book

Python for Cybersecurity

by Howard E. Poston, III

March 2022

Intermediate to advanced

240 pages

5h 13m

English

Wiley

Read now

Unlock full access

How This Book Is OrganizedTools You Will NeedFrom Here
Active ScanningSearch Open Technical DatabasesSummarySuggested Exercises
Valid AccountsReplication Through Removable MediaSummarySuggested Exercises
Windows Management InstrumentationScheduled Task/JobSummarySuggested Exercises
Boot or Logon Autostart ExecutionHijack Execution FlowSummarySuggested Exercises
Boot or Logon Initialization ScriptsHijack Execution FlowSummarySuggested Exercises
Impair DefensesHide ArtifactsSummarySuggested Exercises
Credentials from Password StoresNetwork SniffingSummarySuggested Exercises

Account DiscoveryFile and Directory DiscoverySummarySuggested Exercises
Remote ServicesUse Alternative Authentication MaterialSummarySuggested Exercises
Clipboard DataEmail CollectionSummarySuggested Exercises
Encrypted ChannelProtocol TunnelingSummarySuggested Exercises
Alternative ProtocolsNon-Application Layer ProtocolsSummarySuggested Exercises
Data Encrypted for ImpactAccount Access RemovalSummarySuggested Exercises
Acknowledgments

Content preview from Python for Cybersecurity

CHAPTER 4Maintaining Persistence

In Chapter 3, “Achieving Code Execution,” we discussed some of the methods by which an attacker can use Python to achieve code execution on a target system. In this chapter, we explore how Python can be used to help consolidate that foothold using persistence mechanisms.

The Persistence tactic of the MITRE ATT&CK framework describes 19 different techniques for accomplishing this, as shown in Figure 4.1.

Snapshot of MITRE ATT&CK: Persistence — Figure 4.1: MITRE ATT&CK: Persistence

In this chapter, we will explore the Boot or Logon Autostart Execution and the Hijack Execution Flow techniques under this tactic. The code samples will demonstrate how modifying the Windows Registry can cause code to run automatically on boot or logon and how to modify the Windows Path. We'll also look at how Python code can be used to detect both of these Persistence techniques.

The code sample archive for this chapter can be found at https://www.wiley.com/go/pythonforcybersecurity and contains the following sample code files:

RegAutorun.py
DetectRegistryAutorun.py
ChangePath.py
DetectPathModificationRegistry.py
DetectPathModificationEvent.py

Boot or Logon Autostart Execution

The ability to run scripts upon boot or user logon is an essential part of operating systems. Any OS has a complex series of tasks that enable it to transition from being completely inactive to a fully functional computer. ...