42. Evading IDS, Firewalls and Honeypots – Detection Games

42.7 Covering Tracks vs Log Integrity – Blue Wins

By Ravindra Bagale Last updated: 27 September 2026

CEH phase "covering tracks" = delete logs, change timestamps, stop syslog. Blue answer is not "hope they forget". Blue answer:

Logs leave the box (rsyslog/SIEM/Wazuh) the moment they are born
NTP / chrony so timestamps match across Kali demo + Suricata + firewalld
Append-only / WORM or at least remote write-only
File integrity (AIDE/auditd) on /var/log and suricata.yaml
Restricted root; sudo I/O logs

Red can wipe a local fast.log. Red cannot un-send the copy already on the SIEM in Nagpur.

# Amazon Linux lab – time + audit + syslog (illustrative)
sudo yum install chrony audit rsyslog
sudo service chronyd start
sudo systemctl enable chronyd
sudo service auditd start
sudo service rsyslog start
date
# Integrity idea: after hardening, initialise AIDE (package name may vary)
# sudo yum install aide && sudo aide --init

Red team (attacker) does	Blue team (defender) detects / stops
`rm` / truncate local IDS log	Remote syslog; alert on log volume drop to zero
Sets clock back to confuse IR	chrony + alert on time step; compare SIEM ingest time
Stops `suricata` service	systemd/service monitor; missing-heartbeat in SIEM

Ravindra Bagale's Tip

Students "logs local tar enough" mhantat. First command Red shikto = clear logs. Interview: "My IDS alert is not real until it is off-box." Samjla ka?

Lab

On .40, sudo service suricata stop (lab only) then start again. Write an alert pseudo-rule: suricata heartbeat missing 2 minutes → ticket. Prove chronyd is running (sudo service chronyd status). Don't practise log wiping – practise detecting absence.