In this lesson, you will learn how to reconstruct an attacker’s timeline and intent by performing deep-dive forensic analysis on historical Mandatory Access Control (MAC) logs.
When a security incident occurs, your MAC logs (such as those generated by AppArmor or SELinux) are your primary source of truth. Unlike standard application logs, which can be forged or silenced by an intruder, MAC audit logs are generated by the kernel. This makes them a reliable record of what a process attempted to do, regardless of whether it succeeded.
The Anatomy of an Investigation
Forensic analysis begins with searching for denied events that correlate with the timeline of a suspected breach. If an attacker gains initial access, they will frequently trigger "Access Denied" errors as they probe the system for privilege escalation points or configuration files.
When examining your logs (typically found in /var/log/audit/audit.log or /var/log/syslog), look for patterns of AVC (Access Vector Cache) denials. A single denial might be a configuration bug, but a burst of denials across different system resources often indicates automated reconnaissance or a "living off the land" attack.
Forensic Pattern Matching
To identify malicious intent, filter your logs for unauthorized access attempts directed at sensitive paths:
# Filter for denied attempts at sensitive shadow files
grep "type=AVC" /var/log/audit/audit.log | grep "denied" | grep "/etc/shadow"
Once you identify the process ID (pid) associated with these denials, you can cross-reference it with the audit trail to see the parent process. If a web server process (httpd or nginx) is suddenly attempting to access /etc/shadow or load unauthorized kernel modules, your MAC logs have just provided the "smoking gun" for the breach.
By analyzing the specific MAC context—the scontext (subject context) and tcontext (target context)—you can determine exactly which security policy failed or which process was hijacked to bypass your hardening measures. Use this data to refine your profiles, ensuring that the detected activity is explicitly prohibited in the future.
Key Takeaway: Historical MAC logs act as an immutable kernel-level witness, allowing you to trace an attacker’s lateral movement by correlating denied security context transitions.