Logging Detection
What to log on $LAB — auth, process, network — without hoarding secrets.
Visual · msf_logging_detection
Log for detection; redact secrets. Original Cyberlium.
If defenders cannot see it, they cannot respond.
Enable verbose logging on $LAB victim where brief allows: auth failures from aux, process creation around sessions, firewall denies. Correlate timestamps with msfconsole run. Never log full payloads or creds into public chats — align with privacy hygiene.
1. Log sources on lab
OS auth logs, sysmon-style process logs if available, lab firewall.
MSF journal or script log your own commands — redact IPs if sharing.
Command guide
Try these commands — Log sources on lab
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
Elastic detection — https://www.elastic.co/security (SIEM literacy for MSF lab traffic) MITRE ATT&CK detection — https://attack.mitre.org/
═══ INSTALL ═══
Linux (Debian/Ubuntu): Kali: preinstalled, or: sudo apt install metasploit-framework
macOS: Prefer Kali/Linux VM — brew install metasploit (heavy)
Windows: Use Kali VM or WSL with metasploit-framework — not raw Windows host
═══ LINUX / macOS ═══
Command — copy this
journalctl -n 20 --no-pager 2>/dev/null | grep -iE 'ssh|failed|session' | head -10 || echo 'Review auth logs after YOUR lab session' msfconsole -q -x 'grep -i log; exit' 2>/dev/null || echo 'Note IOCs from YOUR lab traffic'
Primary tools to practice this lesson: msfconsole, journalctl. Reference sites: Elastic detection (https://www.elastic.co/security); MITRE ATT&CK detection (https://attack.mitre.org/). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Detection ideas
Alert on outbound to non-standard ports from server VMs.
Threshold failed logins after aux brute lab.
3. Redaction
Redact SESSION tokens, hashes, passwords from writeups.
chmod 600 notes — owner only.
4. What you ship: logging detection notes
Three log sources + two detection ideas + redaction rule.
5. What you record before the next lesson
Logging notes path.
6. Wrong vs right: stranger hosts vs YOUR lab VM
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
- Wrong: Paste full hashdump into Discord for help.
- Right: Logging plan written. Next: checklist.
Mission: logging plan
1) Name three $LAB log sources. 2) Write two detection ideas. 3) Write redaction rule for creds.
Stuck? Ask Cyberlium AI Mentor
Ask Mentor: “Sysmon vs auth logs for aux?”
APPLY: Detection needs:
APPLY: True or False: Post cred dumps go in public chat.
APPLY: Notes should:
Checklist
Part of Metasploit Framework — Defense View and Capstone Lab.
Capstone Lab
Part of Metasploit Framework — Defense View and Capstone Lab.
Quiz — Metasploit Topic
Part of Metasploit Framework — Defense View and Capstone Lab.