Modify a line in wtmp – Linux Accounting

The /var/log/wtmp file in a Linux system contains data about past user logins.  An attacker may want to modify this file as one of the steps they take in covering their track.  One may also want to modify utmp or btmp as well.  This same technique can be used. The … Continue reading

Capture a spurious outbound connection with NETSTAT

Several years ago, I created a PowerShell script to create a log of outbound connections.  What if you need something quick and dirty and cannot use a script like that or external tools like Process Explorer, etc? Here is a batch script that runs in an infinite loop and catches … Continue reading

  • The postings and views on this site are my own and do not necessarily reflect the positions, strategies, or opinions of any current or previous employer.