book

Python for Cybersecurity

by Howard E. Poston, III

March 2022

Intermediate to advanced

240 pages

5h 13m

English

Wiley

Read now

Unlock full access

How This Book Is OrganizedTools You Will NeedFrom Here
Active ScanningSearch Open Technical DatabasesSummarySuggested Exercises
Valid AccountsReplication Through Removable MediaSummarySuggested Exercises
Windows Management InstrumentationScheduled Task/JobSummarySuggested Exercises
Boot or Logon Autostart ExecutionHijack Execution FlowSummarySuggested Exercises
Boot or Logon Initialization ScriptsHijack Execution FlowSummarySuggested Exercises
Impair DefensesHide ArtifactsSummarySuggested Exercises
Credentials from Password StoresNetwork SniffingSummarySuggested Exercises

Account DiscoveryFile and Directory DiscoverySummarySuggested Exercises
Remote ServicesUse Alternative Authentication MaterialSummarySuggested Exercises
Clipboard DataEmail CollectionSummarySuggested Exercises
Encrypted ChannelProtocol TunnelingSummarySuggested Exercises
Alternative ProtocolsNon-Application Layer ProtocolsSummarySuggested Exercises
Data Encrypted for ImpactAccount Access RemovalSummarySuggested Exercises
Acknowledgments

Content preview from Python for Cybersecurity

CHAPTER 10Collecting Intelligence

Data collection is an essential component of many types of cyberattack campaigns. It is the primary goal in data breaches, essential for targeting ransomware attacks, and can help enable spear phishing and account takeover attacks.

The MITRE ATT&CK framework covers the various ways to collect useful intelligence in its Collection tactic. Figure 10.1 shows this tactic's 17 techniques.

Snapshot of MITRE ATT&CK: Collection — Figure 10.1: MITRE ATT&CK: Collection

These techniques cover two aspects of intelligence collection: methods for collecting the data and processes for automating collection or preparing for data exfiltration. This chapter focuses on two techniques from this first category: Clipboard Data and Email Collection.

The code sample archive for this chapter can be found at https://www.wiley.com/go/pythonforcybersecurity and contains the following sample code files:

ModifyClipboard.py
MonitorClipboard.py
LocalEmailFiles.py
FindEmailArchives.py

Clipboard Data

For many people, the system clipboard is vital to their use of a computer. The ability to copy data from one location and paste it to another increases efficiency and can help to limit the errors caused by typos.

As a result, the system clipboard commonly carries sensitive information. By monitoring the clipboard, an attacker can identify valuable data on a computer without searching through the entire file system. ...