Now we're going to take a look at this section through the eyes of the red and blue team.
And as much as I don't want to do that because the blue team are bad folks, they're not really
bad.
They're just against what we're trying to do.
But we're going ahead, right?
Let's swap over to our lab for just a moment and take a look at a couple things real quick.
By logs, when we were mentioned earlier in opening up this final skill in our course,
we're on the client VM that we've been doing a lot of exploitation with.
And I'm taking a look at the security logs inside of event viewer.
The reason for this is, and I'll zoom in momentarily, but one of the logs that we have in here is
an event 4799, Microsoft Windows security auditing.
And as I zoom in for us, you can see here that we are notified that something happened
with C drive users, error desktop, dummy.exe.
So right here, this is in the eyes of the blue team, dummy.exe does not appear to be
a normal name for any of the files within our organization.
This might cause or raise eyebrows and get, get you caught.
And so it's up to you to know where these logs are and how to deal with them.
Now you could easily go through here and right click and say clear logs, but we'll
discuss more on that in a second.
In the eyes of the red team here, this is good information to know when you're closing
out a, a pen test.
So that way you can go through and make sure that dummy.exe is no longer on this system
just in case.
Now it's not going to be up to you all the time to make sure that these files are deleted.
Could be that you go to the organization with your notes and say, this is where all my stuff
is.
This is what you need to do.
Go forth and conquer.
Now there's other things that we want to address as well, too, such as going to the DC.
You could look here in Microsoft Windows Defender and see that these are all the different times
that we've had to allow dummy.exe to run on the DC.
And these events are still there, meaning that they still exist within the Windows Defender
logs.
And again, red team, blue team thing is, is that blue team sees it and they know something's
up.
Red team sees it and they know that at some point we need to go back and make sure that
these are out of the organization.
And also we need to make sure that throughout the course of the pen test, these logs don't
appear so that way the blue team doesn't catch us.
And these are kind of dead giveaways.
Now it's important to know a couple of things about this and that those are just default
places inside of Windows that you can go through and look at logs to understand what's
going on with the actual system itself.
And yes, you will always have that in your hip pocket to go through and take a look at
and clear.
Before we go more into actually looking at the logs, I do want to mention that there
are also other third party applications out there.
There's even proprietary applications in existence.
And most proprietary systems will generate logs either through the Windows default or
operating system default or in some sort of IDS IPS manner.
And it's up to us as pen testers when we actually infiltrate a network to understand where all
these security systems are and what these logs are being generated mean.
So are we trying to evade capture or getting caught?
Or are we trying to go in and clean everything up at the end of a pen test?
So that way we can make sure that the organization doesn't have any Easter eggs in the future.
Back to our lab, I want to show you something real quick.
And it's kind of a good thing, bad thing type situation for us as pen testers, right?
So it's possible to go in and I'm as local administrator on this system, just demonstrate
for you, that you can clear these logs and you could go into the actual command prompt
and type in commands to clear the event logs.
And I'll put these commands below because I'm just showing you one up here.
But I want to show you what it does as well.
So we're saying webutil clear system, let me zoom in for here real quick.
I'm just in command prompt and there's ways to do this inside of PowerShell too.
I'm just going to put the codes for the command prompt in there.
And now when you do this, there we go, poke back in.
Now when you do this and it's actually spelled correctly, which is why we always have the
code boxes below, you could go back into the appropriate log that you cleared, which this
one was system, and I'll go in and you can see that there's nothing in there but one
event.
And it's that one event that I really want to point out here is that when you go in there,
you can very clearly see, as I select that for you, this system log or this system log
file was cleared, meaning that it was manually cleared and you have a date and timestamp
to verify that.
Does that mean that we got away with everything?
That kind of depends on how you look at it because they don't have any proof of anything
to happen prior to this now, as long as there's no backup, hint, hint, nudge, nudge, but now
you have solid evidence here that this has been cleared and it tells you who done it
because right now this was client VM administrator, right?
I also want to show you on the DC, the event log over there, and this is where it gets
a little wonky, right?
Because in the previous couple of skills, we were going around messing with MTLM hashing
along with the KRB TGT account to make a fake golden ticket.
And this right here was the event that popped up and I'll screenshot this and actually put
it below this video as well for you too.
Because right here, if I scroll down on it, you can see that the account that was made
was Tacos, zoom in for you real quick, Texas Tacos was made.
Now we know that that's not an account inside of Active Directory.
That was that fake account that we made by using the golden ticket to be able to go in
and elevate a made up user to be able to give us administrative rights.
This plays back into our logging thing right here.
So the blue team can see this and say, oh, and the red team can see this and say, we
need to cover that up because we don't want to get caught.
And we can also clear this out at the end of our pin test to make sure that these don't
exist as false positives in the future.
And there's many other reasons that you may want to do stuff like this as well, too.
Just something to consider.