Update TTPs/Persistence/rdp.py

TTPs/Persistence/rdp.py

@@ -31,92 +31,117 @@ def source_event_logs():
 """
     print_info(title, content)
 
-def destination_event_logs(target_ip, open_ports):
-    title = "Destination Event Logs"
-    content = (
-        f"- **Security Event Log** – `security.evtx`\n"
-        f"  - 4624: Logon Type 10\n"
-        f"    - Source IP/Logon User Name\n"
-        f"  - 4778/4779\n"
-        f"    - IP Address of Source/Source System Name\n"
-        f"    - Logon User Name\n"
-        f"- `Microsoft-Windows-RemoteDesktopServices-RdpCoreTS%4Operational.evtx`\n"
-        f"  - 131: Connection Attempts (Source IP)\n"
-        f"  - 98: Successful Connections\n"
-        f"- `Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx`\n"
-        f"  - 1149: Source IP/Logon User Name (Blank user name may indicate Sticky Keys)\n"
-        f"- `Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx`\n"
-        f"  - 21, 22, 25: Source IP/Logon User Name\n"
-        f"  - 41: Logon User Name"
-    )
-    run_command(title, content, target_ip, open_ports)
+def destination_event_logs():
+    title = "RDP Destination Event Logs"
+    content = """
+- **Security Event Log** – `security.evtx`
+    - `4624` Logon Type 10
+        - Source IP/Logon User Name
+    - `4778/4779`
+        - IP Address of Source/Source System Name
+        - Logon User Name
+- `Microsoft-Windows-RemoteDesktopServices-RdpCoreTS%4Operational.evtx`
+    - `131` - Connection Attempts
+        - Source IP
+    - `98` - Successful Connections
+- `Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx`
+    - `1149` 
+        - Source IP/Logon User Name
+            - Blank user name may indicate use of Sticky Keys
+- `Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx`
+    - 21, 22, 25
+        - Source IP/Logon User Name
+    - 41
+        - Logon User Name
+"""
+    print_info(title, content)
 
-def source_registry(target_ip, open_ports):
-    title = "Source Registry"
-    content = (
-        f"- `NTUSER\\Software\\Microsoft\\Terminal Server Client\\Servers`: Remote desktop destinations (per-user)\n"
-        f"- `ShimCache` – SYSTEM: Tracks `mstsc.exe` (Remote Desktop Client)\n"
-        f"- `BAM_DAM` – SYSTEM: Last Time Executed (`mstsc.exe`)\n"
-        f"- `AmCache.hve`: First Time Executed (`mstsc.exe`)\n"
-        f"- `UserAssist` – `NTUSER.DAT`\n"
-        f"  - Tracks execution of `mstsc.exe` (Remote Desktop Client)\n"
-        f"- `RecentApps` – `NTUSER.DAT`\n"
-        f"  - Tracks `mstsc.exe` and connection destinations"
-    )
-    run_command(title, content, target_ip, open_ports)
 
-def destination_registry(target_ip, open_ports):
-    title = "Destination Registry"
-    content = (
-        f"- `ShimCache` - SYSTEM\n"
-        f"  - Tracks `rdpclip.exe` and `tstheme.exe`\n"
-        f"- `AmCache.hve`: First Time Executed\n"
-        f"  - Tracks `rdpclip.exe` and `tstheme.exe`"
-    )
-    run_command(title, content, target_ip, open_ports)
+def source_registry():
+    title = "RDP Source Registry"
+    content = """
+- Remote desktop destinations are tracked per-user
+    - `NTUSER\\Software\\Microsoft\\Terminal Server Client\\Servers`
+- [[ShimCache]] – SYSTEM
+    - `mstsc.exe` Remote Desktop Client
+- [[BAM_DAM]] – SYSTEM – Last Time Executed
+    - `mstsc.exe` Remote Desktop Client
+- [[AmCache.hve]] - First Time Executed
+    - `mstsc.exe`
+- UserAssist – `NTUSER.DAT`
+    - `mstsc.exe` Remote Desktop Client execution
+    - Last Time Executed
+    - Number of Times Executed
+- RecentApps – `NTUSER.DAT`
+    - `mstsc.exe`
+    - Remote Desktop Client execution
+    - Last Time Executed
+    - Number of Times Executed
+    - RecentItems subkey tracks connection destinations and times
+"""
+    print_info(title, content)
 
-def source_artifacts(target_ip, open_ports):
-    title = "Source File System Artifacts"
-    content = (
-        f"- Jumplists: `C:\\Users\\<Username>\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\`\n"
-        f"  - Tracks remote desktop connection destinations and times\n"
-        f"- Prefetch: `C:\\Windows\\Prefetch\\`\n"
-        f"  - Tracks execution of `mstsc.exe`\n"
-        f"- Bitmap Cache: `C:\\Users\\<Username>\\AppData\\Local\\Microsoft\\TerminalServer Client\\Cache`\n"
-        f"- Default.rdp file: `C:\\Users\\<Username>\\Documents\\`"
-    )
-    run_command(title, content, target_ip, open_ports)
+def destination_registry():
+    title = "RDP Destination Registry"
+    content = """
+- [[ShimCache]] - SYSTEM
+    - `rdpclip.exe`
+    - `tstheme.exe`
+- [[AmCache.hve]] - First Time Executed
+    - `rdpclip.exe`
+    - `tstheme.exe`
+"""
+    print_info(title, content)
 
-def destination_artifacts(target_ip, open_ports):
-    title = "Destination File System Artifacts"
-    content = (
-        f"- Prefetch: `C:\\Windows\\Prefetch\\`\n"
-        f"  - Tracks execution of `rdpclip.exe` and `tstheme.exe`"
-    )
-    run_command(title, content, target_ip, open_ports)
 
-def extra_info(target_ip, open_ports):
-    title = "Extra Information"
-    content = (
-        f"- [RDP Authentication vs. Authorization - 13Cubed](https://youtu.be/OlENso8_u7s)\n"
-        f"- Key Concepts:\n"
-        f"  - RDP_NLA (Network Level Authentication)\n"
-        f"  - RDP_successful_logon event codes\n"
-        f"    - 1149 > 4624 type 10 (established) OR 7 (reconnect) > 21 > 22\n"
-        f"  - Understand authentication failures vs. authorization successes"
-    )
-    run_command(title, content, target_ip, open_ports)
+def source_artifacts():
+    title = "RDP Source File System Artifacts"
+    content = """
+- Jumplists - `C:\\Users\\<Username>\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\`
+    - `{MSTSC-APPID}-automaticDestinations-ms`
+    - Tracks remote desktop connection destination and times
+- [[Prefetch]] – `C:\\Windows\\Prefetch\\`
+    - `mstsc.exe-{hash}.pf`
+- [[Bitmap_Cache]] – `C:\\Users\\<Username>\\AppData\\Local\\Microsoft\\TerminalServer Client\\Cache`
+    - bcache##.bmc
+    - cache####.bin
+- Default.rdp file –
+    - `C:\\Users\\<Username>\\Documents\\`
+"""
+    print_info(title, content)
 
-def run_all_rdp_checks(target_ip, open_ports):
-    title = "Run All RDP Checks"
-    content = "Executing all RDP persistence checks. Please wait..."
-    run_command(title, content, target_ip, open_ports)
 
-    # Sequentially run all functions
-    source_event_logs(target_ip, open_ports)
-    destination_event_logs(target_ip, open_ports)
-    source_registry(target_ip, open_ports)
-    destination_registry(target_ip, open_ports)
-    source_artifacts(target_ip, open_ports)
-    destination_artifacts(target_ip, open_ports)
-    extra_info(target_ip, open_ports)
+def destination_artifacts():
+    title = "RDP Destination File System Artifacts"
+    content = """
+- Prefetch – `C:\\Windows\\Prefetch\\`
+- `rdpclip.exe-{hash}.pf`
+- `tstheme.exe-{hash}.pf`
+"""
+    print_info(title, content)
+
+
+def extra_rdp_info():
+    title = "RDP Extra Information"
+    content = """
+# RDP Authentication vs. Authorization
+- RDP authentication happens prior to session establishment (NLA).
+- Know when authentication can fail and authorization can succeed.
+
+# RDP Event Flow
+1149 > 4624 (type 10) OR 7 (reconnect) > 21 > 22
+- 1149: Authentication succeeded
+- 4624: Account successfully logged on
+- 21: Session logon succeeded
+- 22: Shell start notification received
+"""
+    print_info(title, content)
+
+def all_rdp_info():
+    source_event_logs()
+    destination_event_logs()
+    source_registry()
+    destination_registry()
+    source_artifacts()
+    destination_artifacts()
+    extra_rdp_info()