Clearing Tracks On Windows

Clear Uploaded Data

Always upload data to the temporary directory: C:\Temp and remove its content once the audit is finished.

Remove Persistence Services

Once the audit is finished, delete any persistence service created during the audit. Use cleanup Meterpreter RC file if the used module has generated one:

# From a Meterpreter session
resource PATH_TO_THE_RESOURCE_SCRIPT

Clearing Windows Event Logs

Event logs are categorized based on the type of events they store: - Application logs: they store application/program events like startups, crashes, etc. - System logs: they store events like startups, reboots, etc. - Security logs: they store security events like password changes, authentication failures, etc.

Event logs can be accessed via the Event Viewer.

Clearing Event logs with Meterpreter

From the Meterpreter session, invoke the command clearev.