p20319658
/
monkey
forked from p34709852/monkey
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

Add T1504 report data + modify T1156 report data

This commit is contained in:
Shreya 2020-06-15 17:45:23 +05:30
parent 1b040dc874
commit 8bb5096add
2 changed files with 48 additions and 9 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
monkey/monkey_island/cc/services/attack/technique_reports/T1156.py
View File

@ -24,6 +24,7 @@ class T1156(AttackTechnique):
if node['pba_results'] != 'None':
for pba in node['pba_results']:
if pba['name'] == POST_BREACH_SHELL_STARTUP_FILE_MODIFICATION:
if 'powershell.exe' not in pba['command']:
status = ScanStatus.USED.value if pba['result'][1]\
else ScanStatus.SCANNED.value
data['info'].append({

38
monkey/monkey_island/cc/services/attack/technique_reports/T1504.py Normal file
View File

@ -0,0 +1,38 @@
from monkey_island.cc.services.attack.technique_reports import AttackTechnique
from monkey_island.cc.services.reporting.report import ReportService
from common.utils.attack_utils import ScanStatus
from common.data.post_breach_consts import POST_BREACH_SHELL_STARTUP_FILE_MODIFICATION
__author__ = "shreyamalviya"
class T1504(AttackTechnique):
tech_id = "T1504"
unscanned_msg = "Monkey did not try modifying shell startup files on the system."
scanned_msg = "Monkey tried modifying shell startup files on the system but failed."
used_msg = "Monkey modified shell startup files on the system."
@staticmethod
def get_report_data():
data = {'title': T1504.technique_title(), 'info': []}
scanned_nodes = ReportService.get_scanned()
status = ScanStatus.UNSCANNED.value
for node in scanned_nodes:
if node['pba_results'] != 'None':
for pba in node['pba_results']:
if pba['name'] == POST_BREACH_SHELL_STARTUP_FILE_MODIFICATION:
if 'powershell.exe' in pba['command']:
status = ScanStatus.USED.value if pba['result'][1]\
else ScanStatus.SCANNED.value
data['info'].append({
'machine': {
'hostname': pba['hostname'],
'ips': node['ip_addresses']
},
'result': pba['result'][0].replace('#', '')
})
data.update(T1504.get_base_data_by_status(status))
return data