Unit 8: Logs and the timeline · Lesson 5 of 8 · 20 min
Building a timeline
Put the session of 13 October in order and connect it to everything you found on disk.
mission
- You are
- You are writing the timeline section of the incident report.
- Situation
- You have a login, five root commands, a logout and four files on disk with matching times.
- Goal
- Assemble one ordered timeline with evidence for each line.
- Hand in
- A seven-line timeline from login to logout.
Bracket the session
grep -h 'omar' auth.log.1 | grep -E 'Accepted|closed' | awk '{print $3, $6, $7, $8, $9, $10, $11}'
09:12:05 Accepted publickey for omar from 192.0.2.10
09:48:33 pam_unix(sshd:session): session closed for user omar
22:31:12 Accepted publickey for omar from 192.0.2.10
23:02:48 pam_unix(sshd:session): session closed for user omar
you should see A normal morning session and a late one from 22:31 to 23:02. All five root commands sit inside the late one.
Count every root command in both days
grep -h 'COMMAND=' auth.log.1 auth.log | wc -l 6 grep -h 'COMMAND=' auth.log.1 auth.log | awk -F'COMMAND=' '{print $2}' | tail -n 1 /usr/bin/apt update
you should see Five on the 13th and one ordinary package update on the 14th.
Connect log to disk
Each command left a file. Matching times turn two weak clues into one strong one.
ls -l --time-style=+%H:%M /usr/local/lib/.cache/kthreadd /etc/profile.d/proxy.sh /etc/cron.d/.sync-check /etc/systemd/system/kthreadd-helper.service | awk '{print $6, $7}'
22:44 /etc/cron.d/.sync-check
22:42 /etc/profile.d/proxy.sh
22:45 /etc/systemd/system/kthreadd-helper.service
22:41 /usr/local/lib/.cache/kthreadd
The timeline
22:31:12 22:38:50 22:41:07 22:42:30 22:44:02 22:45:10 23:02:48
login, omar from 192.0.2.10 useradd sysops, UID 0 kthreadd copied to .cache proxy.sh written .sync-check cron written kthreadd-helper unit written session closed
What a defender takes away
- 1Bracket activity between login and logout.
- 2Match every log entry to an artifact on disk.
- 3A timeline is the backbone of every incident report.
Questions
0 of 3 solved
Answer each one from what you find on your lab machine.