PowerShell Logging

The subject deliberately deletes logs to eliminate records of their activity and hinder subsequent investigation. This may include host-based logs (e.g., Windows Event Logs, Linux audit logs), application logs (e.g., authentication or access records), or network-level logs (e.g., firewall or proxy logs).

Deletion may be selective by targeting specific time ranges, event types, or identifiers, or more broad by wiping entire log files or directories to prevent attribution or timeline reconstruction.

The subject uses applications, binaries, scripts, services, or administrative utilities already trusted or commonly present within the organizational environment to support or conceal an infringement without introducing new software.

Trusted tool misuse may involve operating system utilities, command and scripting environments, archive tools, managed browsers, synchronization clients, productivity applications, remote management components, or administrative consoles. Because these capabilities are routinely used for legitimate purposes, the subject’s activity may avoid software installation alerts, application control restrictions, and indicators associated with unfamiliar executables.

The anti-forensic significance arises where the subject deliberately selects a trusted capability to reduce detection, obscure intent, or make unauthorized activity appear consistent with normal operational use. Investigators should assess the subject’s role, command-line activity, file access, timing, tool combinations, and surrounding investigative indicators. The execution of a trusted tool should not be treated as inherently suspicious.

Example Behaviors

• Using a signed operating-system binary to execute unauthorized code while avoiding controls focused on unknown executables.
• Using PowerShell, Windows Command Shell, Terminal, or a Unix shell to collect, copy, encode, alter, or remove information.
• Using a built-in archive utility to stage sensitive files without installing external compression software.
• Using an approved browser, synchronization client, collaboration platform, or cloud service to transfer information through activity that resembles routine business use.
• Using native screenshot, clipboard, print, preview, export, or file-management functions to collect or alter information without specialist tooling.
• Using a trusted administrative utility or indirect execution pathway to perform unauthorized activity while reducing distinct control violations.
• Using scheduled tasks, launch agents, login items, shortcuts, or existing automation features to repeat activity without introducing new software.

The subject gathers technical information about an organizational system to understand its operating environment and to assess how it may support subsequent activities. Information collected may include the system name, operating system, version, architecture, hardware configuration, firmware or BIOS details, patch level, installed hotfixes, and other characteristics that identify the system’s capabilities or technical state.

System profiling is preparatory where the information allows the subject to select compatible tools, identify potential weaknesses, assess the suitability or value of the system, or plan subsequent access, privilege elevation, persistence, security control circumvention, or infringement.

A subject clears PowerShell command history to prevent executed commands from being reviewed, disclosing information about the subject’s activities.

PowerShell stores command history in the context of a user account. This file is located at C:/Users/%username%/AppData/Roaming/Microsoft/Windows/PowerShell/PSReadline.

A subject can delete their own PSReadline file without any special permissions.

A subject may attempt to use the Clear-History Cmdlet, however this will only clear commands from the current session, does not affect the PSReadline history file.

A subject clears Windows Event logs to conceal evidence of their activities.

Windows Event Logs store various types of information, such as system errors, application events, security auditing messages, and other operational events.

The logs are stored in C:/WINDOWS/system32/config.

Windows Event Logs can be cleared using the Event Viewer utility, provided the user account has administrative privileges.

A subject installs custom software or malware on an endpoint, potentially disguising it as a legitimate process. This software includes tripwire logic to monitor the system for signs of security activity.

The tripwire software monitors various aspects of the endpoint to detect potential investigations:

• Security Tool Detection: It scans running processes and monitors new files or services for signatures of known security tools, such as antivirus programs, forensic tools, and Endpoint Detection and Response (EDR) systems.
• File and System Access: It tracks access to critical files or system directories (e.g., system logs, registry entries) commonly accessed during security investigations. Attempts to open or read sensitive files can trigger an alert.
• Network Traffic Analysis: The software analyzes network traffic to identify unusual patterns, including connections to Security Operations Centers (SOC) or the blocking of command-and-control servers by network security controls.
• User and System Behavior: It observes system behavior and monitors logs (such as event logs) that indicate an investigation is in progress, such as switching to an administrative account or modifying security settings (e.g., enabling disk encryption, changing firewall rules).

Upon detecting security activity, the tripwire can initiate various evasive responses:

• Alert the Subject: It covertly sends an alert to an external server controlled by the subject, using common system tools (e.g., curl, wget, or HTTP requests).
• Modify Endpoint Behavior: It can terminate malicious processes, erase evidence (e.g., logs, browser history, specific files), or restore system and network configurations to conceal signs of tampering.

The subject deploys a Remote Access Tool (RAT): a software implant that provides covert, persistent remote control of an endpoint or server—enabling continued unauthorized access, monitoring, or post-employment re-entry. Unlike sanctioned remote administration platforms, RATs are deployed without organizational oversight and are often configured to obfuscate their presence, evade detection, or blend into legitimate activity.

RATs deployed by insiders may be off-the-shelf tools (e.g. njRAT, Quasar, Remcos), lightly modified open-source frameworks (e.g. Havoc, Pupy), or commercial-grade products repurposed for unsanctioned use (e.g. AnyDesk, TeamViewer in stealth mode). 

Functionality typically includes:

• Full GUI or shell access
• File system interaction
• Screenshot and webcam capture
• Credential harvesting
• Process and registry manipulation
• Optional keylogging and persistence modules

Deployment methods include manual installation, script-wrapped droppers, DLL side-loading, or execution via LOLBins (mshta, rundll32). Persistence is typically achieved through scheduled tasks, registry run keys, or disguised service installations. In some cases, the RAT may be configured to activate only during specific windows or respond to remote beacons, reducing exposure to detection.

The subject deploys destructive malware; software designed to irreversibly damage systems, erase data, or disrupt operational availability. Unlike ransomware, which encrypts files to extort payment, destructive malware is deployed with the explicit intent to delete, corrupt, or disable systems and assets without recovery. Its objective is disruption or sabotage, not necessarily for direct financial gain.

This behavior may include:

• Wiper malware (e.g. HermeticWiper, WhisperGate, ZeroCleare)
• Logic bombs or time-triggered deletion scripts
• Bootloader overwrite tools or UEFI tampering utilities
• Mass delete or format scripts (format, cipher /w, del /s /q, rm -rf)
• Data corruption utilities (e.g. file rewriters, header corruptors)
• Credential/system-wide lockout scripts (e.g. disabling accounts, resetting passwords en masse)

Insiders may deploy destructive malware as an act of retaliation (e.g. prior to departure), sabotage (e.g. to disrupt an investigation or competitor), or under coercion. Detonation may be manual or scheduled, and in some cases the malware is disguised as routine tooling to delay detection.

Destructive deployment is high-severity and often coincides with forensic tampering or precursor access based infringements (e.g. file enumeration or backup deletion).

A subject may leverage the Windows Background Intelligent Transfer Service (BITS) to exfiltrate organizational data in a covert and resilient manner. BITS is a native Windows component designed to transfer files asynchronously over HTTP or SMB, typically used by system processes such as updates and patch delivery. Its trusted status, ability to throttle bandwidth, and support for job persistence make it an attractive mechanism for stealthy data exfiltration.

In this infringement method, the subject creates or modifies a BITS job, either via native utilities (e.g., bitsadmin, PowerShell cmdlets) or custom tooling, to upload sensitive files to an external endpoint under their control. Transfers may be disguised as legitimate background activity, leveraging standard ports and protocols to blend with normal system traffic.

BITS jobs can persist across reboots, retry on failure, and operate with minimal user interaction, allowing the subject to stage and gradually exfiltrate data over extended periods. In some cases, the subject may combine BITS with obfuscation techniques, such as renaming payloads, encrypting data prior to transfer, or using subject-controlled infrastructure that mimics legitimate services.

This technique is particularly effective in environments where outbound traffic is loosely controlled and where native Windows services are implicitly trusted, reducing the likelihood of immediate detection.

• Examples of Use
  A subject creates a BITS job using PowerShell to upload archived project files to an external HTTP server hosted on a personal VPS.
• A subject schedules a recurring BITS transfer that periodically sends collected documents to a remote endpoint, using low bandwidth to avoid triggering alerts.
• A subject modifies an existing BITS job to include additional file uploads to an attacker-controlled domain, blending activity with legitimate system update traffic.

The subject uses command-line tools such as curl, wget, or PowerShell (Invoke-WebRequest, Invoke-RestMethod) to retrieve files directly from remote sources. This method enables automation, scripting, and execution without user interface interaction. 

Command-line downloads often indicate a higher level of intent or technical capability and may bypass browser-based controls. They are commonly used to retrieve payloads, stage tooling, or integrate downloads into scripted workflows.

The subject downloads files through remote session tools or file transfer mechanisms such as RDP drive mapping, SCP, SFTP, or remote desktop clipboard/file transfer features.

The subject creates or modifies a scheduled task, cron job, system timer, or equivalent mechanism to execute unauthorized commands or code automatically at a future time or recurring interval.

The subject creates or modifies an event subscription, event handler, system hook, or equivalent trigger that executes unauthorized commands or code when specified conditions are met.

The subject uses a network-accessible administrative service or operating-system management interface to access resources, transfer content, execute commands, or perform actions on an additional organizational system without establishing an ordinary interactive desktop session.

Methods may include Server Message Block (SMB), Windows administrative shares, Distributed Component Object Model (DCOM), Windows Remote Management (WinRM), or remote Windows Management Instrumentation (WMI).

The subject bypasses, manipulates, or abuses a technical control intended to regulate elevated execution or access to protected capabilities. This may include abuse of set-user-ID or set-group-ID permissions, bypass of Windows User Account Control, manipulation of sudoers or cached sudo authorization, or alteration of platform consent and privacy controls.

This Sub-section concerns defeating or misusing the elevation control itself.

A subject conceals data within unused, ignored, optional, or non-rendered areas of a file or container so that the carrier continues to function normally while the hidden payload remains outside the content presented to the viewer.

The technique may use padding, reserved fields, unused headers, slack areas, archive comments, trailing data, application-specific metadata, or other structures retained during transfer but not normally displayed or processed. Examples include placing data after the logical end of a file, storing content in unused container fields, or exploiting differences between how applications and security tools interpret the same format.

This behavior may frustrate investigation because the visible content appears benign and the concealed data may only be identified through structural parsing, hexadecimal examination, file carving, or validation against the relevant file-format specification.