When using anti-forensics techniques:
- Assess the organization's susceptibility to anti-forensics techniques.
- Leverage buffer overflows to disrupt forensic tools.
- Leverage techniques like memory residents and VM detection to hide the existence or purpose of malware.
- Cover your tracks to avoid being identified or having your attack detected.
- Keep in mind that you need to deliver a report to the client and shouldn't truly hide the attack.
- Ensure you aren't causing collateral damage when covering your tracks.
- Clear, modify, or falsify event logs to mislead analysts looking for a record of malicious activity.
- Erase shell history to remove traces of the commands you executed.
- Shred or securely erase files to remove traces from the system.
- Change timestamp values in events and files to make it more difficult for analysts to formulate a coherent narrative.