Modify "unscanned" messages for some techniques

+ other tiny changes in techniques' messages
This commit is contained in:
Shreya 2020-07-18 00:26:54 +05:30
parent d313985661
commit 740dc43727
3 changed files with 9 additions and 9 deletions

View File

@ -8,7 +8,7 @@ __author__ = "shreyamalviya"
class T1156(PostBreachTechnique):
tech_id = "T1156"
unscanned_msg = "Monkey did not try modifying bash startup files on the system."
scanned_msg = "Monkey tried modifying bash startup files on the system but failed."
used_msg = "Monkey modified bash startup files on the system."
unscanned_msg = "Monkey didn't try modifying bash startup files since it found no Linux machines."
scanned_msg = "Monkey tried modifying bash startup files but failed."
used_msg = "Monkey successfully modified bash startup files."
pba_names = [POST_BREACH_SHELL_STARTUP_FILE_MODIFICATION]

View File

@ -7,7 +7,7 @@ __author__ = "shreyamalviya"
class T1166(PostBreachTechnique):
tech_id = "T1166"
unscanned_msg = "Monkey did not try creating hidden files or folders."
scanned_msg = "Monkey tried creating hidden files and folders on the system but failed."
used_msg = "Monkey created hidden files and folders on the system."
unscanned_msg = "Monkey didn't try setting the setuid or setgid bits since it found no Linux machines."
scanned_msg = "Monkey tried setting the setuid or setgid bits but failed."
used_msg = "Monkey successfully set the setuid or setgid bits."
pba_names = [POST_BREACH_SETUID_SETGID]

View File

@ -8,7 +8,7 @@ __author__ = "shreyamalviya"
class T1504(PostBreachTechnique):
tech_id = "T1504"
unscanned_msg = "Monkey did not try modifying powershell startup files on the system."
scanned_msg = "Monkey tried modifying powershell startup files on the system but failed."
used_msg = "Monkey modified powershell startup files on the system."
unscanned_msg = "Monkey didn't try modifying powershell startup files since it found no Windows machines."
scanned_msg = "Monkey tried modifying powershell startup files but failed."
used_msg = "Monkey successfully modified powershell startup files."
pba_names = [POST_BREACH_SHELL_STARTUP_FILE_MODIFICATION]