PowerShell Logging

The subject deliberately deletes logs to eliminate records of their activity and hinder subsequent investigation. This may include host-based logs (e.g., Windows Event Logs, Linux audit logs), application logs (e.g., authentication or access records), or network-level logs (e.g., firewall or proxy logs).

Deletion may be selective by targeting specific time ranges, event types, or identifiers, or more broad by wiping entire log files or directories to prevent attribution or timeline reconstruction.

Native application misuse occurs when a subject uses applications, services, binaries, scripts, or administrative utilities already present on a corporate endpoint or server to support, conceal, or facilitate an infringement without introducing new software. This may include exploring built-in operating system/command line tools, approved productivity applications, scripting environments, messaging clients, compression utilities, remote access components, cloud storage integrations, or endpoint management features to identify capabilities that can be repurposed for unauthorized outcomes.

The anti-forensics significance of this behavior is that the subject’s activity may appear consistent with legitimate operational use. Unlike the installation of unauthorized tools or overt malware, native application misuse relies on capabilities that are already trusted, allowed, or commonly present in the environment. This can make it difficult for investigators to distinguish legitimate activity from illegitimate activity without strong context, baseline comparison, command-line visibility, file access history, and correlation with the subject’s role, timing, intent, and surrounding investigative indicators.

A subject may deliberately elect to use a more complicated or convoluted method to achieve an illegitimate outcome when that method relies on native applications or approved services. In these cases, the subject may avoid introducing external software even where doing so would make the task faster, simpler, or more technically effective. The investigative significance is that the inefficient method may itself be purposeful: by operating through trusted tools already present on the endpoint, the subject reduces the number of distinct control violations, avoids software-installation indicators, and makes the activity harder to separate from legitimate business use.

This behavior may contribute to or facilitate an infringement by allowing a subject to stage, compress, transfer, hide, rename, encode, delete, alter, or access data using tools that do not independently appear suspicious. It may also support behavioral drift where repeated minor misuse of approved tools becomes normalized within a team or population, reducing the organization’s ability to identify meaningful deviations from acceptable use.

Investigative Relevance

Native application misuse should be assessed in relation to the subject’s role, normal working patterns, endpoint baseline, approved business processes, and the sensitivity of the data involved. Investigators should avoid treating native tool execution as inherently suspicious. The investigative concern arises when the subject uses ordinary capabilities in unusual combinations, at unusual times, against unusual data, or in ways that produce outcomes inconsistent with their duties.

Investigators should consider whether the subject’s chosen method appears unnecessarily complex when compared with easier external tooling options. Where a subject uses native applications in a slower, more manual, or more indirect manner, that choice may indicate an intent to preserve plausible legitimacy, avoid detection associated with unauthorized software, or obscure the behavioral sequence required to prove intent.

Relevant case logic may include:

• A subject using built-in archive, scripting, browser, synchronization, or file management capabilities shortly before data loss, unauthorized access, or sabotage.
• A subject performing repeated exploratory activity against native utilities, administrative consoles, local services, or corporate applications that are not required for their role.
• A subject using approved tools to perform actions more commonly associated with staging, concealment, bulk collection, transfer, or destruction.
• A subject’s activity remaining below traditional software-control thresholds because no new executable, installer, or external application was introduced.
• A pattern of activity that appears individually explainable but collectively supports preparation, infringement, or anti-forensic concealment.

Example Behaviors

• Using built-in compression or archive utilities to stage sensitive files before transfer.
• Using PowerShell, shell scripts, command prompt, Terminal, or Windows Subsystem for Linux to enumerate, copy, encode, delete, or modify files.
• Using corporate browsers, browser profiles, or approved extensions to access unsanctioned services without installing additional tools.
• Using approved cloud synchronization clients to move files into locations that are less visible to standard file-share auditing.
• Using native search, indexing, preview, or document history features to locate sensitive material outside normal workflow.
• Using operating system rename, timestamp, metadata, recycle bin, clipboard, print-to-PDF, screenshot, or export functions to alter the appearance, location, or traceability of data.
• Using existing remote access, collaboration, or screen-sharing services to view, transfer, or disclose information under the appearance of legitimate work activity.
• Using scheduled tasks, launch agents, login items, shortcuts, or automation features already present on the endpoint to repeat activity without installing new software.

A subject clears PowerShell command history to prevent executed commands from being reviewed, disclosing information about the subject’s activities.

PowerShell stores command history in the context of a user account. This file is located at C:/Users/%username%/AppData/Roaming/Microsoft/Windows/PowerShell/PSReadline.

A subject can delete their own PSReadline file without any special permissions.

A subject may attempt to use the Clear-History Cmdlet, however this will only clear commands from the current session, does not affect the PSReadline history file.

A subject clears Windows Event logs to conceal evidence of their activities.

Windows Event Logs store various types of information, such as system errors, application events, security auditing messages, and other operational events.

The logs are stored in C:/WINDOWS/system32/config.

Windows Event Logs can be cleared using the Event Viewer utility, provided the user account has administrative privileges.

A subject installs custom software or malware on an endpoint, potentially disguising it as a legitimate process. This software includes tripwire logic to monitor the system for signs of security activity.

The tripwire software monitors various aspects of the endpoint to detect potential investigations:

• Security Tool Detection: It scans running processes and monitors new files or services for signatures of known security tools, such as antivirus programs, forensic tools, and Endpoint Detection and Response (EDR) systems.
• File and System Access: It tracks access to critical files or system directories (e.g., system logs, registry entries) commonly accessed during security investigations. Attempts to open or read sensitive files can trigger an alert.
• Network Traffic Analysis: The software analyzes network traffic to identify unusual patterns, including connections to Security Operations Centers (SOC) or the blocking of command-and-control servers by network security controls.
• User and System Behavior: It observes system behavior and monitors logs (such as event logs) that indicate an investigation is in progress, such as switching to an administrative account or modifying security settings (e.g., enabling disk encryption, changing firewall rules).

Upon detecting security activity, the tripwire can initiate various evasive responses:

• Alert the Subject: It covertly sends an alert to an external server controlled by the subject, using common system tools (e.g., curl, wget, or HTTP requests).
• Modify Endpoint Behavior: It can terminate malicious processes, erase evidence (e.g., logs, browser history, specific files), or restore system and network configurations to conceal signs of tampering.

The subject deploys a Remote Access Tool (RAT): a software implant that provides covert, persistent remote control of an endpoint or server—enabling continued unauthorized access, monitoring, or post-employment re-entry. Unlike sanctioned remote administration platforms, RATs are deployed without organizational oversight and are often configured to obfuscate their presence, evade detection, or blend into legitimate activity.

RATs deployed by insiders may be off-the-shelf tools (e.g. njRAT, Quasar, Remcos), lightly modified open-source frameworks (e.g. Havoc, Pupy), or commercial-grade products repurposed for unsanctioned use (e.g. AnyDesk, TeamViewer in stealth mode). 

Functionality typically includes:

• Full GUI or shell access
• File system interaction
• Screenshot and webcam capture
• Credential harvesting
• Process and registry manipulation
• Optional keylogging and persistence modules

Deployment methods include manual installation, script-wrapped droppers, DLL side-loading, or execution via LOLBins (mshta, rundll32). Persistence is typically achieved through scheduled tasks, registry run keys, or disguised service installations. In some cases, the RAT may be configured to activate only during specific windows or respond to remote beacons, reducing exposure to detection.

The subject deploys destructive malware; software designed to irreversibly damage systems, erase data, or disrupt operational availability. Unlike ransomware, which encrypts files to extort payment, destructive malware is deployed with the explicit intent to delete, corrupt, or disable systems and assets without recovery. Its objective is disruption or sabotage, not necessarily for direct financial gain.

This behavior may include:

• Wiper malware (e.g. HermeticWiper, WhisperGate, ZeroCleare)
• Logic bombs or time-triggered deletion scripts
• Bootloader overwrite tools or UEFI tampering utilities
• Mass delete or format scripts (format, cipher /w, del /s /q, rm -rf)
• Data corruption utilities (e.g. file rewriters, header corruptors)
• Credential/system-wide lockout scripts (e.g. disabling accounts, resetting passwords en masse)

Insiders may deploy destructive malware as an act of retaliation (e.g. prior to departure), sabotage (e.g. to disrupt an investigation or competitor), or under coercion. Detonation may be manual or scheduled, and in some cases the malware is disguised as routine tooling to delay detection.

Destructive deployment is high-severity and often coincides with forensic tampering or precursor access based infringements (e.g. file enumeration or backup deletion).

A subject may leverage the Windows Background Intelligent Transfer Service (BITS) to exfiltrate organizational data in a covert and resilient manner. BITS is a native Windows component designed to transfer files asynchronously over HTTP or SMB, typically used by system processes such as updates and patch delivery. Its trusted status, ability to throttle bandwidth, and support for job persistence make it an attractive mechanism for stealthy data exfiltration.

In this infringement method, the subject creates or modifies a BITS job, either via native utilities (e.g., bitsadmin, PowerShell cmdlets) or custom tooling, to upload sensitive files to an external endpoint under their control. Transfers may be disguised as legitimate background activity, leveraging standard ports and protocols to blend with normal system traffic.

BITS jobs can persist across reboots, retry on failure, and operate with minimal user interaction, allowing the subject to stage and gradually exfiltrate data over extended periods. In some cases, the subject may combine BITS with obfuscation techniques, such as renaming payloads, encrypting data prior to transfer, or using subject-controlled infrastructure that mimics legitimate services.

This technique is particularly effective in environments where outbound traffic is loosely controlled and where native Windows services are implicitly trusted, reducing the likelihood of immediate detection.

• Examples of Use
  A subject creates a BITS job using PowerShell to upload archived project files to an external HTTP server hosted on a personal VPS.
• A subject schedules a recurring BITS transfer that periodically sends collected documents to a remote endpoint, using low bandwidth to avoid triggering alerts.
• A subject modifies an existing BITS job to include additional file uploads to an attacker-controlled domain, blending activity with legitimate system update traffic.

The subject uses command-line tools such as curl, wget, or PowerShell (Invoke-WebRequest, Invoke-RestMethod) to retrieve files directly from remote sources. This method enables automation, scripting, and execution without user interface interaction. 

Command-line downloads often indicate a higher level of intent or technical capability and may bypass browser-based controls. They are commonly used to retrieve payloads, stage tooling, or integrate downloads into scripted workflows.

The subject downloads files through remote session tools or file transfer mechanisms such as RDP drive mapping, SCP, SFTP, or remote desktop clipboard/file transfer features.