Offensive Anti Forensics
Anti-forensics and evidence destruction techniques for red team operators conducting...
Install
npx skills add SnailSploit/Claude-Red --skill offensive-anti-forensics -g -a claude-code -y- Repository
- SnailSploit/Claude-Red10.2k
- Category
- Engineering
- Updated
- 23d ago
- License
- MIT
- Context cost
- Mediumabout 3,000 tokens
- Runs scripts
- No, instructions only
What it does
Anti-forensics and evidence destruction techniques for red team operators conducting authorized engagements. Covers log clearing on Windows (wevtutil, Clear-EventLog, ETW provider patching) and Linux (journal truncation, utmp/wtmp binary editing, syslog manipulation), timestamp manipulation via Timestomp and SetMACE to defeat timeline analysis, filesystem-level anti-forensics including NTFS Alternate Data Streams for payload hiding and secure deletion with sdelete/shred, memory artifact removal to counter live forensics, disk artifact manipulation targeting MFT entries and USN journal records, network forensics evasion through encrypted C2 channels and DNS-over-HTTPS tunneling, and anti-VM/sandbox detection to avoid dynamic analysis environments. Tools: Timestomp, wevtutil, sdelete, shred, MimiPenguin, Invoke-Phant0m. Aligns to MITRE ATT&CK T1070 (Indicator Removal), T1027 (Obfuscated Files or Information), T1497 (Virtualization/Sandbox Evasion). Each technique includes the forensic artifact it targets, the destruction or manipulation method, and the defender perspective so operators understand detection gaps they must account for.
Offensive Anti-Forensics
Anti-forensics is the practice of manipulating, destroying, or preventing the creation of forensic artifacts during an engagement. As a red team operator, you treat every action as generating evidence -- logs, timestamps, memory structures, disk metadata, and network captures all tell a story. Your objective is to control that narrative. This skill covers the primary evidence categories you encounter on Windows and Linux targets, the techniques for manipulating each, and the defender view so you understand what a competent forensic analyst looks for when your cleanup is incomplete.
You operate under an authorization scope. Every technique here assumes you have written permission to execute these actions on target systems. Document what you clear and when -- your engagement report must account for artifacts you destroyed so the blue team can rebuild their detection baseline.
Quick Workflow
- Enumerate logging infrastructure before executing payloads -- identify what generates evidence.
- Disable or blind telemetry sources (ETW, Sysmon, auditd) at the earliest safe opportunity.
- Execute your operation with minimal footprint using in-memory techniques where possible.
- Manipulate timestamps on any files you touched to blend with surrounding filesystem activity.
- Clear or edit logs selectively -- wholesale deletion is noisier than surgical modification.
- Remove memory artifacts if you have reason to believe live forensics will occur.
- Validate your cleanup by checking the same artifacts a forensic analyst would examine.
Windows Event Log Clearing
Windows Event Logs are the primary evidence source on Windows targets. The Security, System, PowerShell, and Sysmon/Operational channels record authentication, process creation, and command execution events.
Wevtutil Approach
Clear specific channels rather than all logs to reduce the blast radius of your cleanup.
