Skip to content
Get packs

Offensive Anti-Forensics

Guides red team operators through hiding or destroying logs, timestamps and other forensic evidence on Windows and Linux targets.

Source Download skill
Repository
SnailSploit/Claude-Red
Stars
10,230
Licence
MIT
Files
1 file

What it does

When installed, this skill gives an AI agent detailed, step-by-step know-how for erasing or altering the traces an attack leaves behind: clearing Windows event logs, editing Linux login records, forging file timestamps, hiding data in NTFS streams, securely deleting files, and detecting virtual machines or sandboxes. It also tells the agent to explain the defender's view of each technique so operators know which detection gaps remain. It is written for authorized penetration testers and red teams, and the file itself is a playbook for evidence destruction rather than a defensive guide.

Great for

  • Authorized red team operators preparing a detection-gap assessment for a client
  • Security teams studying how attackers erase evidence so they can improve log retention and detection rules
  • Trainers building courses on anti-forensics and MITRE ATT&CK T1070 indicator removal

Skip it if

  • Anyone without written authorization: the techniques (log clearing, timestomping, disabling ETW) destroy evidence and are illegal against systems you do not own or have permission to test.
  • Incident responders or investigators, because the skill teaches how to defeat their work rather than how to preserve evidence.
  • People looking for simple cleanup of their own computer; the commands can permanently remove records and cause data loss or damage to system logging.

Try asking

  • “Walk me through the wevtutil commands for clearing Security and PowerShell logs during an authorized engagement, and what a defender would still see.”
  • “Explain how timestomping works and how an analyst would detect mismatched MFT timestamps.”
  • “Show how to detect whether my lab VM is a sandbox using anti-VM checks, and what the defender perspective is.”
  • “Create a cleanup checklist for my red team report documenting every artifact I altered and when.”
Step-by-step guide: how to use Offensive Anti-ForensicsInstall, first run, examples, tips and FAQs

Install in 3 steps

  1. 1

    Download the skill

    The ZIP contains the 1 original files, the MIT licence and an attribution note.

    offensive-anti-forensics.zip
  2. 2

    Add it to your agent

    Claude Code (all projects)

    mkdir -p ~/.claude/skills && unzip offensive-anti-forensics.zip -d ~/.claude/skills/

    Claude Code / Agent SDK (this project only)

    mkdir -p .claude/skills && unzip offensive-anti-forensics.zip -d .claude/skills/

    Claude apps (web/desktop): Settings → Capabilities → Skills → Upload skill, and choose the ZIP.

  3. 3

    Ask for the task

    No special command needed — the agent reads the skill's description and loads it when your request matches. Try one of the prompts above.

Get better results

  • Only use with a signed scope document and a named client; log every action so the report can account for changes.
  • Ask the agent for the detection and defender perspective alongside each technique to get more useful report content.
  • Review any command before running it, especially destructive ones such as rm -rf on journal directories or clearing whole event channels.

What's inside

  • SKILL.md

Redistributed unmodified from SnailSploit/Claude-Red under the MIT licence. The assessment was drafted with AI from the skill's files on 2026-10-29. Skills can instruct your agent to run code — read SKILL.md and any scripts before installing.