Python for Cybersecurity

Index

• A
• access argument, 61
• accessAdminShare function, 144
• Account Access Removal technique, 205–211
• Account Discovery technique, 126–133
• AccountAccessRemoval.py file, 206
• ACK number, 8
• Active Directory Service Interfaces (ADSI) Component Object Model (COM), 207
• Active Scanning technique, 2–9
• add_answer function, 16
• AddClipboardFormatListener function, 161
• ADMIN$, 144
• admin shares
  • enabling full access to, 143–144
  • executing commands on, 144
  • exploiting, 142–145
  • managing for defenders, 145–148
  • transferring files via, 144

• Administrator accounts, 127–128, 131–132
• Advanced Settings dialog, 72
• AES encryption algorithm, 109, 172
• alternate data streams (ADS)
  • about, 96–97
  • detecting, 98–102
  • detecting with PowerShell, 100–101
  • hiding files in, 96–98
  • in Python, 97–98

• AlternateDataStreams.py file, 97
• Alternative Protocols technique, 184–191
• antivirus, disabling, 90–93
• archive files, searching, 165
• -argumentlist <name>, 41
• audit events, enabling, 71–73
• audit logs, monitoring, 73–75
• authentication attempts, detecting, 147–148
• Autorun
  • detecting processes, 36
  • detecting scripts, 34–36
  • exploiting, 31–34
  • finding scripts, 36
  • generating files, 33–34

• Autorun keys
  • about, 57–60
  • disabling antivirus, 90–93
  • identifying, 81
  • modifying with Python, 60–61

• AutorunDetection.py file, 35
• Autorun.inf file, 33–34
• AutorunSetup.py file, 31–32

• B
• Base64 encoding, 117–118, 181, 190
• Berkeley Packet Filter (BPF) syntax, 7
• Boot or Logon Autostart Execution technique, 56–65
• Boot or Logon Initialization ...