4. Clear Logs to hide the Evidence of Compromise

1. View, Edit and clear Audit Policies using Auditpol

Auditpol.exe is the command-line utility tool to change the Audit Security settings at the category and sub-category levels. You can use Auditpol to enable or disable security auditing on local or remote systems and to adjust the audit criteria for different categories of security events. In real-time, the moment intruders gain administrative privileges, they disable auditing with the help of auditpol.exe. Once they complete their mission, they turn auditing back on by using the same tool (audit.exe).

See all audit policies

auditpol /get /category:*

To set an auditing policy

auditpol /set /category:"system","account logon" /success:enable /failure:enable

To clear all audit policies

auditpol /clear /y

2. Clear windows logs using different utilities

Bat Script

Download the script and run as administrator.

wevtutil el

list event logs

wevtutil el

To clear a single log

wevtutil cl system  \\system is the log name

To clear all logs

for /F "tokens=*" %1 in ('wevtutil.exe el') DO wevtutil.exe cl "%1"

Cipher (Overwrite deleted files)

cipher /w:c:

3. Clear Linux logs using bash shell

Disable history keeping

export HISTSIZE=0

To clear bash history

history -c

clear history of existing shell only

history -w

shred the history without clearing

shred ~/.bash_history

to view history file

more ~/.bash_history

First shred history file and then clear it.

shred ~/.bash_history && cat /dev/null>.bash_history && history -c && exit

4. Hiding Artifacts in Windows and Linux

Windows

create a dir

mkdir test

Hide a folder in windows

attrib +h +r +s test

To unhide a folder in windows

attrib -s -h -r test

Hide user accounts in windows

net user test /add
net user test /active:yes
net user test /active:no      \\hides the account

Linux

Create a file with . to hide a file. Ti view the hidden files

ls -la

5. Clear window logs using CCleaner

We need the pro trial version. You can go to custom clean and clean everything as you desire.

Previous3. Maintain access and hide malicious activitiesNextModule 7. Malware Threats

Last updated