https://github.com/PaulNorman01/Forensia

Anti Forensics Tool For Red Teamers, Used For Erasing Footprints In The Post Exploitation Phase.
https://github.com/PaulNorman01/Forensia

anti-forensics evasion forensics post-exploitation redteam

Last synced: 2 months ago
JSON representation

Anti Forensics Tool For Red Teamers, Used For Erasing Footprints In The Post Exploitation Phase.

• Host: GitHub
• URL: https://github.com/PaulNorman01/Forensia
• Owner: PaulNorman01
• License: gpl-3.0
• Created: 2022-12-07T14:45:52.000Z (about 2 years ago)
• Default Branch: main
• Last Pushed: 2023-06-23T23:23:22.000Z (over 1 year ago)
• Last Synced: 2024-08-04T22:15:07.479Z (6 months ago)
• Topics: anti-forensics, evasion, forensics, post-exploitation, redteam
• Language: C++
• Homepage:
• Size: 104 KB
• Stars: 721
• Watchers: 15
• Forks: 75
• Open Issues: 4
• Metadata Files:
  • Readme: README.md
  • License: LICENSE

Awesome Lists containing this project

• awesome-anti-forensic - Forensia

README

        
# Forensia

**Anti Forensics Tool For Red Teamers, Used For Erasing Some Footprints In The Post Exploitation Phase.**

Reduces Payload Burnout And Increases Detection Countdown. Can Be Used To Test The capabilities of Your Incident Response / Forensics Teams.

## Capabilities

* Unloading Sysmon Driver.

* Gutmann Method File Shredding.

* USNJrnl Disabler.

* Prefetch Disabler.

* Log Eraser and Event log Disabler.

* User Assist Update Time Disabler.

* Access Time Disabler.

* Clear Recent Items

* Clear Shim Cache

* Clear RecentFileCache

* Clear ShellBag

* Delete Windows Defender Quarantine Files

* File Melting Capabilities.

![Screenshot](forensia.png)

## Important Update

Added:

* Clear Recent Items

* Clear Shim Cache

* Clear RecentFileCache

* Clear ShellBag

* Clear Quanatine Files

## TODO

- [ ] USNJRnl Execution On All Disk Drives.

- [ ] Unallocated Space ReWriting.

- [x] A Bit of Polishing.

## Credits

https://github.com/Naranbataar/Corrupt

https://github.com/LloydLabs/delete-self-poc

https://github.com/OsandaMalith/WindowsInternals/blob/master/Unload_Minifilter.c

https://stackoverflow.com/users/15168/jonathan-leffler

https://github.com/GiovanniDicanio/WinReg