From 92ddeebd4e571880e3a6754f7a4f6116556955ac Mon Sep 17 00:00:00 2001 From: Mike Salvatore Date: Wed, 16 Feb 2022 14:53:13 -0500 Subject: [PATCH] Island: Add SSHCollector to system info collectors --- .../definitions/system_info_collector_classes.py | 11 ++++++++++- .../monkey_island/cc/services/config_schema/monkey.py | 2 ++ .../monkey_configs/automated_master_config.json | 4 ++-- .../monkey_configs/monkey_config_standard.json | 6 ++---- 4 files changed, 16 insertions(+), 7 deletions(-) diff --git a/monkey/monkey_island/cc/services/config_schema/definitions/system_info_collector_classes.py b/monkey/monkey_island/cc/services/config_schema/definitions/system_info_collector_classes.py index 5e446513c..3f3b8e8ad 100644 --- a/monkey/monkey_island/cc/services/config_schema/definitions/system_info_collector_classes.py +++ b/monkey/monkey_island/cc/services/config_schema/definitions/system_info_collector_classes.py @@ -1,6 +1,7 @@ from common.common_consts.system_info_collectors_names import ( MIMIKATZ_COLLECTOR, PROCESS_LIST_COLLECTOR, + SSH_COLLECTOR, ) SYSTEM_INFO_COLLECTOR_CLASSES = { @@ -11,7 +12,7 @@ SYSTEM_INFO_COLLECTOR_CLASSES = { { "type": "string", "enum": [MIMIKATZ_COLLECTOR], - "title": "Mimikatz Collector", + "title": "Mimikatz Credentials Collector", "safe": True, "info": "Collects credentials from Windows credential manager.", "attack_techniques": ["T1003", "T1005"], @@ -24,5 +25,13 @@ SYSTEM_INFO_COLLECTOR_CLASSES = { "info": "Collects a list of running processes on the machine.", "attack_techniques": ["T1082"], }, + { + "type": "string", + "enum": [SSH_COLLECTOR], + "title": "SSH Credentials Collector", + "safe": True, + "info": "Searches users' home directories and collects SSH keypairs.", + "attack_techniques": ["T1005", "T1145"], + }, ], } diff --git a/monkey/monkey_island/cc/services/config_schema/monkey.py b/monkey/monkey_island/cc/services/config_schema/monkey.py index 80719d4c2..85f975fe1 100644 --- a/monkey/monkey_island/cc/services/config_schema/monkey.py +++ b/monkey/monkey_island/cc/services/config_schema/monkey.py @@ -1,6 +1,7 @@ from common.common_consts.system_info_collectors_names import ( MIMIKATZ_COLLECTOR, PROCESS_LIST_COLLECTOR, + SSH_COLLECTOR, ) MONKEY = { @@ -87,6 +88,7 @@ MONKEY = { "default": [ PROCESS_LIST_COLLECTOR, MIMIKATZ_COLLECTOR, + SSH_COLLECTOR, ], }, }, diff --git a/monkey/tests/data_for_tests/monkey_configs/automated_master_config.json b/monkey/tests/data_for_tests/monkey_configs/automated_master_config.json index e7290d822..6524a169f 100644 --- a/monkey/tests/data_for_tests/monkey_configs/automated_master_config.json +++ b/monkey/tests/data_for_tests/monkey_configs/automated_master_config.json @@ -104,8 +104,8 @@ } }, "system_info_collector_classes": [ - "ProcessListCollector", - "MimikatzCollector" + "MimikatzCollector", + "SSHCollector" ] } } diff --git a/monkey/tests/data_for_tests/monkey_configs/monkey_config_standard.json b/monkey/tests/data_for_tests/monkey_configs/monkey_config_standard.json index 69e6f4416..9552d4da9 100644 --- a/monkey/tests/data_for_tests/monkey_configs/monkey_config_standard.json +++ b/monkey/tests/data_for_tests/monkey_configs/monkey_config_standard.json @@ -146,10 +146,8 @@ }, "system_info": { "system_info_collector_classes": [ - "environmentcollector", - "hostnamecollector", - "processlistcollector", - "mimikatzcollector" + "MimikatzCollector", + "SSHCollector" ] } }