Penetration Test Cleanup and Restoration Checklist

Cleanup is the last technical phase of a professional penetration test. You remove what you added, restore what you changed, and hand the environment back in a known state. That work belongs in the rules of engagement and in the closeout section of your penetration test report, not as an afterthought the night before delivery.

This checklist is for authorized assessments. It maps to CompTIA PenTest+ post-engagement objectives and to the restoration expectations in frameworks such as PTES reporting and NIST SP 800-115.

Cleanup is part of the engagement

Treat restoration as scope, not secrecy. A mature program expects you to leave artifacts documented, evidence preserved for the report, and production-like settings returned where the RoE allows.

Authorized restoration versus anti-forensics

The line is intent and authorization:

Pen testers restore trust. Attackers cover tracks. If the RoE requires leaving certain markers for detection exercises, follow that instead of default removal.

Name cleanup responsibilities during pre-engagement scoping: who removes persistence, who restores cloud IAM, and what evidence the client keeps.

Maintain an artifact log during testing

The artifact log is your operational source of truth. Update it when you create something, not when the report deadline arrives.

Record at minimum:

• Hostname or resource ID
• File path or object name
• Account or principal created
• Scheduled task, service, or cron entry
• Configuration change (firewall, GPO, registry key, cloud security group)
• Listener, handler, or C2 callback endpoint
• Credential, API key, or token issued for the test
• Cloud resource (instance, role, bucket, Lambda)
• Timestamp (UTC) and tester initials
• Owner for sign-off (client contact or your engagement lead)

A spreadsheet, ticket system, or project tool such as Cervantes works. Each row should answer: what is it, where is it, who created it, and what removes it.

If you practiced post-exploitation persistence in a lab, mirror the same discipline on client systems. Persistence without a cleanup row is how engagements leave ghost accounts behind.

Stop active sessions and listeners

Before you delete files, close controlled connections so nothing dials home while you are mid-cleanup.

Checklist:

• Exit or kill interactive shells on targets and jump hosts
• Stop Metasploit handlers, nc listeners, and reverse-shell catchers on your attack platform
• Tear down SOCKS proxies, ssh -R forwards, and pivoting tunnels
• Stop temporary web servers, mock APIs, and phishing landing pages used only for the test
• Revoke or close VPN and bastion sessions opened for the engagement
• Confirm no orphaned processes still bind to engagement ports on your laptop or team server

Document the stop time in the artifact log. If the client blue team monitors netflow, a listener that stays up after closeout looks like an active intrusion.

Remove created files and tools

Delete only artifacts you introduced. Do not treat cleanup as a license to erase legitimate system or security data.

Typical removals:

• Uploaded exploit scripts, binaries, and wordlists in /tmp, C:\Users\Public, or web upload directories
• Web shells and proof-of-concept HTML or ASPX files placed during exploitation
• Staged archives used for data exfiltration drills (after evidence is preserved)
• Installer packages dropped for privilege-escalation proofs
• Screensaver or macro payloads used in social-engineering exercises when the RoE allowed them

Leave alone:

• Original application files unless the RoE explicitly covers replacement
• Security product quarantine folders (coordinate with the client)
• Centralized logs on collectors, SIEM, and cloud audit trails

When in doubt, ask the asset owner before deleting on production. In your own lab, snapshot restore is the safety net; on a client network, the artifact log is.

Remove persistence changes

Persistence mechanisms from the test must be reversed or explicitly handed off. Cross-reference every row in your persistence lesson notes with the artifact log.

Walk through the same categories covered in post-exploitation persistence: tasks, services, cron, registry, and test accounts. If the engagement was detection-focused, the RoE may require leaving specific artifacts for an agreed window. Document that exception in writing.

Restore configuration

Return security controls and application settings to the pre-test baseline or to a state the client approves.

Areas to review:

• Host and network firewall rules you opened for scanning or pivoting
• Disabled security controls (AV exclusions, AppLocker relaxations, SELinux permissive mode)
• Application config files changed to prove impact (debug flags, weak cipher suites)
• Group Policy Objects or Intune profiles modified during testing
• Load balancer or WAF rules set to allow your traffic
• Database roles or shares created for demonstration

Capture before-and-after values in the report appendix when the change is material. If you cannot restore automatically, list the manual steps the client must run and offer a retest window.

Handle test credentials and secrets

Temporary credentials exist to prove impact. They must be revoked or rotated, not merely deleted from your notes.

Actions:

• Disable or delete test-only local and domain accounts
• Revoke API keys, OAuth tokens, and service principals created for the assessment
• Rotate passwords you learned or set during the test when policy requires it
• Invalidate session cookies and Kerberos tickets obtained for demonstration
• Remove shared vault entries your team added for the engagement

Rotating a password without telling the client can cause an outage. Follow the RoE escalation path: security operations often wants to orchestrate rotation on production accounts even when you cracked them.

Do not keep live client secrets in personal password managers after closeout unless the contract defines secure retention.

Restore cloud resources

Cloud tests add another inventory layer. Terminate or delete only resources the client agreed you own for the engagement.

Review:

• EC2, Azure VM, or GCP instances spawned for pivot or exfil demos
• IAM roles, policies, and trust relationships attached to those instances
• Security groups, NACLs, and firewall rules with your tester IP or prefix
• S3, Blob, or GCS objects holding staged exfiltration files
• Lambda, Cloud Functions, or Container Apps deployed as proof
• DNS records pointing to your infrastructure

Follow the provider penetration-testing policy (AWS, Azure, Google Cloud) and any notification rules in the RoE. For broader cloud attack surface context, see cloud pentesting fundamentals. If a resource is shared production infrastructure, do not delete it; document required owner action.

Preserve evidence before removal

Cleanup must not destroy evidence the client needs for the report, compliance, or detection engineering.

Preserve before you delete:

• Screenshots and screen recordings tied to findings
• Tool output (scanner reports, bloodhound collections, crack results with redaction)
• Relevant log excerpts with timestamps
• Packet captures when the RoE allowed them
• File hashes of dropped tools and retrieved samples
• Cloud API audit entries for critical findings

Store evidence in the secure channel named in the RoE. Redact credentials and personal data per the data-handling section. The penetration test report should reference evidence paths without embedding live secrets.

Order of operations: capture → hash → report reference → remove artifact from target.

Secure disposal

After delivery, dispose of copies on your side according to contract retention, not convenience.

Be honest about limits. SSDs, copy-on-write filesystems, and cloud object versioning may prevent forensic-grade erasure without vendor-specific tools. Promise "unrecoverable deletion" only when your process and media support it.

Verify restoration

Re-check the environment after cleanup. Spot checks beat assumptions.

Verification passes:

• Services start and respond as before the test window
• Firewall and security tool policies match the agreed baseline
• Test accounts no longer authenticate
• Listeners on your platform and target jump hosts are closed
• Cron, tasks, and services from the artifact log are gone
• Cloud consoles show no orphaned engagement resources
• Blue team or client contact confirms monitoring returned to normal

Record verification results in the closeout email or report section. Note any item that could not be restored and why.

Client sign-off

Some items require owner action. List them explicitly instead of implying the environment is pristine.

Common handoff items:

• Production password rotations the client must schedule
• Third-party SaaS tokens you cannot revoke
• Hardware appliances you were not allowed to reconfigure
• Detections the client asked to keep for tuning exercises
• Findings that remain open until remediation, with retest dates

Send a concise cleanup summary: artifact log attached, evidence location, outstanding owner tasks, and confirmation that active testing has ended. Obtain written acknowledgment when the contract requires it.

Penetration test cleanup checklist

Use this table as a printable closeout guide. Adapt rows to your RoE and platform mix.

References

• NIST SP 800-115 — Technical Guide to Information Security Testing and Assessment
• PTES — Reporting
• MITRE ATT&CK — Indicator Removal — understand what unauthorized removal looks like; do not emulate it on client systems without explicit detection-exercise scope
• AWS — Penetration testing
• Microsoft MSRC — Penetration testing rules of engagement

Summary

Penetration test cleanup is authorized restoration, not cover-up. You stop listeners, remove what you added, restore configuration, rotate or revoke test credentials, and preserve evidence the client needs before anything is deleted from targets.

The artifact log drives the work: if it is not logged, it will be missed. Verification and client sign-off close the loop when production teams must rotate passwords or remove shared cloud resources themselves.

Carry the same habit into your lab. When you practice persistence or pivoting, schedule cleanup in the same session and snapshot targets when a full revert is faster than manual removal. That discipline is what separates a professional closeout from an engagement that leaves ghost shells behind.