Membership

Log files: Attacks & Defenses (W38)

Investigate how log files are used, altered, and defended. Explore the relationship between attack activity, attempts to hide traces, and forensic analysis.

Instructor · RANJITHA R

Modules:
5
Lessons:
67

eForensics learning

Practical skills.
Verified progress.

What you'll learn

  • Recognize attempts to clear logs or disable auditing.
  • Investigate techniques used to hide files and activity.
  • Assess the role of logs in detecting and reconstructing attacks.

Prerequisites

Basics of Cyber Forensics, for example the five-phase cycle of attack. Equipment and software: Windows OS, LINUX/UNIX platforms.

Module 2

Module 1

  1. 1. (W38M01) Module Introduction

  2. 2. (W38M02) Methodology of Hacking

  3. 3. (W38M03) Covering tracks and hiding

  4. 4. (W38M04) Hiding evidence by altering event logs

  5. 5. (W38M05) Attacking event logs in Windows

  6. 6. (W38M06) Altering Event Logs in Windows

  7. 7. (W38M07) Tool 1 - LCP

  8. 8. (W38M08) Tool 2 - Winzapper

  9. 9. (W38M09) Tool 3 - Event Viewer

  10. 10. (W38M10) How to clear Event Logs

  11. 11. (W38M11) Clearing Events from Command Prompt Part 1

  12. 12. (W38M12) Clearing Events from Command Prompt Part 2

  13. 13. (W38M13) Clear All Events Using PowerShell

  14. 14. (W38M14) Linux / Unix Logs

  15. 15. (W38M15) How to View Linux Logs?

  16. 16. (W38M16) Brief History About Syslogs

  17. 17. (W38M17) Attacking System Logs and Accounting Files in Linux / Unix

  18. 18. (W38M18) Netcat

  19. 19. (W38M00) Netcat

  20. 20. (W38M19) Demonstration: Clearing Logs

  21. 21. (W38M20) Demonstration: Linux Logs

  22. 22. (W38M21) Demonstration: Lab Exercise 1

Assessments

Assignment Required

(W38A01) Module 1 Exercises and Practical Labs

Module 3

Module 2

  1. 1. (W38M00) UBUNTU SERVER INSTALLATION (MODULE 2)

  2. 2. (W38M23) Defences against Log and Accounting File Attacks

  3. 3. (W38M00) UNIX / LINUX - SYSTEM LOGGING

  4. 4. (W38M24) Active Logging

  5. 5. (W38M25) Group Policy Objects

  6. 6. (W38M26) Active Directory

  7. 7. (W38M27) Microsoft Management Console

  8. 8. (W38M28) Setting Proper Permissions

  9. 9. (W38M29) Separate Logging Server

  10. 10. (W38M30) Encrypting Log Files

  11. 11. (W38M31) Append-only

  12. 12. (W38M32) Write-once media

  13. 13. (W38M33) UTMP, WTMP, BTMP filesv in Linux

  14. 14. (W38M34) Demonstration: UTMP, WTMP, BTMP files

  15. 15. (W38M35) Linux

  16. 16. (W38M36) Shell History

  17. 17. (W38M37) Syslog Services

  18. 18. (W38M38) Demonstration: Microsoft Management Console

  19. 19. (W38M39) Demonstration: ACL Enabling

Assessments

Assignment Required

(W38A02) Module 2 Exercises and Practical Labs

Module 4

Module 3

  1. 1. (W38M41) Creating hidden files and directories in UNIX

  2. 2. (W38M42) Linux Links

  3. 3. (W38M43) Creating Hidden Files in Windows

  4. 4. (W38M44) Defenses from Hidden Files

  5. 5. (W38M45) Alternate Stream View

  6. 6. (W38M46) ADS Manager

  7. 7. (W38M47) ADS Spy Tool

  8. 8. (W38M48) Create a text file using a CAT command

  9. 9. (W38M49) Hiding Files Demonstration

  10. 10. (W38M50) NTFS Streaming Demonstration

  11. 11. (W38M51) Tools Demonstration

  12. 12. (W38M52) Port Scanning Demonstration

  13. 13. (W38M53) Exercise Demonstration

Assessments

Assignment Required

(W38A03) Module 3 Assignments

Module 6

Final Exam

Lessons will appear here after course content is added.

Assessments

Quiz Required

(W38Q01) Final Exam

Course access

Unlock Log files: Attacks & Defenses (W38).

Enter your email. We’ll send a sign-in code here without taking you away from this course.