Leaving¶

Leaving cleanly relies on two distinct mechanisms executed before disconnecting. Covering tracks degrades the true trail by clearing event logs, timestamps, and caches that tie observed indicators back to the operation. False flags plant misleading artefacts designed to direct investigators toward an alternative attribution. Covering tracks belongs to the final phase of egress, while false flags tend to carry better when planted during initial access, since artefacts dated to that stage fit the timeline an investigator reconstructs. Neither can be arranged once the connection closes.