We reach the last lesson of Module 5, and also the most delicate to frame. "Covering tracks" is what a real attacker does at the end of an intrusion: erasing or tampering with the records so the victim cannot know what happened, when, or how. In a professional course this is not taught as a tutorial for escaping an investigation. It is taught the other way around: so that the defender knows which anti-forensic techniques exist, why they are used, and —this is the star— how to guarantee the integrity and traceability of their records so that erasure does not work. The pentester studies these techniques for two legitimate reasons: (a) to test whether TechNova's SOC detects them, if the RoE covers it, and (b) to recommend log integrity controls in the report.

And here is the most important statement of the lesson, which must be crystal clear: the professional pentester does NOT hide their activity from the client. On the contrary, they keep an auditable record of all their actions —engagement log, timestamps, documented artifacts (recall 05-02)— and hand it over. They do not erase logs "to come out clean"; they leave a trail on purpose so TechNova can reconstruct exactly what they did. Anti-forensic techniques are used only as a controlled test of detection, never to deceive the client or to evade a real investigation. With that rule up front, let us begin.

1. Anti-forensics: what it is and why an attacker uses it
2. Why the professional pentester leaves a trail (and does not hide it)
3. Anti-forensic techniques (so the defender knows them)
4. The defensive side, as protagonist: integrity and traceability
5. Centralized forwarding and immutable logging (WORM)
6. Testing the SOC's detection, if the RoE covers it
7. Common mistakes and tips (including ethical ones)
8. Exercises
9. Conclusion

Anti-forensics encompasses the techniques that hinder or prevent a forensic investigation: erasing logs, altering timestamps, wiping histories, removing artifacts. A real attacker uses them for one reason: to buy time and deny evidence. If the response team cannot tell when they got in, what they touched, or from where, containment and attribution become far harder.

For the defender, the conclusion is direct and shapes the whole lesson: if the evidence lives only on the host the attacker controls, the attacker can destroy it. Robust defense consists in the evidence not depending on the compromised host. That is the thread running through everything that follows.

It is worth stressing this before looking at any technique, because it marks the difference between a professional and an intruder:

• Traceability for the client: TechNova must be able to reconstruct every action of the pentester. That is why an engagement log is kept with times, relevant commands, hosts touched, and artifacts created (the same ones that in 05-02 are documented and reverted).
• Legal and scope safety: the auditable trail proves that the pentester stayed within scope. Erasing it would destroy their own alibi and would be, in itself, a serious bad practice.
• Not contaminating a real investigation: if during the engagement the activity of a genuine attacker appeared, the pentester must not erase anything—they must preserve the evidence and raise the alarm. Tampering with logs could destroy proof of a real incident.
• The value is in detection, not in stealth: the goal is not "to go unseen" but to measure TechNova's ability to see you. Hiding by default runs against the engagement.

In short: the pentester leaves traces on purpose. The techniques in this topic are studied in order to defend against them, not to practice them against the client.

The defender cannot detect what they do not understand. This table catalogs the techniques —what they are, why an attacker would use them, and, as protagonist, how the defender neutralizes them. There are no operational destruction commands: the focus is defense.

The pattern, again: each technique attacks the local evidence, and each defense consists in having the evidence out of the host's reach or in detecting the attempt to tamper with it.

Here is the heart of the lesson. For covering tracks not to work, TechNova needs to guarantee two properties of its records:

• Integrity: that a log cannot be altered or erased without it being noticed. Achieved with immutable storage, chained signatures/hashes, and strict access controls.
• Traceability: that it is possible to reconstruct who did what and when, from start to finish. Achieved with complete logging, reliable timestamps (NTP), and correlation in the SIEM.

The key idea, visually: as soon as an event is generated, it leaves the host toward a central SIEM the attacker does not control. Even if they later erase the local logs, the copy is already safe and, moreover, their erasure attempt may have triggered an alert. The compromised host is treated as an untrusted source—the same principle we saw against rootkits in 05-02.

The two technical measures that hold up everything above, with the counterpart as protagonist:

Centralized log forwarding. Each host sends its events, as they are generated, to a central collector/SIEM. This way the evidence stops living only where the attacker can touch it.

With this single line, local deletion loses almost all its value: the events are already replicated off-host. Immutable logging / WORM (Write Once Read Many) goes a step further: the SIEM storage is configured so that records, once written, cannot be modified or erased during a retention period —not even by a compromised administrator. Adding hash chaining (each block of logs signs the previous one) also makes it possible to prove there has been no tampering: if a record changes, the hash chain breaks and the alert fires.

• Centralized forwarding → the evidence survives local deletion.
• WORM / immutable retention → the evidence cannot be altered even if the SIEM is compromised.
• Hash chaining / signatures → any tampering is detectable.
• Reliable NTP → the timestamps are coherent and timestomping gives itself away.

When the contract includes evaluating the response capability (sometimes as a purple team exercise), the pentester can trigger in a controlled way the signals an attacker would generate —always documented and traceable— to check whether TechNova detects them:

• Generate an auditing service stop event and verify whether the SIEM alerts on the silence.
• Modify a file watched by integrity (FIM) and check whether the alert fires.
• Attempt (in a test environment) to delete a local log already forwarded and confirm that the central copy remains intact.

The result —detected or not— is a report finding: if the SOC does not see the logging stop or the tampering of a file, that is a concrete improvement recommendation. All of this is done with the activity recorded in the engagement log, not in secret: the pentester tests detection, they do not hide from it.

• [Ethical] Erasing logs to "come out clean". This is bad practice par excellence: it destroys the traceability the client needs and your own scope alibi. The pentester leaves an auditable trail, they do not erase it.
• [Ethical] Tampering with records during a real incident. If a genuine attacker appears, preserve the evidence and raise the alarm; erasing or altering anything could destroy proof of a crime.
• [Ethical] Treating anti-forensics as an offensive skill to show off. In this course it is defensive knowledge: it serves so TechNova detects and resists these techniques, not to run them against it.
• Trusting the compromised host's logs. A taken host is an untrusted source; the valid evidence is the one already in the central SIEM. Design the defense assuming this.
• Centralizing logs without protecting them. Forwarding to the SIEM is good, but without WORM or access control an attacker with SIEM access could erase them there. Add immutability and hash chaining.
• Forgetting NTP. Without synchronized time, correlating events across hosts is chaos and timestomping is harder to detect. Synchronize time across the whole network.
• Tip: when you test detection, notify the contact and coordinate with the blue team (purple team approach). The shared goal is to improve TechNova's detection, not to catch anyone out.

Exercise 1. An attacker who has compromised TechNova's internal server deletes /var/log/auth.log to hide their SSH access. Explain why, if TechNova has its logging architecture well set up, this deletion accomplishes little. Describe the two concrete defensive measures that neutralize it and what role WORM storage plays.

Exercise 2. TechNova's RoE includes testing the SOC's detection capability. Design a controlled and traceable test to verify whether the SOC detects log tampering, state what evidence you would capture, and why this activity does not contradict the principle that the pentester leaves an auditable trail.

Exercise 3. Explain, in your own words, why a professional pentester does not hide their activity from the client even though they technically know how to, and what they keep instead. Relate it to the golden rule of lesson 05-02 about artifacts.

Solution 1. The deletion accomplishes little because, with a correct architecture, the auth.log events have already been forwarded in real time to a central SIEM off the host: erasing the local copy does not remove the central one. Measures: (1) centralized log forwarding (e.g., rsyslog sending to siem.technova.lab over TCP), so the evidence leaves the host as soon as it is generated; (2) an alert on tampering/silence —the deletion attempt itself, or the stopping of the logging service, is a signal the SIEM detects. WORM storage guarantees that, once in the SIEM, records cannot be modified or erased during retention —not even by a compromised administrator— so the evidence is at once durable and intact; adding hash chaining makes it possible to prove there was no tampering.

Solution 2. Controlled test: coordinated with the technical contact (purple team approach), modify a file watched by file integrity (FIM) and/or generate an auditing service stop on a test host, and observe whether the SIEM/SOC alerts; optionally, delete a local log already forwarded and confirm that the central copy remains intact. Evidence: the exact time of each action, the alert generated (or its absence), and the comparison between the local log and the central one. It does not contradict the auditable-trail principle because the whole test is documented in the engagement log and coordinated with the client: the pentester does not erase to hide, but triggers signals in a traceable way to measure detection; whether or not the SOC detects it, the result is a report finding with its recommendation.

Solution 3. A professional pentester does not hide their activity because their engagement is to help the client defend itself, not to beat it: they need TechNova to be able to reconstruct every action in order to verify they stayed within scope, to learn from the simulation, and not to contaminate a possible real investigation. Hiding would destroy the traceability, their own scope alibi, and the value of the exercise. Instead they keep an auditable record: an engagement log with times, relevant commands, hosts touched, and artifacts created. This ties directly into the golden rule of 05-02: every artifact (account, task, key, webshell) is documented and reverted, handing the client the complete list. Leaving a trail and reverting artifacts are two sides of the same professional ethic: nothing hidden, everything traceable, everything returned.

We have closed Module 5 with the lesson that best sets a professional apart: covering tracks, taught from the defensive side. We saw which anti-forensic techniques exist —log tampering and deletion, timestomping, history wiping, artifact cleanup— and why an attacker uses them, but the protagonist was the defensive side: guaranteeing the integrity and traceability of records with centralized forwarding, immutable logging (WORM), hash chaining, NTP, and tampering alerts, always treating the compromised host as an untrusted source. And we made crystal clear the rule that governs the whole module: the pentester does not hide their activity; they leave an auditable trail, document and revert every artifact, and use these techniques only to test the SOC's detection if the RoE covers it.

With this, post-exploitation ends. Throughout the module we escalated privileges (05-01), understood persistence in a controlled way (05-02), measured reach across the network (05-03), and now secured traceability (05-04). At every step the mandate was the same: capture evidence —commands, outputs, timestamps, artifacts, the compromise chain, the internal network map— cleanly and documented. That evidence is not the end: it is the raw material of Module 6: Reporting and Remediation. Everything we captured in an authorized and controlled way now becomes the report: findings are documented (06-01), classified by risk with CVSS (06-02), remediations are proposed (06-03), and results are presented (06-04). The technical work is done; the work of turning it into value for TechNova begins.