HACTRAC: REMOTE LOG TOOL
Loading...
Files
Date
2019-07-04T11:21:50Z
Authors
Journal Title
Journal ISSN
Volume Title
Publisher
Abstract
Deception Technology is a recent addition to network security that involves the use of
deceptive servers to implement a decoy strategy in order to prevent hacking attacks.
A decoy server is a server machine, which is ideally a virtual machine that closely
mimics the original production servers. It will run the same services as the original
server, which are intended to deceive the attacker into believing that it is a legitimate
production server. It will also contain deceptive documents that seem like they are
documents that contain valuable information, whereas in reality they are just fake
documents used to trick the attacker.
HacTrac is a remote event log tool that allows a user, ideally a security administrator,
to monitor the activity on a remote decoy server machine, with the intent of identifying
a potential attack. It was built to work with a decoy/engagement server VM, thereby
implementing a deception strategy. HacTrac was built using C# .NET, and works with
various classes from the .NET Framework that are associated with windows
diagnostics and eventing (found under the System.Diagnostics namespace)
It uses RPCs (Remote Procedure Call) in order to communicate with the remote
machine, and uses classes such as the EventLogQuery and EventLogReader within
the eventing framework, to query and read the event logs of the remote machine. . This
allows the security administrator to remotely monitor the engagement VM and its
activities through the background, without having to directly access it. It further
implements filters in order to isolate irrelevant events and only populate those events
that are of concern to the security administrator
Description
Keywords
1NZ17MCA71