Offensive Anti-Forensics skill: install, scope and safe use

What the skill covers

The skill is a playbook on anti-forensics for red team engagements. Its source describes techniques for Windows and Linux event logs, timestamp manipulation, filesystem and disk artifacts, memory artifacts, network forensics evasion, and anti-VM and sandbox detection.

It aligns to MITRE ATT&CK T1070 (Indicator Removal), T1027 (Obfuscated Files or Information) and T1497 (Virtualization/Sandbox Evasion). According to the source, each technique names the forensic artifact it targets and includes a defender perspective, so operators can see which detection gaps remain.

How to install the skill

Download the skill ZIP from our page and unzip it. The package contains SKILL.md. For a personal install, place the unzipped folder in ~/.claude/skills/. For a single project, place it in that project's .claude/skills/ folder.

You can also upload the skill in the Claude apps under Settings, then Capabilities, then Skills.

• Personal install: ~/.claude/skills/
• Project install: .claude/skills/ inside your project
• Claude apps: Settings, Capabilities, Skills, then upload

How to trigger the skill with a request

Agent skills are loaded when a request matches their description. State your authorized context and the defensive goal in plain language, for example asking what a client's logging would reveal about a given activity, or asking for the defender's view of a technique.

Name the scope too. A request that mentions the client, the engagement and the systems in scope gives the agent the context the skill expects.

• Ask for the defender view of a technique to plan a detection-gap assessment
• Ask which artifacts a given technique leaves for a training course on T1070
• State that the engagement is authorized and name the systems in scope

What you need before using it

The skill's listing says it is for Windows and/or Linux targets where you have administrator or root access. It references the tools Timestomp, wevtutil, sdelete, shred, MimiPenguin and Invoke-Phant0m, plus a compiled utmp editor written in C. It also requires written authorization for the engagement.

The listing states that the skill runs scripts and does not use the network.

• Windows and/or Linux target systems with administrator or root access
• Tools referenced in the file: Timestomp, wevtutil, sdelete, shred, MimiPenguin, Invoke-Phant0m, and a compiled utmp editor
• Written authorization for the engagement

Safety notes before you use it

The techniques described in the skill destroy or alter evidence. The listing says they are illegal against systems you do not own or have permission to test, and that commands can permanently remove records and damage system logging.

The skill's own guidance is to document what you clear and when, so the engagement report accounts for every artifact you destroyed and the blue team can rebuild its detection baseline.

• Do not use it on any system without written authorization
• Keep a record of every change so the blue team can rebuild its baseline
• Do not use it for cleanup on your own computer; the commands can cause data loss

Tips for defenders reviewing this skill

If you are a security team studying evidence destruction, use the skill's defender perspectives as a checklist. Ask whether your logs leave the host, how long they are retained, and whether your detection rules would notice the gaps the skill describes.

Trainers can use the technique categories and the ATT&CK mappings as an outline. Incident responders should note that the skill is written to defeat forensic work, so it is not a guide to preserving evidence.

• Check where logs are stored and whether they are retained off the host
• Review detection rules against each technique category listed above
• Use the ATT&CK T1070 mapping as an outline for training material