logger container ready
This commit is contained in:
marcos.luna
@@ -82,6 +82,7 @@ See the [Getting Started Guide] for installation and setup instructions.
|
||||
- **Getting Started** - Installation and first steps
|
||||
- **Features Overview** - Detailed feature explanations
|
||||
- **OPSEC Guide** - Operational security considerations
|
||||
- **Logging & Syslog** - System logging and syslog configuration
|
||||
- **Usage Examples** - Practical examples and use cases
|
||||
- **Troubleshooting** - Common issues and solutions
|
||||
|
||||
|
||||
@@ -0,0 +1,281 @@
|
||||
+++
|
||||
title = "Logging & Syslog"
|
||||
chapter = false
|
||||
weight = 50
|
||||
pre = "6. "
|
||||
+++
|
||||
|
||||
# 📊 Logging & Syslog
|
||||
|
||||
Cazalla includes a complete logging system that records all Mythic events and sends them to a central syslog server for analysis and auditing.
|
||||
|
||||
## 🎯 Description
|
||||
|
||||
Cazalla's logging system:
|
||||
|
||||
- ✅ **Logs ALL events** from Mythic automatically
|
||||
- ✅ **Does not modify the agent** (avoids detections)
|
||||
- ✅ **Runs on the server**, not on the target
|
||||
- ✅ **Sends logs to syslog** central for analysis
|
||||
- ✅ **Saves local logs** as backup
|
||||
- ✅ **Structured JSON format** for easy parsing
|
||||
|
||||
## 📋 Logged Events
|
||||
|
||||
The logger automatically captures all these events:
|
||||
|
||||
| Event | Description |
|
||||
|--------|-------------|
|
||||
| **CALLBACK** | When an agent connects or checks in |
|
||||
| **TASK** | When a task is created or updated (commands executed) |
|
||||
| **RESPONSE** | Agent responses (command output) |
|
||||
| **CREDENTIAL** | Captured credentials |
|
||||
| **KEYLOG** | Keystrokes captured by the keylogger |
|
||||
| **FILE** | Files uploaded or downloaded |
|
||||
| **ARTIFACT** | Generated artifacts (IOCs, processes created, etc.) |
|
||||
| **PAYLOAD** | Created payloads |
|
||||
|
||||
## ⚙️ Configuration
|
||||
|
||||
### Step 1: Configure the Logger
|
||||
|
||||
The logger is configured via a configuration file. **You don't need to modify docker-compose.yml**.
|
||||
|
||||
1. **Edit the configuration file:**
|
||||
```bash
|
||||
nano Payload_Type/cazalla/logger/syslog.conf
|
||||
```
|
||||
|
||||
2. **Configure the syslog server IP:**
|
||||
```bash
|
||||
# If rsyslog is on the same host as Mythic, use the host IP
|
||||
SYSLOG_SERVER=10.8.20.50
|
||||
|
||||
# Or if using Docker bridge
|
||||
SYSLOG_SERVER=172.17.0.1
|
||||
|
||||
# Port (default 514)
|
||||
SYSLOG_PORT=514
|
||||
|
||||
# Syslog facility (16 = LOCAL0, recommended)
|
||||
SYSLOG_FACILITY=16
|
||||
```
|
||||
|
||||
3. **Rebuild and restart the container:**
|
||||
```bash
|
||||
cd /opt/mythic
|
||||
sudo ./mythic-cli build cazalla
|
||||
sudo ./mythic-cli restart cazalla
|
||||
```
|
||||
|
||||
### Step 2: Configure rsyslog on the Host (Optional)
|
||||
|
||||
If you want to receive logs on the same server where Mythic runs:
|
||||
|
||||
1. **Install rsyslog** (if not installed):
|
||||
```bash
|
||||
sudo apt-get update && sudo apt-get install -y rsyslog
|
||||
```
|
||||
|
||||
2. **Enable UDP reception** in `/etc/rsyslog.conf`:
|
||||
```bash
|
||||
sudo sed -i 's/#module(load="imudp")/module(load="imudp")/' /etc/rsyslog.conf
|
||||
sudo sed -i 's/#input(type="imudp" port="514")/input(type="imudp" port="514")/' /etc/rsyslog.conf
|
||||
```
|
||||
|
||||
3. **Create rule for Cazalla** in `/etc/rsyslog.d/50-cazalla.conf`:
|
||||
```bash
|
||||
sudo bash -c 'cat > /etc/rsyslog.d/50-cazalla.conf << EOF
|
||||
# Logs from Cazalla Mythic agent
|
||||
# Filter by facility LOCAL0 (16)
|
||||
if \$syslogfacility-text == "local0" then /var/log/cazalla.log
|
||||
& stop
|
||||
EOF
|
||||
'
|
||||
```
|
||||
|
||||
4. **Restart rsyslog:**
|
||||
```bash
|
||||
sudo systemctl restart rsyslog
|
||||
sudo systemctl enable rsyslog
|
||||
```
|
||||
|
||||
5. **Verify it's listening:**
|
||||
```bash
|
||||
sudo netstat -ulnp | grep 514
|
||||
# You should see: UNCONN ... 0.0.0.0:514 ... rsyslogd
|
||||
```
|
||||
|
||||
## 📊 Verification
|
||||
|
||||
### Verify Logger is Active
|
||||
|
||||
```bash
|
||||
# View container logs
|
||||
sudo docker logs cazalla | grep -i "syslog\|Logger initialized"
|
||||
|
||||
# You should see:
|
||||
# INFO:cazalla_logger:Syslog client initialized: 10.8.20.50:514 (facility=16)
|
||||
# INFO:cazalla_logger:Logger initialized: cazalla_logger
|
||||
```
|
||||
|
||||
### View Logs in Real-Time
|
||||
|
||||
```bash
|
||||
# View logs in syslog (host)
|
||||
sudo tail -f /var/log/cazalla.log
|
||||
|
||||
# View local logs (inside container)
|
||||
sudo docker exec cazalla tail -f /tmp/cazalla_mythic_$(date +%Y-%m-%d).log
|
||||
```
|
||||
|
||||
### View Specific Events
|
||||
|
||||
```bash
|
||||
# View only tasks
|
||||
sudo tail -100 /var/log/cazalla.log | grep '"event_type": "TASK"'
|
||||
|
||||
# View only responses
|
||||
sudo tail -100 /var/log/cazalla.log | grep '"event_type": "RESPONSE"'
|
||||
|
||||
# Count events by type
|
||||
sudo tail -1000 /var/log/cazalla.log | grep -o '"event_type": "[^"]*"' | sort | uniq -c
|
||||
```
|
||||
|
||||
## 📝 Log Format
|
||||
|
||||
Logs are saved in structured JSON format for easy parsing:
|
||||
|
||||
```json
|
||||
{
|
||||
"event_type": "TASK",
|
||||
"timestamp": "2025-11-17T15:18:23.117715674Z",
|
||||
"operation_id": 1,
|
||||
"operation_name": "Operation Chimera",
|
||||
"username": "mythic_admin",
|
||||
"action": "new_task",
|
||||
"server_name": "mythic",
|
||||
"data": {
|
||||
"id": 18,
|
||||
"command_name": "shell",
|
||||
"params": "{\"command\":\"whoami\"}",
|
||||
"status": "success",
|
||||
"callback_id": 2,
|
||||
"operator_username": "mythic_admin",
|
||||
...
|
||||
}
|
||||
}
|
||||
```
|
||||
|
||||
### Log Locations
|
||||
|
||||
- **Syslog (host)**: `/var/log/cazalla.log`
|
||||
- **Local logs (container)**: `/tmp/cazalla_mythic_YYYY-MM-DD.log`
|
||||
- One file per day
|
||||
- No rotation (all files are kept)
|
||||
- Format: `cazalla_mythic_2025-11-17.log`
|
||||
|
||||
## 🔍 Usage Examples
|
||||
|
||||
### Search for a Specific Command
|
||||
|
||||
```bash
|
||||
# Search for all 'whoami' executions
|
||||
sudo grep -i "whoami" /var/log/cazalla.log | grep '"event_type": "TASK"'
|
||||
```
|
||||
|
||||
### View Operator Activity
|
||||
|
||||
```bash
|
||||
# View all events from a user
|
||||
sudo grep '"username": "mythic_admin"' /var/log/cazalla.log
|
||||
```
|
||||
|
||||
### View Captured Credentials
|
||||
|
||||
```bash
|
||||
# View credential events
|
||||
sudo grep '"event_type": "CREDENTIAL"' /var/log/cazalla.log
|
||||
```
|
||||
|
||||
### Analyze Generated Artifacts
|
||||
|
||||
```bash
|
||||
# View all artifacts (detected IOCs)
|
||||
sudo grep '"event_type": "ARTIFACT"' /var/log/cazalla.log
|
||||
```
|
||||
|
||||
## 🛠️ Troubleshooting
|
||||
|
||||
### Logger Doesn't Appear in Mythic GUI
|
||||
|
||||
**Solution:**
|
||||
1. Verify the logger is imported in `main.py`
|
||||
2. Rebuild the container: `sudo ./mythic-cli build cazalla`
|
||||
3. Restart: `sudo ./mythic-cli restart cazalla`
|
||||
|
||||
### Don't See "Syslog client initialized"
|
||||
|
||||
**Solution:**
|
||||
1. Verify `SYSLOG_SERVER` has a value in `syslog.conf`:
|
||||
```bash
|
||||
sudo docker exec cazalla cat /Mythic/logger/syslog.conf | grep SYSLOG_SERVER
|
||||
```
|
||||
2. Rebuild the container if you just edited the file
|
||||
|
||||
### Messages Not Reaching Syslog
|
||||
|
||||
**Solution:**
|
||||
1. Verify rsyslog is listening: `sudo netstat -ulnp | grep 514`
|
||||
2. Verify connectivity from container to host
|
||||
3. Verify rsyslog configuration: `sudo cat /etc/rsyslog.d/50-cazalla.conf`
|
||||
4. Verify firewall: `sudo iptables -L -n | grep 514`
|
||||
|
||||
### Logs Are Empty
|
||||
|
||||
**Solution:**
|
||||
- Logs only appear when there's activity in Mythic
|
||||
- Execute a command on an agent to generate events
|
||||
- Verify the agent is connected and active
|
||||
|
||||
## 📚 Advanced Configuration
|
||||
|
||||
### Change Syslog Facility
|
||||
|
||||
The syslog facility determines how messages are categorized. By default, `16` (LOCAL0) is used.
|
||||
|
||||
To change the facility, edit `syslog.conf`:
|
||||
|
||||
```bash
|
||||
# Use AUTH (4) for security logs
|
||||
SYSLOG_FACILITY=4
|
||||
|
||||
# Or use LOCAL1 (17)
|
||||
SYSLOG_FACILITY=17
|
||||
```
|
||||
|
||||
Then update the rsyslog rule to filter by the new facility.
|
||||
|
||||
### Send to Multiple Syslog Servers
|
||||
|
||||
To send to multiple servers, you would need to modify the logger code or use an intermediate syslog server that forwards messages.
|
||||
|
||||
### SIEM Integration
|
||||
|
||||
The JSON formatted logs can be easily integrated with SIEMs such as:
|
||||
- Splunk
|
||||
- ELK Stack (Elasticsearch, Logstash, Kibana)
|
||||
- Graylog
|
||||
- QRadar
|
||||
|
||||
Simply configure the SIEM to read from `/var/log/cazalla.log` or from the central syslog server.
|
||||
|
||||
## 🔗 References
|
||||
|
||||
- [Logger Technical Documentation](../Payload_Type/cazalla/logger/README.md)
|
||||
- [Mythic Logging Documentation](https://docs.mythic-c2.net/customizing/3.-consuming-containers/logging)
|
||||
- [RFC 3164 - The BSD syslog Protocol](https://tools.ietf.org/html/rfc3164)
|
||||
|
||||
---
|
||||
|
||||
**Note:** The logging system is active by default. You only need to configure the syslog server if you want to centralize logs.
|
||||
Reference in New Issue
Block a user