# Log Completeness Matrix

| #   | Attack Step                                    | MITRE Technique | Log Source                         | Log Entry Summary                                                                                                                  | Default Logging? | Config Required                                                 |
| --- | ---------------------------------------------- | --------------- | ---------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------- | ---------------- | --------------------------------------------------------------- |
| 1   | Reconnaissance (Network Scan)                  | T1046           | /var/log/syslog & journalctl       | Connection attempts logged inside specific active network daemons                                                                  | Yes              | None (UFW is active but allows extensive interfaces by default) |
| 2   | Enumeration (Directory Brute-force)            | T1083           | /usr/local/apache2/logs/access_log | High volume of rapid queries targeting path structures inside `/cgi-bin/`                                                          | Yes              | None                                                            |
| 3   | Initial Access (Apache Path Traversal RCE)     | T1190           | /usr/local/apache2/logs/access_log | `POST /cgi-bin/.%%32%65/.%%32%65/.%%32%65/.%%32%65/bin/sh HTTP/1.1" 200` tracking malicious input payload execution                | Yes              | None                                                            |
| 4   | Execution (Foothold Shell Actions)             | T1059.004       | /var/log/audit/audit.log           | `type=SYSCALL ... comm=whoami exe=/usr/bin/whoami` tracking system binary execution under `daemon` user                            | Partial          | Enable auditd process execution monitoring                      |
| 5   | Post-Exploitation (Credential Looting)         | T1552.001       | /var/log/audit/audit.log           | `type=SYSCALL ... comm=cat exe=/usr/bin/cat ... uid=daemon ... key=credential_loot` verifying direct script readout                | No               | Add auditd file watch rule on `/opt/internal_logs.py`           |
| 6   | Lateral Movement (SSH Pivot to student)        | T1021.004       | /var/log/auth.log                  | Successful interactive password authentication records for the target account: `Accepted password for student from 192.168.56.1`   | Yes              | None                                                            |
| 7   | Privilege Escalation (CVE-2023-0386 OverlayFS) | T1068           | /var/log/audit/audit.log           | `type=SYSCALL ... syscall=setgid success=yes ... comm=sudo ... key=priv_change` tracking malicious FUSE/OverlayFS capability abuse | Partial          | Enable auditd for privilege changes and file writes             |
| 8   | Privilege Escalation (Read Root Flag)          | T1068           | /var/log/audit/audit.log           | `type=PROCTITLE ... proctitle=cat /tmp/root_flag.txt` linked to anchor `type=SYSCALL ... key=flag_read` tracking flag access       | No               | Add auditd file watch on `/tmp/root_flag.txt`                   |

## Summary:

- 4/8 steps are fully logged by default (50.0% coverage)
- 4/8 steps require additional configuration (50.0% gap)

**After configuration: 8/8 steps are logged (100% coverage).**

## Action items for log completeness:

1. **Enable auditd with rules for:**
   - File access monitoring (`-w /opt/internal_logs.py -p r -k credential_loot`)
   - Process execution monitoring (`-a always,exit -F arch=b64 -S execve -k process_exec`)
   - Privilege escalation monitoring (`-a always,exit -F arch=b64 -S setuid -S setgid -k priv_change`)
   - Flag exfiltration watch (`-w /tmp/root_flag.txt -p r -k flag_read`)

## Visibility Gap Analysis & Observability Justification

- **Step 5 (Credentials in Files):** Reading local production scripts (`/opt/internal_logs.py`) via the Apache execution space is handled as a standard application execution layer natively and stays silent to prevent system log bloating. This visibility gap is resolved by implementing specific kernel auditwatches.
- **Step 8 (Read Root Flag):** File modifications inside temporary directories like `/tmp/` are unmonitored by default. This limitation is **non-critical** for overall forensic analysis because Step 7 (the malicious `CVE-2023-0386` core OverlayFS exploit sequence) generates extensive, loud telemetry at the filesystem boundary, alerting defenders before data extraction occurs.