sdelete -p 3 -s C:\Temp\malware.exe

eraser addtask --file="C:\Temp\malware.exe" --method=dod

dban -m dod5220 -a /dev/sda

python3 vol.py -f memory.dmp windows.mftscan

-- 检测 SDelete 执行
SELECT TimeCreated, ProcessName, CommandLine
FROM SecurityEvents
WHERE EventID = 4688
  AND (CommandLine LIKE '%sdelete%' OR CommandLine LIKE '%eraser%' OR CommandLine LIKE '%bleachbit%')
ORDER BY TimeCreated DESC

python3 vol.py -f memory.dmp windows.prefetch | grep -i "sdelete\|eraser\|bleachbit"

echo malicious_code > legitimate_file.txt:hidden_stream

wmic process call create "C:\Temp\legitimate_file.txt:hidden_stream"

dir /r C:\Temp\
streams -s C:\Temp\

Get-Item -Path "C:\Temp\*" -Stream *

stegdetect -T C:\Temp\image.jpg

# 检查磁盘分区表
diskpart
list disk
list partition

# 检查加密容器
find / -name "*.tc" -o -name "*.hc" 2>/dev/null

# 比对 $SI 和 $FN 时间戳
python3 vol.py -f memory.dmp windows.mft | grep -A 5 "filename"

# 使用 PowerShell 检查时间戳异常
Get-Item "C:\Temp\file.exe" | Select-Object CreationTime, LastWriteTime, LastAccessTime

wevtutil cl Security
wevtutil cl System
wevtutil cl Application

Clear-EventLog -LogName Security, System, Application

-- 检测日志清理事件
SELECT TimeCreated, SubjectUserName, LogName
FROM SecurityEvents
WHERE EventID = 1102
ORDER BY TimeCreated DESC

# 检查日志文件大小和记录数
Get-EventLog -LogName Security | Select-Object Log, Count, MaximumKilobytes, OldestRecordNumber

sc stop WinDefend
sc stop MsMpSvc
net stop "Symantec Endpoint Protection"

-- 检测安全软件服务禁用
SELECT TimeCreated, ServiceName, StartType
FROM SystemEvents
WHERE EventID = 7040
  AND (ServiceName LIKE '%WinDefend%' OR ServiceName LIKE '%MsMpSvc%' OR ServiceName LIKE '%Symantec%')
ORDER BY TimeCreated DESC

# 检查安全软件服务状态
Get-Service | Where-Object { $_.DisplayName -match "Defender|Symantec|McAfee|CrowdStrike" } | Select-Object Name, Status, StartType

-- 检测日志时间间隙
SELECT TimeCreated, COUNT(*) as event_count
FROM SecurityEvents
WHERE TimeCreated BETWEEN '2026-06-15 00:00:00' AND '2026-06-15 23:59:59'
GROUP BY DATEPART(hour, TimeCreated)
ORDER BY DATEPART(hour, TimeCreated)

-- 检测反取证行为模式
SELECT TimeCreated, EventID, ProcessName, CommandLine
FROM SecurityEvents
WHERE TimeCreated BETWEEN '2026-06-15 10:00:00' AND '2026-06-15 11:00:00'
  AND (EventID IN (1102, 4688, 4699) OR CommandLine LIKE '%clear%' OR CommandLine LIKE '%delete%')
ORDER BY TimeCreated

# Anti-Forensics Detection Hunting Script
Write-Host "=== Anti-Forensics Detection ===" -ForegroundColor Cyan

# 1. 检查日志清理痕迹
Write-Host "`n[1] Checking for log clearing evidence..." -ForegroundColor Yellow
$logClearEvents = Get-WinEvent -FilterHashtable @{LogName='Security'; Id=1102} -ErrorAction SilentlyContinue
if ($logClearEvents) {
    Write-Host "[ALERT] Log clearing events detected:" -ForegroundColor Red
    $logClearEvents | ForEach-Object {
        Write-Host "  Time: $($_.TimeCreated) | User: $($_.Properties[0].Value)" -ForegroundColor Red
    }
} else {
    Write-Host "[OK] No log clearing events found" -ForegroundColor Green
}

# 2. 检查安全软件服务状态
Write-Host "`n[2] Checking security software services..." -ForegroundColor Yellow
$securityServices = Get-Service | Where-Object {
    $_.DisplayName -match "Defender|Symantec|McAfee|CrowdStrike|SentinelOne"
}
foreach ($svc in $securityServices) {
    if ($svc.Status -ne 'Running') {
        Write-Host "[ALERT] Security service stopped: $($svc.Name) - $($svc.DisplayName)" -ForegroundColor Red
    }
}

# 3. 检查 ADS（备用数据流）
Write-Host "`n[3] Checking for Alternate Data Streams..." -ForegroundColor Yellow
$adsFiles = Get-ChildItem -Path "C:\Temp", "C:\Users\Public" -Recurse -ErrorAction SilentlyContinue |
    ForEach-Object {
        $streams = Get-Item -Path $_.FullName -Stream * -ErrorAction SilentlyContinue |
            Where-Object { $_.Stream -ne ':$DATA' -and $_.Stream -ne '' }
        if ($streams) {
            [PSCustomObject]@{
                File = $_.FullName
                Stream = $streams.Stream
                Size = $streams.Length
            }
        }
    }
if ($adsFiles) {
    Write-Host "[ALERT] Files with ADS detected:" -ForegroundColor Red
    $adsFiles | ForEach-Object {
        Write-Host "  $($_.File) - Stream: $($_.Stream) - Size: $($_.Size)" -ForegroundColor Red
    }
} else {
    Write-Host "[OK] No suspicious ADS found" -ForegroundColor Green
}

# 4. 检查时间戳异常
Write-Host "`n[4] Checking for timestamp anomalies..." -ForegroundColor Yellow
$suspiciousFiles = Get-ChildItem -Path "C:\Temp", "C:\Users\Public" -Recurse -ErrorAction SilentlyContinue |
    Where-Object {
        $_.CreationTime -lt $_.LastWriteTime -or
        $_.CreationTime.Year -lt 2020 -or
        ($_.CreationTime.Second -eq 0 -and $_.CreationTime.Millisecond -eq 0)
    }
if ($suspiciousFiles) {
    Write-Host "[ALERT] Files with suspicious timestamps:" -ForegroundColor Red
    $suspiciousFiles | ForEach-Object {
        Write-Host "  $($_.FullName) - Created: $($_.CreationTime) | Modified: $($_.LastWriteTime)" -ForegroundColor Red
    }
} else {
    Write-Host "[OK] No timestamp anomalies found" -ForegroundColor Green
}

# 5. 检查安全删除工具执行痕迹
Write-Host "`n[5] Checking for secure deletion tools..." -ForegroundColor Yellow
$secureDeleteTools = @("sdelete", "eraser", "bleachbit", "shred", "wipe")
foreach ($tool in $secureDeleteTools) {
    $prefetch = Get-ChildItem -Path "C:\Windows\Prefetch" -Filter "*$tool*.pf" -ErrorAction SilentlyContinue
    if ($prefetch) {
        Write-Host "[ALERT] Secure deletion tool found in Prefetch: $($prefetch.Name)" -ForegroundColor Red
    }
}

Write-Host "`n=== Detection Complete ===" -ForegroundColor Cyan

-- 综合反取证事件日志狩猎

-- 1. 日志清理事件
SELECT TimeCreated, SubjectUserName, LogName
FROM SecurityEvents
WHERE EventID = 1102
ORDER BY TimeCreated DESC

-- 2. 安全软件服务禁用
SELECT TimeCreated, ServiceName, StartType
FROM SystemEvents
WHERE EventID = 7040
  AND (ServiceName LIKE '%WinDefend%' OR ServiceName LIKE '%MsMpSvc%' OR ServiceName LIKE '%Symantec%')
ORDER BY TimeCreated DESC

-- 3. 安全删除工具执行
SELECT TimeCreated, ProcessName, CommandLine
FROM SecurityEvents
WHERE EventID = 4688
  AND (CommandLine LIKE '%sdelete%' OR CommandLine LIKE '%eraser%' OR CommandLine LIKE '%bleachbit%')
ORDER BY TimeCreated DESC

-- 4. 浏览器历史清理
SELECT TimeCreated, ProcessName, CommandLine
FROM SecurityEvents
WHERE EventID = 4688
  AND (CommandLine LIKE '%Clear-BrowsingData%' OR CommandLine LIKE '%clear-history%')
ORDER BY TimeCreated DESC

-- 5. 回收站清空
SELECT TimeCreated, ProcessName, CommandLine
FROM SecurityEvents
WHERE EventID = 4688
  AND CommandLine LIKE '%Clear-RecycleBin%'
ORDER BY TimeCreated DESC

-- 6. 日志时间间隙检测
SELECT DATEPART(hour, TimeCreated) as Hour, COUNT(*) as EventCount
FROM SecurityEvents
WHERE TimeCreated BETWEEN '2026-06-15 00:00:00' AND '2026-06-15 23:59:59'
GROUP BY DATEPART(hour, TimeCreated)
ORDER BY Hour

title: Anti-Forensics - Log Clearing
id: d331bbe2-6db4-4941-80a5-8270db72eb61
status: test
description: Detects attempts to clear Windows event logs
references:
    - https://attack.mitre.org/techniques/T1070/001/
date: 2026-06-23
tags:
    - attack.defense-evasion
    - attack.t1070.001
logsource:
    product: windows
    category: process_creation
detection:
    selection:
        CommandLine|contains:
            - 'wevtutil cl'
            - 'Clear-EventLog'
            - 'clear-log'
    condition: selection
falsepositives:
    - Legitimate administrative activity
level: medium

title: Anti-Forensics - Security Software Disabled
id: a1b2c3d4-e5f6-7890-abcd-ef1234567890
status: test
description: Detects attempts to disable security software services
references:
    - https://attack.mitre.org/techniques/T1562/001/
date: 2026-06-23
tags:
    - attack.defense-evasion
    - attack.t1562.001
logsource:
    product: windows
    service: system
detection:
    selection:
        EventID: 7040
        ServiceName|contains:
            - 'WinDefend'
            - 'MsMpSvc'
            - 'Symantec'
            - 'McAfee'
            - 'CrowdStrike'
    condition: selection
falsepositives:
    - Legitimate administrative activity
level: high