HOWARD E. POSTON III is a freelance consultant and content creator with a professional focus on blockchain and cybersecurity. He has over ten years' experience in programming with Python and has developed and taught over a dozen courses teaching cybersecurity. He is a sought-after speaker on blockchain and cybersecurity at international security conferences.

Introduction xvii

Chapter 1 Fulfilling Pre- ATT&CK Objectives 1

Active Scanning 2

Scanning Networks with scapy 2

Implementing a SYN Scan in scapy 4

Performing a DNS Scan in scapy 5

Running the Code 5

Network Scanning for Defenders 6

Monitoring Traffic with scapy 7

Building Deceptive Responses 8

Running the Code 9

Search Open Technical Databases 9

Offensive DNS Exploration 10

Searching DNS Records 11

Performing a DNS Lookup 12

Reverse DNS Lookup 12

Running the Code 13

DNS Exploration for Defenders 13

Handling DNS Requests 15

Building a DNS Response 15

Running the Code 16

Summary 17

Suggested Exercises 17

Chapter 2 Gaining Initial Access 19

Valid Accounts 20

Discovering Default Accounts 20

Accessing a List of Default Credentials 21

Starting SSH Connections in Python 22

Performing Telnet Queries in Python 23

Running the Code 24

Account Monitoring for Defenders 24

Introduction to Windows Event Logs 25

Accessing Event Logs in Python 28

Detecting Failed Logon Attempts 28

Identifying Unauthorized Access to Default Accounts 30

Running the Code 30

Replication Through Removable Media 31

Exploiting Autorun 31

Converting Python Scripts to Windows Executables 32

Generating an Autorun File 33

Setting Up the Removable Media 34

Running the Code 34

Detecting Autorun Scripts 34

Identifying Removable Drives 35

Finding Autorun Scripts 36

Detecting Autorun Processes 36

Running the Code 36

Summary 37

Suggested Exercises 37

Chapter 3 Achieving Code Execution 39

Windows Management Instrumentation 40

Executing Code with WMI 40

Creating Processes with WMI 41

Launching Processes with PowerShell 41

Running the Code 42

WMI Event Monitoring for Defenders 42

WMI in Windows Event Logs 43

Accessing WMI Event Logs in Python 45

Processing Event Log XML Data 45

Running the Code 46

Scheduled Task/Job 47

Scheduling Malicious Tasks 47

Checking for Scheduled Tasks 48

Scheduling a Malicious Task 48

Running the Code 49

Task Scheduling for Defenders 50

Querying Scheduled Tasks 51

Identifying Suspicious Tasks 52

Running the Code 52

Summary 53

Suggested Exercises 53

Chapter 4 Maintaining Persistence 55

Boot or Logon Autostart Execution 56

Exploiting Registry Autorun 56

The Windows Registry and Autorun Keys 57

Modifying Autorun Keys with Python 60

Running the Code 61

Registry Monitoring for Defenders 62

Querying Windows Registry Keys 63

Searching the HKU Hive 64

Running the Code 64

Hijack Execution Flow 65

Modifying the Windows Path 65

Accessing the Windows Path 66

Modifying the Path 67

Running the Code 68

Path Management for Defenders 69

Detecting Path Modification via Timestamps 69

Enabling Audit Events 71

Monitoring Audit Logs 73

Running the Code 75

Summary 76

Suggested Exercises 76

Chapter 5 Performing Privilege Escalation 77

Boot or Logon Initialization Scripts 78

Creating Malicious Logon Scripts 78

Achieving Privilege Escalation with Logon Scripts 79

Creating a Logon Script 79

Running the Code 79

Searching for Logon Scripts 80

Identifying Autorun Keys 81

Running the Code 81

Hijack Execution Flow 81

Injecting Malicious Python Libraries 82

How Python Finds Libraries 82

Creating a Python Library 83

Running the Code 83

Detecting Suspicious Python Libraries 83

Identifying Imports 85

Detecting Duplicates 85

Running the Code 86

Summary 86

Suggested Exercises 87

Chapter 6 Evading Defenses 89

Impair Defenses 90

Disabling Antivirus 90

Disabling Antivirus Autorun 90

Terminating Processes 93

Creating Decoy Antivirus Processes 94

Catching Signals 95

Running the Code 95

Hide Artifacts 95

Concealing Files in Alternate Data Streams 96

Exploring Alternate Data Streams 96

Alternate Data Streams in Python 97

Running the Code 98

Detecting Alternate Data Streams 98

Walking a Directory with Python 99

Using PowerShell to Detect ADS 100

Parsing PowerShell Output 101

Running the Code 102

Summary 102

Suggested Exercises 103

Chapter 7 Accessing Credentials 105

Credentials from Password Stores 106

Dumping Credentials from Web Browsers 106

Accessing the Chrome Master Key 108

Querying the Chrome Login Data Database 108

Parsing Output and Decrypting Passwords 109

Running the Code 109

Monitoring Chrome Passwords 110

Enabling File Auditing 110

Detecting Local State Access Attempts 111

Running the Code 113

Network Sniffing 114

Sniffing Passwords with scapy 114

Port- Based Protocol Identification 116

Sniffing FTP Passwords 116

Extracting SMTP Passwords 117

Tracking Telnet Authentication State 119

Running the Code 121

Creating Deceptive Network Connections 121

Creating Decoy Connections 122

Running the Code 122

Summary 123

Suggested Exercises 123

Chapter 8 Performing Discovery 125

Account Discovery 126

Collecting User Account Data 126

Identifying Administrator Accounts 127

Collecting User Account Information 128

Accessing Windows Password Policies 128

Running the Code 129

Monitoring User Accounts 130

Monitoring Last Login Times 130

Monitoring Administrator Login Attempts 131

Running the Code 132

File and Directory Discovery 133

Identifying Valuable Files and Folders 133

Regular Expressions for Data Discovery 135

Parsing Different File Formats 135

Running the Code 136

Creating Honeypot Files and Folders 136

Monitoring Decoy Content 136

Creating the Decoy Content 137

Running the Code 138

Summary 138

Suggested Exercises 139

Chapter 9 Moving Laterally 141

Remote Services 142

Exploiting Windows Admin Shares 142

Enabling Full Access to Administrative Shares 143

Transferring Files via Administrative Shares 144

Executing Commands on Administrative Shares 144

Running the Code 144

Admin Share Management for Defenders 145

Monitoring File Operations 146

Detecting Authentication Attempts 147

Running the Code 148

Use Alternative Authentication Material 148

Collecting Web Session Cookies 149

Accessing Web Session Cookies 150

Running the Code 150

Creating Deceptive Web Session Cookies 151

Creating Decoy Cookies 151

Monitoring Decoy Cookie Usage 153

Running the Code 153

Summary 154

Suggested Exercises 155

Chapter 10 Collecting Intelligence 157

Clipboard Data 158

Collecting Data from the Clipboard 158

Accessing the Windows Clipboard 159

Replacing Clipboard Data 159

Running the Code 160

Clipboard Management for Defenders 160

Monitoring the Clipboard 161

Processing Clipboard Messages 161

Identifying the Clipboard Owner 161

Running the Code 162

Email Collection 162

Collecting Local Email Data 162

Accessing Local Email Caches 163

Running the Code 163

Protecting Against Email Collection 164

Identifying Email Caches 165

Searching Archive Files 165

Running the Code 166

Summary 166

Suggested Exercises 166

Chapter 11 Implementing Command and Control 169

Encrypted Channel 170

Command and Control Over Encrypted Channels 170

Encrypted Channel Client 171

Encrypted Channel Server 172

Running the Code 173

Detecting Encrypted C2 Channels 174

Performing Entropy Calculations 175

Detecting Encrypted Traffic 175

Running the Code 176

Protocol Tunneling 176

Command and Control via Protocol Tunneling 176

Protocol Tunneling Client 177

Protocol Tunneling Server 177

Running the Code 179

Detecting Protocol Tunneling 179

Extracting Field Data 181

Identifying Encoded Data 181

Running the Code 181

Summary 182

Suggested Exercises 182

Chapter 12 Exfiltrating Data 183

Alternative Protocols 184

Data Exfiltration Over Alternative Protocols 184

Alternative Protocol Client 185

Alternative Protocol Server 186

Running the Code 188

Detecting Alternative Protocols 189

Detecting Embedded Data 190

Running the Code 191

Non- Application Layer Protocols 191

Data Exfiltration via Non- Application Layer Protocols 192

Non- Application Layer Client 193

Non- Application Layer Server 193

Running the Code 194

Detecting Non- Application Layer Exfiltration 195

Identifying Anomalous Type and Code Values 196

Running the Code 196

Summary 197

Suggested Exercises 197

Chapter 13 Achieving Impact 199

Data Encrypted for Impact 200

Encrypting Data for Impact 200

Identifying Files to Encrypt 201

Encrypting and Decrypting Files 202

Running the Code 202

Detecting File Encryption 203

Finding Files of Interest 204