In this section of the course,
we'll focus on the strategies and tools
that enable attackers to maintain presence
within a compromised system over extended periods of time.
Persistence involves a lot of different methods
that attackers use to gain continuous, long-term access
to systems after initial exploitation.
These techniques are important
for deepening control over the system,
watching the data flow for long periods of time,
and maintaining access despite restarts, password changes,
or other disruptions.
The domain in this section will be centered around Domain 5,
Post-exploitation and Lateral Movement.
Objective 5.1 will be our main focus in this section,
which states that given the scenario,
we must perform tasks to maintain and establish presence.
First, we'll kick things off
by exploring Command and Control techniques,
which are methods by which compromised systems
are controlled remotely by an attacker.
Understanding C2 frameworks and protocols
help in both setting up robust attack foundations
and defending against them.
Next, we'll discuss Automating Persistence.
This includes automating scheduled tasks
to reinstate back doors using service creation
to reestablish C2 channels
and tweak different configurations to recover credentials
if the connection is interrupted.
Following that, Remote Shells will be covered.
Remote shells such as reverse and binding shells
are foundational for maintaining control over a system,
allowing for real-time command execution and data removal.
We'll then move on to a hands-on demo
using remote shells,
where you'll learn to set up and utilize these shells
to maintain access with Metasploit.
Backdoors will be examined next,
discovering how we can install root kits
and other things within systems to allow for sneaky reentry
even after initial access points are closed.
To further demonstrate back doors,
a demo of Remote Access Trojans will follow,
showing practical application
using these advanced mail row tools
designed to provide elevated administrative control
over system widely.
Next, Account Credentials will be explored
to understand how attackers gather and use credentials
to maintain access by moving laterally through the network
or reestablish access as needed.
Following that, Browser-Based Persistence will be discussed,
focusing on how browser extensions can be used
to maintain persistence through web browsers.
Lastly, Security Control Tampering will be covered,
which involves manipulating or disabling security software,
like firewall, antivirus, and logs,
to hide your presence and activities on the whole system.
Finally, we'll take a short quiz
to see what you learned during this section of the course
and review each of those quiz questions fully
to ensure you can explain why each answer was right.
So, if you're ready to learn about the techniques
and tools for maintaining access,
let's begin our section on persistence.