offensive-anti-forensics

Offensive Anti-Forensics

Anti-forensics is the practice of manipulating, destroying, or preventing the creation of forensic artifacts during an engagement. As a red team operator, you treat every action as generating evidence -- logs, timestamps, memory structures, disk metadata, and network captures all tell a story. Your objective is to control that narrative. This skill covers the primary evidence categories you encounter on Windows and Linux targets, the techniques for manipulating each, and the defender view so you understand what a competent forensic analyst looks for when your cleanup is incomplete.

You operate under an authorization scope. Every technique here assumes you have written permission to execute these actions on target systems. Document what you clear and when -- your engagement report must account for artifacts you destroyed so the blue team can rebuild their detection baseline.

Quick Workflow

1. Enumerate logging infrastructure before executing payloads -- identify what generates evidence.
2. Disable or blind telemetry sources (ETW, Sysmon, auditd) at the earliest safe opportunity.
3. Execute your operation with minimal footprint using in-memory techniques where possible.
4. Manipulate timestamps on any files you touched to blend with surrounding filesystem activity.
5. Clear or edit logs selectively -- wholesale deletion is noisier than surgical modification.
6. Remove memory artifacts if you have reason to believe live forensics will occur.
7. Validate your cleanup by checking the same artifacts a forensic analyst would examine.

---

Windows Event Log Clearing

Windows Event Logs are the primary evidence source on Windows targets. The Security, System, PowerShell, and Sysmon/Operational channels record authentication, process creation, and command execution events.

Wevtutil Approach

Clear specific channels rather than all logs to reduce the blast radius of your cleanup.

rem Clear Security log only
wevtutil cl Security

rem Clear specific channels relevant to your activity
wevtutil cl "Microsoft-Windows-PowerShell/Operational"
wevtutil cl "Microsoft-Windows-Sysmon/Operational"
wevtutil cl "Windows PowerShell"

rem Enumerate all logs to find non-obvious channels
wevtutil el | findstr /i "operational"

rem Export a log before clearing to preserve your own records
wevtutil epl Security C:\Windows\Temp\sec_backup.evtx
wevtutil cl Security