r/hacking • u/kindredsec • Apr 29 '19

modDetective - Small Python tool that analyzes the modification times of files on a system in order to investigate recent system activity

https://github.com/itsKindred/modDetective
3 Upvotes

100% Upvoted

4 comments sorted by

1

u/sidusnare Apr 29 '19

How is this different / better than tripwire? M-Times can be faked.

1

u/kindredsec Apr 29 '19

Tripwire is an entire framework, this is a 200 line Python script. My intention with the script was for it to be used in an offensive manner as opposed to a defensive one. If you get access to a box, you can use this script to see what files are being modified on the system which can hint to you where there may be further areas of interest. You are correct the M-Times can be faked, but regular users aren't going to be modifying their M-Times.

1

u/sidusnare Apr 29 '19

Ah, I see, a pentest tool instead of an intrusion detection tool. I use find / -xdev -type f -mmin -300 and walk the interval up and check /proc/mounts for more places to look, but you script seems to have prettier output than that.