No Cover-Tracks Crime
Explicit refusal — log tampering, anti-forensics, and 'covering tracks' are out of scope and unethical.
Visual · t19_no_cover_tracks
Cover tracks = refused. Defender logging is protected. Original Cyberlium.
Clearing event logs on a system you do not own is not pentest — it is evidence destruction.
Cyberlium explicitly refuses teaching or endorsing anti-forensics for crime: clearing Windows Event Logs, deleting bash history on unauthorized hosts, timestomping, disabling EDR/SIEM, ransomware, or 'covering tracks' on production or stranger systems. Authorized pentests document actions with timestamps for blue team — they do not hide from defenders on systems outside agreed rules. On $LAB_VM you may revert snapshot instead of stealth. Defenders: immutable logging, centralized SIEM, and integrity monitoring on critical systems. If a tutorial teaches log wiping for 'OPSEC,' stop — that is out of Cyberlium scope and often illegal outside your own disposable lab revert.
1. What we refuse
Log clearing, audit disable, EDR kill, ransomware staging, destructive wiper behavior on any non-disposable target.
Framing crime tradecraft as 'advanced pentest' — refused in course and capstone.
Command guide
Try these commands — What we refuse
═══ LINUX / KALI (Penetration Testing & Service Audit) ═══
Port scan and service banner grabbing against authorized target
Command — copy this
nmap -sV -sC -Pn -T4 -p 21,22,80,443,445,3389 ${LAB_HOST:-127.0.0.1}Enumerate web directories and hidden endpoints
Command — copy this
gobuster dir -u http://${LAB_HOST:-127.0.0.1} -w /usr/share/wordlists/dirb/common.txt -q -t 20 2>/dev/null || head -5 /etc/hostsMetasploit framework module inspection (Safe lab syntax)
Command — copy this
msfconsole -q -x "use auxiliary/scanner/portscan/tcp; set RHOSTS 127.0.0.1; set PORTS 80,443; run; exit" 2>/dev/null || echo "Run in Kali msfconsole"
═══ WINDOWS (Audit Target) ═══ Enumerate open listening ports with process mappings
Command — copy this
netstat -ano | findstr /i "LISTENING"
Primary tools to practice this lesson: python3, curl. Reference sites: Evidence collection; No log wiping. Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Authorized alternative
Document your lab actions in notes with UTC timestamps for mentor review.
Revert $LAB_VM snapshot — replaces need for anti-forensics on disposable images.
3. Defender priority
Centralized logging, WORM storage, alerting on log clear events (T1070), EDR tamper protection.
Purple-team exercises improve detection — not hide from it on stranger nets.
4. What you ship: cover-tracks refusal statement
Signed refusal paragraph + authorized lab alternative + defender logging note.
5. What you record before the next lesson
Refusal statement path.
6. Wrong vs right: stranger nets vs YOUR lab VMs
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
- Wrong: Clear Security logs on employer server 'to test blue team.'
- Right: Refusal written. Next: Post-Ex Lab.
Mission: refusal statement
1) List three refused anti-forensics actions. 2) Write snapshot-revert alternative for $LAB_VM. 3) Name T1070 as defender detection literacy.
Stuck? Ask Cyberlium AI Mentor
Ask Mentor: “Purple team vs hiding from SIEM?”
APPLY: Clearing logs on unauthorized hosts:
APPLY: True or False: Cover-tracks modules on production are pentest.
APPLY: Lab alternative to anti-forensics: