Logging read/write/execute/attribute change

7:10 If you want CWD in your logs, uncomment this line

13:20 Logging priv_esc events

14:40 Excluding system accounts from log captures

15:40 Fun detections to find recon and suspicious activity

21:40 Logging when users fail to access files in special directories

24:16 Running the omigod exploit and getting a reverse shell echo/base64

25:05 Running ausearch to detect what we had done by searching for commands ran by r

28:00 Using some bashfu to show only commands ran by a ppid

28:50 Looking for the suspicious activity

30:40 Analyzing a detection rule for this and understanding the importance of not ex

34:15 Checking if mkfifo is detected... yep

36:20 Installing Laurel to convert Auditd's multiline format to singleline JSON

38:50 Installing Rust then compiling Laurel

43:40 Removing End Of Event from Auditd config to see if that fixes the Laurel bug (

46:56 Viewing our Auditd logs in JSON Format! SIEMS will love this!

48:30 Going over aureport to show some things

50:30 Looking for why we have so many syscall failures

Playlist

Uploads from IppSec · IppSec · 0 of 60

← Previous Next →