Attempt to hide attackers presence on the system so the system appears uncompromised.
To avoid detection the attacker needs to
modify the system logs and delete their activity during the attack.
ensure that future activities are not logged
You can mitigate damage by reducing footprint by e.g. making your access disguise a legit process.
đź’ˇ Have an exit strategy prior to breaking in by getting to know OS type, log types, policies (e.g. log altered alarms) and applications running on it.
E.g. if you know OS you can know where in general the OS keeps logs (e.g. /var/log/)
âť— There's no universal way to figure out where all the logs are in a system
Log file permissions
Common and big mistake: bad permissions on log files
Allows access from a lot of users that shouldn't
E.g. to read system messages you need to become root sudo tail /var/log/messages
Terminal history
Might leave footprints here for commands you run.
Good place to learn about the user (they sometimes write passwords by mistake).
You can run history to get the history.
In (fedora) saved in home/<username>/.bash_history