Merge remote-tracking branch 'upstream/develop' into attack_bugfixes

monkey/common/utils/attack_utils.py

@@ -15,12 +15,13 @@ class UsageEnum(Enum):
            ScanStatus.SCANNED.value: "SMB exploiter failed to run the monkey by creating a service via MS-SCMR."}
     MIMIKATZ = {ScanStatus.USED.value: "Windows module loader was used to load Mimikatz DLL.",
                 ScanStatus.SCANNED.value: "Monkey tried to load Mimikatz DLL, but failed."}
-    MIMIKATZ_FILE_COPY = {ScanStatus.USED.value: "WinAPI was called to load mimikatz.",
-                          ScanStatus.SCANNED.value: "Monkey tried to call WinAPI to load mimikatz, but failed."}
-    SINGLETON_FILE_COPY = {ScanStatus.USED.value: "WinAPI was called to acquire system singleton for monkey's process.",
-                           ScanStatus.SCANNED.value: "WinAPI call to acquire system singleton"
-                                                     " for monkey process wasn't successful."}
-    DROPPER_FILE_COPY = {ScanStatus.USED.value: "WinAPI was used to mark monkey files for deletion on next boot."}
+    MIMIKATZ_WINAPI = {ScanStatus.USED.value: "WinAPI was called to load mimikatz.",
+                       ScanStatus.SCANNED.value: "Monkey tried to call WinAPI to load mimikatz."}
+    DROPPER = {ScanStatus.USED.value: "WinAPI was used to mark monkey files for deletion on next boot."}
+    SINGLETON_WINAPI = {ScanStatus.USED.value: "WinAPI was called to acquire system singleton for monkey's process.",
+                        ScanStatus.SCANNED.value: "WinAPI call to acquire system singleton"
+                                                  " for monkey process wasn't successful."}
+    DROPPER_WINAPI = {ScanStatus.USED.value: "WinAPI was used to mark monkey files for deletion on next boot."}
 
 
 # Dict that describes what BITS job was used for

monkey/infection_monkey/control.py

@@ -125,6 +125,7 @@ class ControlClient(object):
     @staticmethod
     def send_telemetry(telem_category, data):
         if not WormConfiguration.current_server:
+            LOG.error("Trying to send %s telemetry before current server is established, aborting." % telem_category)
             return
         try:
             telemetry = {'monkey_guid': GUID, 'telem_category': telem_category, 'data': data}

monkey/infection_monkey/dropper.py

@@ -158,6 +158,6 @@ class MonkeyDrops(object):
                     else:
                         LOG.debug("Dropper source file '%s' is marked for deletion on next boot",
                                   self._config['source_path'])
-                        T1106Telem(ScanStatus.USED, UsageEnum.DROPPER_FILE_COPY).send()
+                        T1106Telem(ScanStatus.USED, UsageEnum.DROPPER_WINAPI).send()
         except AttributeError:
             LOG.error("Invalid configuration options. Failing")

monkey/infection_monkey/system_info/mimikatz_collector.py

@@ -55,8 +55,8 @@ class MimikatzCollector(object):
         except Exception:
             LOG.exception("Error initializing mimikatz collector")
             status = ScanStatus.SCANNED
+        T1106Telem(status, UsageEnum.MIMIKATZ_WINAPI).send()
         T1129Telem(status, UsageEnum.MIMIKATZ).send()
-        T1106Telem(status, UsageEnum.MIMIKATZ_FILE_COPY).send()
 
     def get_logon_info(self):
         """

monkey/infection_monkey/system_singleton.py

@@ -59,7 +59,7 @@ class WindowsSystemSingleton(_SystemSingleton):
 
         if not status:
             status = ScanStatus.USED
-        T1106Telem(status, UsageEnum.SINGLETON_FILE_COPY).send()
+        T1106Telem(status, UsageEnum.SINGLETON_WINAPI).send()
         if status == ScanStatus.SCANNED:
             return False
 

monkey/infection_monkey/telemetry/attack/t1106_telem.py

@@ -4,8 +4,8 @@ from infection_monkey.telemetry.attack.usage_telem import UsageTelem
 class T1106Telem(UsageTelem):
     def __init__(self, status, usage):
         """
-        T1129 telemetry.
+        T1106 telemetry.
         :param status: ScanStatus of technique
-        :param usage: UsageEnum type value
+        :param usage: Enum name of UsageEnum
         """
         super(T1106Telem, self).__init__("T1106", status, usage)

monkey/infection_monkey/telemetry/attack/usage_telem.py

@@ -7,10 +7,10 @@ class UsageTelem(AttackTelem):
         """
         :param technique: Id of technique
         :param status: ScanStatus of technique
-        :param usage: Enum of UsageEnum type
+        :param usage: Usage string
         """
         super(UsageTelem, self).__init__(technique, status)
-        self.usage = usage.name
+        self.usage = usage
 
     def get_data(self):
         data = super(UsageTelem, self).get_data()

monkey/monkey_island/cc/services/attack/technique_reports/T1035.py

@@ -13,7 +13,5 @@ class T1035(UsageTechnique):
     @staticmethod
     def get_report_data():
         data = T1035.get_tech_base_data()
-        services = list(mongo.db.telemetry.aggregate(T1035.get_usage_query()))
-        services = list(map(T1035.parse_usages, services))
-        data.update({'services': services})
+        data.update({'services': T1035.get_usage_data()})
         return data

monkey/monkey_island/cc/services/attack/technique_reports/T1106.py

@@ -1,10 +1,9 @@
-from monkey_island.cc.database import mongo
-from monkey_island.cc.services.attack.technique_reports import AttackTechnique
+from monkey_island.cc.services.attack.technique_reports import UsageTechnique
 
 __author__ = "VakarisZ"
 
 
-class T1106(AttackTechnique):
+class T1106(UsageTechnique):
     tech_id = "T1106"
     unscanned_msg = "Monkey didn't try to directly use WinAPI."
     scanned_msg = "Monkey tried to use WinAPI, but failed."
@@ -13,5 +12,5 @@ class T1106(AttackTechnique):
     @staticmethod
     def get_report_data():
         data = T1106.get_tech_base_data()
-        data.update({'api_uses': list(mongo.db.telemetry.aggregate(T1106.get_usage_query()))})
+        data.update({'api_uses': T1106.get_usage_data()})
         return data

monkey/monkey_island/cc/services/attack/technique_reports/T1129.py

@@ -13,7 +13,5 @@ class T1129(UsageTechnique):
     @staticmethod
     def get_report_data():
         data = T1129.get_tech_base_data()
-        dlls = list(mongo.db.telemetry.aggregate(T1129.get_usage_query()))
-        dlls = list(map(T1129.parse_usages, dlls))
-        data.update({'dlls': dlls})
+        data.update({'dlls': T1129.get_usage_data()})
         return data

monkey/monkey_island/cc/services/attack/technique_reports/__init__.py

@@ -134,6 +134,11 @@ class UsageTechnique(AttackTechnique):
                          "Check if usage enum field exists and covers all telem. statuses.")
         return usage
 
+    @classmethod
+    def get_usage_data(cls):
+        data = list(mongo.db.telemetry.aggregate(cls.get_usage_query()))
+        return list(map(cls.parse_usages, data))
+
     @classmethod
     def get_usage_query(cls):
         """