Write 1 of 2 chapter of general conclusion for report using contents below.
Conclusion must contains:
- what I done in my work;
- what results I got.

Contents:
The first chapter reviewed relevant resources on cyberattack techniques using the “execution” mechanism and reviewed case studies of known attacks based on this mechanism. It was found that the “Execution” tactic describes the use by attackers of tools and methods of remote and local execution in the attacked system of various commands, scripts and executable files that were delivered to it at the previous stage.
The MITER ATT&CK database was reviewed, which is a curated knowledge base and behavioral model of cybercriminals that reflects the different stages of an attacker’s attack lifecycle and the platforms they target.
In addition, in the first chapter of the course work, methods for carrying out cyber attacks were discussed, such as scripting, using remote tools of the Windows task scheduler, built-in system utilities regsvr32 and regdll32 for opening snap-in files. It has been discovered that cyber attacks can be carried out using the PowerShell (PS) environment.
Understanding cyberattack techniques and tools is essential to developing effective countermeasures because cybercriminals use a variety of sophisticated tools and techniques to exploit vulnerabilities, perform unauthorized actions, and evade detection.

We will develop a Python script to facilitate the detection of potential cyberattacks by scanning the Windows event log for specific signs of malicious activity according to MITER ATT&CK. The script will use the subprocess module to run PowerShell commands from Python. Events related to the use of PowerShell, abuse of the cmd interpreter and other suspicious activities will be scanned and detected.

Creating detailed logs of command line actions, such as the execution of cmd.exe, powershell.exe, and batch files with their arguments, can greatly enhance your ability to monitor and audit system activity for operational and security purposes. Here’s a detailed guide on how to enable and configure Windows Event Logs for these types of events:

### Step 1: Enable detailed process creation auditing

Windows provides a built-in Group Policy feature to monitor process creation events in detail. Here are the steps to enable it:

1. Open Group Policy Editor:
- Press Win + R to open the Run dialog box.
- Type gpedit.msc and press Enter.

2. Go to the following path:
- Computer Configuration -> Windows Settings -> Security Settings -> Advanced Audit Policy Configuration -> System Audit Policies -> Detailed Tracking.

We will test the developed Python program to analyze the Windows event log and search for suspicious activities, having previously launched the runtime environment as an administrator

As a result of the program’s operation, a report file (threats.txt) was created. Let’s look at its contents in a little more detail.

Time: /Date(1715754067823)/: Represents the timestamp of the event, although formatted in JavaScript date format. It indicates when the event occurred.
- Event ID: 4688: This ID indicates the type of event, which in this case indicates the creation of a new process.
- Information: New process created.: This is a short description of the event in Russian, meaning “New process created.”

### Creator Subject (Creator Subject):
- Security ID (SID): S-1-5-21-957450932-978757485-18214884-1006: This is the Security ID (SID) of the user account that created the process.
- Account Name (Account Name): User: This is the name of the user account that created the process.
- Account Domain (Account Domain): DESKTOP-OMALKUI: This is the domain of the user account that created the process.
- Login ID (Login ID): 0x28977: This is the unique identifier for the login session.

### Target entity (Target entity):
- SID (Security Identifier): S-1-0-0: This indicates that no specific user is associated with this process.
- Account Name: -: Account name is not specified.
- Account Domain (Account Domain): -: Account Domain is not specified.
- Login ID (Login ID): 0x0: A specific login session ID is not associated.

### Process Details (Process Information):
- New Process ID (New Process ID): 0x145c: This is the unique identifier of the newly created process.
- New Process Name (new process name): C:\Windows\System32\cmd.exe: This is the file path of the newly created process executable file.
- Token Elevation Type (Token Elevation Type): %%1936: Specifies the elevation type for the newly created process.
- Mandatory Label (Mandatory Label): S-1-16-8192: This SID indicates the integrity level, in this case medium.
- process-id-create

la (creator process ID): 0x12d4: This is the unique identifier of the process that created the new process.
- Creator Process Name (creator process name): C:\Windows\explorer.exe: This is the file path of the process that created the new process.
- Process command line (process command line): C:\Windows\system32\cmd.exe /c "“C:\Users\user\Desktop\execution.bat” ": This command line specifies exactly how the new process was started . . It shows that cmd.exe was used to run a batch file located in C:\Users\user\Desktop\execution.bat.

Conclusions on the second chapter
In the second chapter of this course work, it was studied and analyzed in detail how Windows operating systems and various GNU/Linux distributions can be configured to achieve an increased level of security and protection against cyber attacks using execution techniques.
Particular attention was paid to methods for configuring and optimizing the security settings of operating systems. In addition, a program (script) in Python was developed to monitor the Windows event log for execution techniques according to MITER ATT&CK. For the program to function properly, you must grant it administrator rights. The program facilitates the timely detection of possible attacks based on the execution technique.
Details of setting up the Windows and GNU/Linux operating systems were disclosed in order to increase their level of security. Tools mentioned include Windows Defender ATP and SRP, and for Linux – SELinux and AppArmor. At the end, a test run of the developed Python script was carried out and it was concluded that using such a program in Python would not provide unambiguous confirmation of the presence of malware in the system, but the data obtained would be useful for further investigation and correlation of events from other sources.