p15670423
/
monkey
1
0
Fork 5
Code Issues Pull Requests 3 Projects Releases Wiki Activity

island: Move T1216's details from T1216.py to attack_schema.py so that it's 

shown in the config instead of the ATT&CK report
This commit is contained in:
Shreya Malviya 2021-09-22 18:23:17 +05:30
parent ba2207b21d
commit 9564fb1aaa
2 changed files with 6 additions and 13 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
monkey/monkey_island/cc/services/attack/attack_schema.py
View File

@ -214,9 +214,10 @@ SCHEMA = {
"value": False,
"necessary": False,
"link": "https://attack.mitre.org/techniques/T1216",
"description": "Adversaries may use scripts signed with "
"trusted certificates to "
"proxy execution of malicious files on Windows systems.",
"description": "Adversaries may use scripts signed with trusted certificates "
"to proxy execution of malicious files on Windows systems. This behavior could "
"be abused by adversaries to execute malicious files that could bypass "
"application control and signature validation on systems.",
},
},
},

12
monkey/monkey_island/cc/services/attack/technique_reports/T1216.py
View File

@ -6,22 +6,14 @@ class T1216(PostBreachTechnique):
tech_id = "T1216"
unscanned_msg = (
"Monkey didn't attempt to execute an arbitrary program with the help of a "
+ "pre-existing signed script since it didn't run on any Windows machines. "
+ "If successful, this behavior could be abused by adversaries to execute malicious "
"files that could " + "bypass application control and signature validation on "
"systems."
"pre-existing signed script since it didn't run on any Windows machines. "
)
scanned_msg = (
"Monkey attempted to execute an arbitrary program with the help of a "
+ "pre-existing signed script on Windows but failed. "
+ "If successful, this behavior could be abused by adversaries to execute malicious "
"files that could " + "bypass application control and signature validation on "
"systems."
"pre-existing signed script on Windows but failed. "
)
used_msg = (
"Monkey executed an arbitrary program with the help of a pre-existing signed script "
"on Windows. "
+ "This behavior could be abused by adversaries to execute malicious files that could "
+ "bypass application control and signature validation on systems."
)
pba_names = [POST_BREACH_SIGNED_SCRIPT_PROXY_EXEC]