Re: commands in hex vs ASCII

[Steve Grubb <sgrubb@redhat.com>]

Hello,

On Tuesday, October 4, 2016 9:46:32 AM EDT Kevin Brown wrote:
> Is there an option within auditd to set whether commands are stored as hex
> vs ASCII?

No.
 
> With the prevalence of SIEM these days, seems easier to keep the commands
> as ASCII and not presume a person needs to have access to a local system to
> run ausearch.
> 
> Have gone through the documentation but didn't see an answer.

This is a design decision from way back around 2005. The problem is that a 
user can control certain things. If they want to evade detection or throw off 
naive analysis, then the can do log injection attacks by using spaces, legal 
field names, and carriage returns in fields controlled by the user. Simple 
parsers will be tricked.

There is some work currently going on wrt formatting output differently. In a 
way I'd rather see some plugins created using libauparse that presents the 
information to the siem in a format that it won't naively parse.

-Steve