book

Python for Cybersecurity

by Howard E. Poston, III

March 2022

Intermediate to advanced

240 pages

5h 13m

English

Wiley

Read now

Unlock full access

How This Book Is OrganizedTools You Will NeedFrom Here
Active ScanningSearch Open Technical DatabasesSummarySuggested Exercises
Valid AccountsReplication Through Removable MediaSummarySuggested Exercises
Windows Management InstrumentationScheduled Task/JobSummarySuggested Exercises
Boot or Logon Autostart ExecutionHijack Execution FlowSummarySuggested Exercises
Boot or Logon Initialization ScriptsHijack Execution FlowSummarySuggested Exercises
Impair DefensesHide ArtifactsSummarySuggested Exercises
Credentials from Password StoresNetwork SniffingSummarySuggested Exercises

Account DiscoveryFile and Directory DiscoverySummarySuggested Exercises
Remote ServicesUse Alternative Authentication MaterialSummarySuggested Exercises
Clipboard DataEmail CollectionSummarySuggested Exercises
Encrypted ChannelProtocol TunnelingSummarySuggested Exercises
Alternative ProtocolsNon-Application Layer ProtocolsSummarySuggested Exercises
Data Encrypted for ImpactAccount Access RemovalSummarySuggested Exercises
Acknowledgments

Content preview from Python for Cybersecurity

CHAPTER 6Evading Defenses

Gaining access to a target environment represents a significant investment of time and effort by an attacker. Maintaining this access requires the ability to evade detection and remediation by defenders.

The Defense Evasion tactic of the MITRE ATT&CK framework includes 39 techniques, making it the tactic with the greatest number of techniques. Figure 6.1 shows the breakdown of Defense Evasion techniques.

Snapshot of MITRE ATT&CK: Defense Evasion — Figure 6.1: MITRE ATT&CK: Defense Evasion

In this chapter, we will focus on two techniques from the Defense Evasion tactic. The first half of the chapter discusses Impair Defenses by targeting antivirus programs, and the second explores the use of alternate data streams (ADS) to Hide Artifacts created by an attack.

The code sample archive for this chapter can be found at https://www.wiley.com/go/pythonforcybersecurity and contains the following sample code files:

DetectAntivirusService.py
TerminateAntivirus.py
DecoyProcess.py
AlternateDataStreams.py
DetectADS.py

Impair Defenses

Like many stages of the cyberattack lifecycle, defense evasion can be performed either actively or passively. The Impair Defenses technique is an example of active Defense Evasion.

This technique can be carried out in a few different ways that target different defensive tools. Defenses can be impaired by disabling logging, interfering with cybersecurity tools, or otherwise ...