WEBVTT

00:00:01.740 --> 00:00:02.490
Before we go,

00:00:02.490 --> 00:00:05.540
I want to share with you a few more resources in case you want

00:00:05.540 --> 00:00:08.119
to learn about Impacket and persistence.

00:00:08.119 --> 00:00:10.140
First, and most important,

00:00:10.140 --> 00:00:14.480
check the official documentation from Impacket. In this course, we

00:00:14.480 --> 00:00:18.170
covered just one of the features of the tool. But the reality is

00:00:18.170 --> 00:00:22.050
that Impacket has several other features, like SMB servers and

00:00:22.050 --> 00:00:24.600
relays, network packet manipulation,

00:00:24.610 --> 00:00:27.250
Active Directory reconnaissance, and much more.

00:00:29.240 --> 00:00:32.689
Also, if you want to improve your red teaming game, I do recommend

00:00:32.689 --> 00:00:36.530
you two courses here from Pluralsight. First, the Privilege

00:00:36.530 --> 00:00:40.030
Escalation with Rubeus in which you'll learn a few interesting

00:00:40.030 --> 00:00:42.150
techniques to getting admin access.

00:00:43.540 --> 00:00:47.860
Also, I recommend the Post Exploitation with Meterpreter, which, as the

00:00:47.860 --> 00:00:51.510
name suggests, covers all the activities after getting initial access to a

00:00:51.510 --> 00:00:56.290
server. And also, if you're wondering how you can protect your company

00:00:56.300 --> 00:00:59.080
against the persistent attacks that we've been discussing here, I have a

00:00:59.080 --> 00:01:03.670
few suggestions. First, it is a good idea to use an endpoint protection

00:01:03.670 --> 00:01:09.370
tool that is able to monitor WMI events and triggers. Attackers love to use

00:01:09.370 --> 00:01:14.210
WMI to create persistence and execute malicious code. So if you can monitor

00:01:14.210 --> 00:01:18.670
it, you can prevent it. Also, you could adopt network behavior defense

00:01:18.670 --> 00:01:22.780
tool, so then you can detect reverse shell beacons. The payload that we

00:01:22.780 --> 00:01:25.650
used in the demo iterates packets in regular intervals.

00:01:26.040 --> 00:01:31.000
So, network behavior tools can detect those beacons and alert you.

00:01:31.000 --> 00:01:35.490
So that's it. That's the end of our Impacket course. I hope you

00:01:35.490 --> 00:01:38.410
enjoyed what you learned, and now you have one more persistent

00:01:38.410 --> 00:01:39.850
technique in your skill set.

00:01:40.540 --> 00:01:43.360
So, thank you for watching, and I will see you in the next course.