Evidence Elimination

Operational Context

Removing traces of the operation to prevent attribution and detection by incident responders.

Mission Objectives

• 1
  Wipe logs (Event Viewer/Syslog)
• 2
  Secure delete tools and payloads
• 3
  Restore modified timestamps (Timestomping)
• 4
  Remove persistence mechanisms