Insider Threat Matrix™
Search
Waiting/typing...
DT/PV
Chains
Sponsors
More
Detections
Preventions
Chains
Sponsors
About Us
Contributors
GitHub
Anti-Forensics
Account Misuse
Account Obfuscation
Unauthorized Credential Use
Clear Browser Artifacts
Clear Chrome Artifacts
Clear Edge Artifacts
Clear Firefox Artifacts
Clear Email Artifacts
Auto-Forwarding Rule Deletion
Email Deletion
Inbox Rule Deletion
Shared Mailbox Deletion
Code Contribution Obfuscation and Misrepresentation
Concealment of Functionality Within Benign Changes
Fragmentation of Functionality Across Contributions
Misleading Contribution Description
Decrease Privileges
Delayed Execution Triggers
Delete User Account
Delete Local Linux User
Delete Local Mac User
Delete Local Windows User
Delete Windows Active Directory User
Deletion of Volume Shadow Copy
Disk Wiping
Disk Content Wiping
Disk Structure Wiping
File Deletion
File Encryption
Hide Artifacts
Hidden File System
Hidden Files and Directories
Hide Emails With Rules
Hiding or Destroying Command History
Clear Bash History
Clear PowerShell History
PYTHONHISTORY Environment Variable Null
Log Deletion
Clear Linux System Logs
Clear macOS System Logs
Clear Windows Event Logs
Log Modification
Message Deletion
Deletion of Corporate Communication Messages
Deletion of Non-Corporate Communication Messages
Modify Windows Registry
Delete or Modify Registry Key
Delete or Modify Registry Key Value
Disabling Application Launch Tracking via Registry
Network Obfuscation
Browser or System Proxy Configuration
Switching to Unmonitored Networks
Unauthorized VPN Usage
Use of Browser-Based VPN Extensions
Physical Destruction of Storage Media
Physical Destruction of Disk Storage
Physical Destruction of Removable Media
Physical Removal of Disk Storage
Stalling
Authorized Leave
Connectivity Obstruction
Lack of Communication
Powering Off Devices
Refusal to Return Organizational Devices
Unauthorized Leave
Steganography
Image Steganography
System Shutdown
Timestomping
Tripwires
Canary Tokens
Endpoint Tripwires
Environment Tripwires
Uninstalling Software
Virtualization
Portable Hypervisors
Snapshots and Rollbacks to Remove Evidence
Use of a Virtual Machine
Use of Windows Subsystem for Linux (WSL)
Windows System Time Modification
Home
-
AR5
ID: AR5
Created: 22nd May 2024
Updated: 23rd April 2025
Anti-Forensics
The actions undertaken by a subject to frustrate any subsequent investigation.
Sections (28)