Which tool is commonly used to wipe out all the logs from a Windows system during a compromise?

• A. Bash
• B. ICMP tunneling
• C. DNS tunneling
• D. Meterpreter shell

Answer: (D)

Wiping logs to cover tracks is a common goal after gaining access to a system, because logs can reveal unauthorized activity. Meterpreter is a post-exploitation payload that runs on the compromised Windows host and includes capabilities for manipulating the system, including clearing Windows event logs. Using Meterpreter, an operator can run commands that erase entries in the Security, System, and Application logs, effectively removing evidence of the intrusion. That makes Meterpreter the best fit for wiping out logs during a compromise. In contrast, Bash is a Unix shell not typically used for Windows log management, and ICMP tunneling or DNS tunneling are methods for covert data transfer rather than log deletion.