book

Python for Cybersecurity

by Howard E. Poston, III

March 2022

Intermediate to advanced

240 pages

5h 13m

English

Wiley

Read now

Unlock full access

How This Book Is OrganizedTools You Will NeedFrom Here
Active ScanningSearch Open Technical DatabasesSummarySuggested Exercises
Valid AccountsReplication Through Removable MediaSummarySuggested Exercises
Windows Management InstrumentationScheduled Task/JobSummarySuggested Exercises
Boot or Logon Autostart ExecutionHijack Execution FlowSummarySuggested Exercises
Boot or Logon Initialization ScriptsHijack Execution FlowSummarySuggested Exercises
Impair DefensesHide ArtifactsSummarySuggested Exercises
Credentials from Password StoresNetwork SniffingSummarySuggested Exercises

Account DiscoveryFile and Directory DiscoverySummarySuggested Exercises
Remote ServicesUse Alternative Authentication MaterialSummarySuggested Exercises
Clipboard DataEmail CollectionSummarySuggested Exercises
Encrypted ChannelProtocol TunnelingSummarySuggested Exercises
Alternative ProtocolsNon-Application Layer ProtocolsSummarySuggested Exercises
Data Encrypted for ImpactAccount Access RemovalSummarySuggested Exercises
Acknowledgments

Content preview from Python for Cybersecurity

CHAPTER 8Performing Discovery

The Pre-ATT&CK tactics of the MITRE ATT&CK framework discuss how information about a target environment can be gathered in preparation for an attack. However, the information that is available from outside the target network may be limited.

The Discovery tactic of MITRE ATT&CK discusses methods for information gathering from inside the target environment. This tactic includes 27 techniques, as shown in Figure 8.1.

Snapshot of MITRE ATT&CK: Discovery — Figure 8.1: MITRE ATT&CK: Discovery

In this chapter, we'll focus on collecting information about the user accounts and files on a target machine. The first part of the chapter discusses how intelligence about user accounts can be collected via MITRE ATT&CK's Account Discovery technique and how this collection can be detected. The second part explores how to identify valuable data within files as part of the File and Directory Discovery technique and how to detect this data harvesting.

The code sample archive for this chapter can be found at https://www.wiley.com/go/pythonforcybersecurity and contains the following sample code files:

UserDiscovery.py
LastLogin.py
DetectAdminLogin.py
FileDiscovery.py
MonitorDecoyContent.py
CreateDecoyContent.py

Account Discovery

Access to user accounts is vital to an attacker's ability to expand their access to the target environment and achieve their overall objectives. To gain access to these user ...