#Forensics

Audit Logs That Survive an Incident (Because the Attacker Reads Logs Too) 🔥📜

The first thing a competent attacker does after popping a box is check what's watching them — and the second thing is delete it. If your audit trail lives only on the host it's auditing, you don't have an audit trail, you have a suggestion.