MrKaplan is a tool aimed to help red teamers to stay hidden and clear as much as traces possible. It works by saving information such as the time it ran, under which user and "reverting" the computer to look like before MrKaplan ran.
This tool is inspired by MoonWalk, a similar tool for Unix machines.
You can read more about it in the wiki page. (COMING SOON)
- Stopping event logging.
- Clearing files artifacts.
- Clearing registry artifacts.
- Can run for multiple users.
-
Before you start your operations on the computer, run MrKaplan with begin flag and whenever your finish run it again with end flag.
-
THIS PROGRAM MUST RUN AS AN ADMINISTRATOR (FOR NOW)
- Add an option to run as user.
- Add exclusion support.
- Add time stomping support.
- Add more artifacts (WMI, inet cache, etc.).
I'm not responsible in any way for any kind of damage that is done to your computer / program as cause of this project. I'm happily accept contribution, make a pull request and I will review it!