134 lines
4.2 KiB
Python
134 lines
4.2 KiB
Python
import sys
|
||
from Modules.Imports.ttp_imports import *
|
||
from Modules.submenu import build_submenu
|
||
|
||
def map_share_submenu():
|
||
"""
|
||
Submenu for Map Share detection techniques.
|
||
"""
|
||
actions = {
|
||
"1": {"description": "Source Event Logs", "function": source_event_logs},
|
||
"2": {"description": "Destination Event Logs", "function": destination_event_logs},
|
||
"3": {"description": "Source Registry", "function": source_registry},
|
||
"4": {"description": "Destination Registry", "function": destination_registry},
|
||
"5": {"description": "Source File System", "function": source_file_system},
|
||
"6": {"description": "Destination File System", "function": destination_file_system},
|
||
}
|
||
build_submenu("Map Share Persistence", actions)
|
||
|
||
# Individual submenu functions
|
||
|
||
def source_event_logs():
|
||
"""
|
||
Displays source event logs related to map shares.
|
||
"""
|
||
title = "Map Share Source Event Logs"
|
||
content = """
|
||
- `security.evtx`
|
||
- `4648` - Logon specifying alternate credentials
|
||
- Current logged-on User Name
|
||
- Alternate User Name
|
||
- Destination Host Name/IP
|
||
- Process Name
|
||
- `Microsoft-Windows-SmbClient\\Security.evtx`
|
||
- `31001` – Failed logon to destination
|
||
- Destination Host Name
|
||
- User Name for failed logon
|
||
- Reason code for failed destination logon (e.g., bad password)
|
||
"""
|
||
print_info(title, content)
|
||
|
||
def destination_event_logs():
|
||
"""
|
||
Displays destination event logs related to map shares.
|
||
"""
|
||
title = "Map Share Destination Event Logs"
|
||
content = """
|
||
- **Security Event Log – `security.evtx`**
|
||
- `4624`
|
||
- Logon Type 3
|
||
- Source IP/Logon User Name
|
||
- `4672`
|
||
- Logon User Name
|
||
- Logon by user with administrative rights
|
||
- Requirement for accessing default shares such as **C$** and **ADMIN$**
|
||
- `4776` - NTLM if authenticating to Local System
|
||
- Source Host Name/Logon User Name
|
||
- `4768` - TGT Granted
|
||
- Source Host Name/Logon User Name
|
||
- Available only on domain controller
|
||
- `4769` - Service Ticket Granted if authenticating to Domain Controller
|
||
- Destination Host Name/Logon User Name
|
||
- Source IP
|
||
- Available only on domain controller
|
||
- `5140`
|
||
- Share Access
|
||
- `5145`
|
||
- Auditing of shared files – **NOISY**!
|
||
"""
|
||
print_info(title, content)
|
||
|
||
def source_registry():
|
||
"""
|
||
Displays source registry information related to map shares.
|
||
"""
|
||
title = "Map Share Source Registry"
|
||
content = """
|
||
- **MountPoints2** - Remotely mapped shares
|
||
- `NTUSER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2`
|
||
- **Shellbags** - USRCLASS.DAT
|
||
- Remote folders accessed inside an interactive session via Explorer by attackers.
|
||
- **ShimCache** – SYSTEM
|
||
- `net.exe`
|
||
- `net1.exe`
|
||
- **BAM_DAM** – NTUSER.DAT – Last Time Executed
|
||
- `net.exe`
|
||
- `net1.exe`
|
||
- **AmCache.hve** - First Time Executed
|
||
- `net.exe`
|
||
- `net1.exe`
|
||
"""
|
||
print_info(title, content)
|
||
|
||
def destination_registry():
|
||
"""
|
||
Displays destination registry information related to map shares.
|
||
"""
|
||
title = "Map Share Destination Registry"
|
||
content = """
|
||
- N/A
|
||
"""
|
||
print_info(title, content)
|
||
|
||
def source_file_system():
|
||
"""
|
||
Displays source file system artifacts related to map shares.
|
||
"""
|
||
title = "Map Share Source File System"
|
||
content = """
|
||
- **Prefetch** - `C:\\Windows\\Prefetch\\`
|
||
- `net.exe-{hash}.pf`
|
||
- `net1.exe-{hash}.pf`
|
||
- **User Profile Artifacts**
|
||
- Review shortcut files and jumplists for remote files accessed by attackers if they had interactive access (RDP).
|
||
"""
|
||
print_info(title, content)
|
||
|
||
def destination_file_system():
|
||
"""
|
||
Displays destination file system artifacts related to map shares.
|
||
"""
|
||
title = "Map Share Destination File System"
|
||
content = """
|
||
- **File Creation**
|
||
- Attacker's files (malware) copied to the destination system.
|
||
- Look for Modified Time before Creation Time.
|
||
- Creation Time is the time of file copy.
|
||
- **User Access Logging (Servers Only)**
|
||
- `C:\\Windows\\System32\\LogFiles\\Sum`
|
||
- User Name
|
||
- Source IP Address
|
||
- First and Last Access Time
|
||
"""
|
||
print_info(title, content)
|