CEH Enumeration and System Hacking Practice Question

A security analyst is investigating a compromised Linux system. The /var/log/auth.log file appears to be truncated, and the timestamps on several binaries in /bin/ have been modified. Which of the following tools or techniques is the attacker MOST likely using to cover tracks?

⚠ Common exam trap

Watch out — candidates often confuse a simple log cleaner script (Option D) with the full capability of a rootkit, failing to recognize that only a rootkit can simultaneously hide processes, modify binary timestamps, and intercept log writes at the system call level.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Rootkit

The attacker is most likely using a rootkit to cover tracks because rootkits are designed to hide malicious activity by intercepting system calls (e.g., via LD_PRELOAD or kernel modules) to hide processes, files, and network connections. The truncated auth.log and modified timestamps on binaries in /bin/ indicate the rootkit is actively tampering with system logs and file metadata to evade detection, which aligns with rootkit behavior rather than simpler tools.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
Timestamp manipulation tool
Why it's wrong here
A timestamp manipulation tool, such as `touch` or `utime`, is designed solely to alter the access, modification, and change times (atime, mtime, ctime) of files and directories. While useful for forensic evasion by making files appear older or newer, it does not possess the capability to truncate log files or modify the content of system binaries in `/bin`, which are distinct and more complex system-level alterations.
✓
Rootkit
Why this is correct
A rootkit is a collection of tools designed to obtain and maintain privileged access on a computer while actively hiding its presence from administrators and security software. It achieves this by replacing legitimate system binaries with malicious versions, hooking system calls to manipulate output (e.g., hiding processes or files), and modifying log files to erase traces of its activity. This comprehensive subversion of the operating system allows an attacker to maintain persistent, stealthy control over the compromised Linux system.
✗
Steganography
Why it's wrong here
Steganography is the art and science of hiding information within other non-secret data or media, such as images, audio files, or network packets, to avoid detection. Its primary purpose is covert communication, embedding secret messages without revealing their existence. This technique does not involve modifying system binaries, truncating system logs, or altering the operational behavior of the operating system itself, making it unsuitable for the described system compromise actions.
✗
Log cleaner script
Why it's wrong here
A log cleaner script is typically an automated utility designed for routine system maintenance, focusing on managing log file sizes by archiving, compressing, or deleting old log entries. While it can truncate or remove logs, its functionality is limited strictly to log file management and does not extend to modifying or replacing executable binaries located in critical system directories like `/bin`. Such a script would lack the necessary permissions or design to subvert core system functionality.

Go deeper

CEH Enumeration and System Hacking Practice Question

Why each option matters

Option-by-option breakdown

Related to this question