Backdoor Detection & Creation Toolkit with Enumeration · Hacking Project

Develop a lab toolkit that both creates persistence backdoors and enumerates/detects them, mapping each to ATT&CK and remediation guidance.

**The problem**
Attackers plant persistence backdoors — web shells, cron/service implants, SUID abuses, malicious startup entries — that survive reboots and evade casual inspection. Defenders who cannot recognize how backdoors are created and hidden struggle to enumerate and eradicate them during incident response. Bridging the offensive creation and defensive detection perspectives is essential to hardening systems.

**What you'll build**
Build a dual-purpose lab toolkit: an offensive side that plants representative backdoors and persistence mechanisms across Linux/Windows in an isolated range, and a defensive side that enumerates the host (users, services, cron, autoruns, listening ports, file integrity) to detect and report them. Map every technique to MITRE ATT&CK persistence tactics and produce hardening/remediation guidance. Strict lab-only scoping and reversibility are enforced.

**Objective** — Develop a lab toolkit that both creates persistence backdoors and enumerates/detects them, mapping each to ATT&CK and remediation guidance.

**Expected outcome** — A paired create/detect toolkit that plants and then reliably enumerates and reports common backdoors in a lab, with an ATT&CK-mapped detection and hardening report.

**Difficulty** — Advanced — spans OS internals, persistence tradecraft, and host enumeration/detection on two platforms.

**Primary category** — Persistence & Post-Exploitation / Host Enumeration; Secondary = Incident Response, System Hardening, DFIR

**Security domains** — Primary = Purple Team; Secondary = Red Team, Blue Team, Incident Response, Digital Forensics

**Technical focus** — web shells, cron/scheduled-task persistence, systemd/service implants, registry Run keys, SUID/setuid abuse, SSH key/authorized_keys backdoors, host enumeration, autoruns analysis, file integrity monitoring, ATT&CK persistence mapping, remediation/hardening

**Core technologies** — Languages: Python, Bash, PowerShell, C; Frameworks/Libraries: psutil, WMI/CIM, osquery; Security Tools: LinPEAS/WinPEAS, Sysinternals Autoruns, chkrootkit/rkhunter, osquery, Wazuh; Cloud/Infra: isolated Linux/Windows VMs, snapshotting; AI/Data: anomaly scoring of enumeration output; Databases: SQLite for findings/baseline

**Where it's valued** — IR/DFIR firms, MSSPs, enterprise blue teams, red-team consultancies, managed detection & response

**Careers it builds toward** — Incident Responder, Purple Team Engineer, Threat Hunter, System Hardening/Blue Team Engineer, Penetration Tester

**Framework alignment**
• MITRE ATT&CK: Persistence — Server Software Component: Web Shell (T1505.003), Scheduled Task/Job (T1053), Create or Modify System Process (T1543), Boot/Logon Autostart Execution (T1547), Account Manipulation: SSH Authorized Keys (T1098.004); Privilege Escalation — Setuid/Setgid (T1548.001); Discovery — Network Service Discovery (T1046), Process Discovery (T1057)
• NIST CSF 2.0: Detect (enumeration/detection) and Protect (hardening); supports Respond and Recover (eradication guidance)
• OWASP: Web Top 10 A03 Injection / A01 Broken Access Control (web-shell vector); otherwise host-focused
• CIS Controls v8: 4 (Secure Configuration), 5 (Account Management), 8 (Audit Log Management), 10 (Malware Defenses)

**Innovation** — Improved Existing Solution — enumeration and rootkit-check tools exist, but a unified create-and-detect purple-team kit with ATT&CK mapping is strong training IP. Scores: Innovation 6/10, Startup 5/10, Enterprise-Readiness 6/10, Patent = No.