Python for Cybersecurity: Using Python for Cyber Offense and Defense

Cover
Title Page
Copyright Page
About the Author
Acknowledgments
About the Technical Editor
Contents at a Glance
Contents
Introduction
How This Book Is Organized
Tactics and Techniques
Why MITRE ATT&CK?
Tools You Will Need
Setting Up Python
Accessing Code Samples
Installing Packages
From Here
Chapter 1 Fulfilling Pre-ATT&CK Objectives
Active Scanning
Scanning Networks with scapy
Implementing a SYN Scan in scapy
Performing a DNS Scan in scapy
Running the Code
Network Scanning for Defenders
Monitoring Traffic with scapy
Building Deceptive Responses
Running the Code
Search Open Technical Databases
Offensive DNS Exploration
Searching DNS Records
Performing a DNS Lookup
Reverse DNS Lookup
Running the Code
DNS Exploration for Defenders
Handling DNS Requests
Building a DNS Response
Running the Code
Summary
Suggested Exercises
Chapter 2 Gaining Initial Access
Valid Accounts
Discovering Default Accounts
Accessing a List of Default Credentials
Starting SSH Connections in Python
Performing Telnet Queries in Python
Running the Code
Account Monitoring for Defenders
Introduction to Windows Event Logs
Accessing Event Logs in Python
Detecting Failed Logon Attempts
Identifying Unauthorized Access to Default Accounts
Running the Code
Replication Through Removable Media
Exploiting Autorun
Converting Python Scripts to Windows Executables
Generating an Autorun File
Setting Up the Removable Media
Running the Code
Detecting Autorun Scripts
Identifying Removable Drives
Finding Autorun Scripts
Detecting Autorun Processes
Running the Code
Summary
Suggested Exercises
Chapter 3 Achieving Code Execution
Windows Management Instrumentation
Executing Code with WMI
Creating Processes with WMI
Launching Processes with PowerShell
Running the Code
WMI Event Monitoring for Defenders
WMI in Windows Event Logs
Accessing WMI Event Logs in Python
Processing Event Log XML Data
Running the Code
Scheduled Task/Job
Scheduling Malicious Tasks
Checking for Scheduled Tasks
Scheduling a Malicious Task
Running the Code
Task Scheduling for Defenders
Querying Scheduled Tasks
Identifying Suspicious Tasks
Running the Code
Summary
Suggested Exercises
Chapter 4 Maintaining Persistence
Boot or Logon Autostart Execution
Exploiting Registry Autorun
The Windows Registry and Autorun Keys
Modifying Autorun Keys with Python
Running the Code
Registry Monitoring for Defenders
Querying Windows Registry Keys
Searching the HKU Hive
Running the Code
Hijack Execution Flow
Modifying the Windows Path
Accessing the Windows Path
Modifying the Path
Running the Code
Path Management for Defenders
Detecting Path Modification via Timestamps
Enabling Audit Events
Monitoring Audit Logs
Running the Code
Summary
Suggested Exercises
Chapter 5 Performing Privilege Escalation
Boot or Logon Initialization Scripts
Creating Malicious Logon Scripts
Achieving Privilege Escalation with Logon Scripts
Creating a Logon Script
Running the Code
Searching for Logon Scripts
Identifying Autorun Keys
Running the Code
Hijack Execution Flow
Injecting Malicious Python Libraries
How Python Finds Libraries
Creating a Python Library
Running the Code
Detecting Suspicious Python Libraries
Identifying Imports
Detecting Duplicates
Running the Code
Summary
Suggested Exercises
Chapter 6 Evading Defenses
Impair Defenses
Disabling Antivirus
Disabling Antivirus Autorun
Terminating Processes
Creating Decoy Antivirus Processes
Catching Signals
Running the Code
Hide Artifacts
Concealing Files in Alternate Data Streams
Exploring Alternate Data Streams
Alternate Data Streams in Python
Running the Code
Detecting Alternate Data Streams
Walking a Directory with Python
Using PowerShell to Detect ADS
Parsing PowerShell Output
Running the Code
Summary
Suggested Exercises
Chapter 7 Accessing Credentials
Credentials from Password Stores
Dumping Credentials from Web Browsers
Accessing the Chrome Master Key
Querying the Chrome Login Data Database
Parsing Output and Decrypting Passwords
Running the Code
Monitoring Chrome Passwords
Enabling File Auditing
Detecting Local State Access Attempts
Running the Code
Network Sniffing
Sniffing Passwords with scapy
Port-BasedProtocol Identification
Sniffing FTP Passwords
Extracting SMTP Passwords
Tracking Telnet Authentication State
Running the Code
Creating Deceptive Network Connections
Creating Decoy Connections
Running the Code
Summary
Suggested Exercises
Chapter 8 Performing Discovery
Account Discovery
Collecting User Account Data
Identifying Administrator Accounts
Collecting User Account Information
Accessing Windows Password Policies
Running the Code
Monitoring User Accounts
Monitoring Last Login Times
Monitoring Administrator Login Attempts
Running the Code
File and Directory Discovery
Identifying Valuable Files and Folders
Regular Expressions for Data Discovery
Parsing Different File Formats
Running the Code
Creating Honeypot Files and Folders
Monitoring Decoy Content
Creating the Decoy Content
Running the Code
Summary
Suggested Exercises
Chapter 9 Moving Laterally
Remote Services
Exploiting Windows Admin Shares
Enabling Full Access to Administrative Shares
Transferring Files via Administrative Shares
Executing Commands on Administrative Shares
Running the Code
Admin Share Management for Defenders
Monitoring File Operations
Detecting Authentication Attempts
Running the Code
Use Alternative Authentication Material
Collecting Web Session Cookies
Accessing Web Session Cookies
Running the Code
Creating Deceptive Web Session Cookies
Creating Decoy Cookies
Monitoring Decoy Cookie Usage
Running the Code
Summary
Suggested Exercises
Chapter 10 Collecting Intelligence
Clipboard Data
Collecting Data from the Clipboard
Accessing the Windows Clipboard
Replacing Clipboard Data
Clipboard Management for Defenders
Monitoring the Clipboard
Processing Clipboard Messages
Identifying the Clipboard Owner
Running the Code
Email Collection
Collecting Local Email Data
Accessing Local Email Caches
Running the Code
Protecting Against Email Collection
Identifying Email Caches
Searching Archive Files
Running the Code
Summary
Suggested Exercises
Chapter 11 Implementing Command and Control
Encrypted Channel
Command and Control Over Encrypted Channels
Encrypted Channel Client
Encrypted Channel Server
Running the Code
Detecting Encrypted C2 Channels
Performing Entropy Calculations
Detecting Encrypted Traffic
Running the Code
Protocol Tunneling
Command and Control via Protocol Tunneling
Protocol Tunneling Client
Protocol Tunneling Server
Running the Code
Detecting Protocol Tunneling
Extracting Field Data
Identifying Encoded Data
Running the Code
Summary
Suggested Exercises
Chapter 12 Exfiltrating Data
Alternative Protocols
Data Exfiltration Over Alternative Protocols
Alternative Protocol Client
Alternative Protocol Server
Running the Code
Detecting Alternative Protocols
Detecting Embedded Data
Running the Code
Non-Application Layer Protocols
Data Exfiltration via Non-Application Layer Protocols
Non-ApplicationLayer Client
Non-ApplicationLayer Server
Running the Code
Detecting Non-Application Layer Exfiltration
Identifying Anomalous Type and Code Values
Running the Code
Summary
Suggested Exercises
Chapter 13 Achieving Impact
Data Encrypted for Impact
Encrypting Data for Impact
Identifying Files to Encrypt
Encrypting and Decrypting Files
Running the Code
Detecting File Encryption
Finding Files of Interest
Calculating File Entropies
Running the Code
Account Access Removal
Removing Access to User Accounts
Changing Windows Passwords
Changing Linux Passwords
Running the Code
Detecting Account Access Removal
Detecting Password Changes in Windows
Detecting Password Changes in Linux
Running the Code
Summary
Suggested Exercises
Index
EULA