Fixed bug created during merge, fixed typos in attack telemetries for usage.

This commit is contained in:
VakarisZ 2019-08-19 09:16:14 +03:00
parent e774fcaff6
commit 7eab8687c1
5 changed files with 9 additions and 11 deletions

View File

@ -18,12 +18,10 @@ class UsageEnum(Enum):
MIMIKATZ_WINAPI = {ScanStatus.USED.value: "WinAPI was called to load mimikatz.",
ScanStatus.SCANNED.value: "Monkey tried to call WinAPI to load mimikatz."}
DROPPER = {ScanStatus.USED.value: "WinAPI was used to mark monkey files for deletion on next boot."}
MIMIKATZ_FILE_COPY = {ScanStatus.USED.value: "WinAPI was called to load mimikatz.",
ScanStatus.SCANNED.value: "Monkey tried to call WinAPI to load mimikatz, but failed."}
SINGLETON_FILE_COPY = {ScanStatus.USED.value: "WinAPI was called to acquire system singleton for monkey's process.",
SINGLETON_WINAPI = {ScanStatus.USED.value: "WinAPI was called to acquire system singleton for monkey's process.",
ScanStatus.SCANNED.value: "WinAPI call to acquire system singleton"
" for monkey process wasn't successful."}
DROPPER_FILE_COPY = {ScanStatus.USED.value: "WinAPI was used to mark monkey files for deletion on next boot."}
DROPPER_WINAPI = {ScanStatus.USED.value: "WinAPI was used to mark monkey files for deletion on next boot."}
# Dict that describes what BITS job was used for

View File

@ -158,6 +158,6 @@ class MonkeyDrops(object):
else:
LOG.debug("Dropper source file '%s' is marked for deletion on next boot",
self._config['source_path'])
T1106Telem(ScanStatus.USED, UsageEnum.DROPPER_FILE_COPY).send()
T1106Telem(ScanStatus.USED, UsageEnum.DROPPER_WINAPI).send()
except AttributeError:
LOG.error("Invalid configuration options. Failing")

View File

@ -55,8 +55,8 @@ class MimikatzCollector(object):
except Exception:
LOG.exception("Error initializing mimikatz collector")
status = ScanStatus.SCANNED
T1106Telem(status, UsageEnum.MIMIKATZ_WINAPI).send()
T1129Telem(status, UsageEnum.MIMIKATZ).send()
T1106Telem(status, UsageEnum.MIMIKATZ_FILE_COPY).send()
def get_logon_info(self):
"""

View File

@ -59,7 +59,7 @@ class WindowsSystemSingleton(_SystemSingleton):
if not status:
status = ScanStatus.USED
T1106Telem(status, UsageEnum.SINGLETON_FILE_COPY).send()
T1106Telem(status, UsageEnum.SINGLETON_WINAPI).send()
if status == ScanStatus.SCANNED:
return False

View File

@ -7,10 +7,10 @@ class UsageTelem(AttackTelem):
"""
:param technique: Id of technique
:param status: ScanStatus of technique
:param usage: Enum of UsageEnum type
:param usage: Usage string
"""
super(UsageTelem, self).__init__(technique, status)
self.usage = usage.name
self.usage = usage
def get_data(self):
data = super(UsageTelem, self).get_data()