Summary

In this chapter, we explored many techniques for manipulating and deceiving the opponent into collecting false or useless data about the environment. The concept of tampering with logs and host-based telemetry can take an attacker further, but these techniques are still detectable from a forensics point of view. Being able to tell when a system is not reporting proper telemetry as a defender is critical to understanding when there is foul play. We saw in practice how multiple data sources could point out when one source has been tampered with. From the attacker's perspective we took the idea of hiding data to the extreme by showing a common rootkit, how to use it, and later looked at multiple techniques for detecting rootkits. We deep dived into various rootkit detection techniques, showing how we could use various datasets to discover and investigate such extremely deceptive tools. Later in the defensive section, I showed several tried-and-true techniques for both misdirecting...