p20319658
/
monkey
forked from p34709852/monkey
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

Island: Change config schema for process list collection

This commit is contained in:
Shreya Malviya 2022-02-11 22:36:37 +05:30
parent 4839f099a4
commit a8059f021a
4 changed files with 10 additions and 15 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
monkey/monkey_island/cc/services/config_schema/definitions/post_breach_actions.py
View File

@ -94,5 +94,13 @@ POST_BREACH_ACTIONS = {
"info": "Attempts to clear the command history.",
"attack_techniques": ["T1146"],
},
{
"type": "string",
"enum": ["ProcessListCollection"],
"title": "Process List Collector",
"safe": True,
"info": "Collects a list of running processes on the machine.",
"attack_techniques": ["T1082"],
},
],
}

9
monkey/monkey_island/cc/services/config_schema/definitions/system_info_collector_classes.py
View File

@ -1,6 +1,5 @@
from common.common_consts.system_info_collectors_names import (
MIMIKATZ_COLLECTOR,
PROCESS_LIST_COLLECTOR,
)
SYSTEM_INFO_COLLECTOR_CLASSES = {
@ -16,13 +15,5 @@ SYSTEM_INFO_COLLECTOR_CLASSES = {
"info": "Collects credentials from Windows credential manager.",
"attack_techniques": ["T1003", "T1005"],
},
{
"type": "string",
"enum": [PROCESS_LIST_COLLECTOR],
"title": "Process List Collector",
"safe": True,
"info": "Collects a list of running processes on the machine.",
"attack_techniques": ["T1082"],
},
],
}

3
monkey/monkey_island/cc/services/config_schema/monkey.py
View File

@ -1,6 +1,5 @@
from common.common_consts.system_info_collectors_names import (
MIMIKATZ_COLLECTOR,
PROCESS_LIST_COLLECTOR,
)
MONKEY = {
@ -71,6 +70,7 @@ MONKEY = {
"ScheduleJobs",
"Timestomping",
"AccountDiscovery",
"ProcessListCollection",
],
},
},
@ -85,7 +85,6 @@ MONKEY = {
"uniqueItems": True,
"items": {"$ref": "#/definitions/system_info_collector_classes"},
"default": [
PROCESS_LIST_COLLECTOR,
MIMIKATZ_COLLECTOR,
],
},

5
monkey/monkey_island/cc/services/telemetry/processing/system_info_collectors/system_info_telemetry_dispatcher.py
View File

@ -1,16 +1,13 @@
import logging
import typing
from common.common_consts.system_info_collectors_names import PROCESS_LIST_COLLECTOR
from monkey_island.cc.services.telemetry.zero_trust_checks.antivirus_existence import (
check_antivirus_existence,
)
logger = logging.getLogger(__name__)
SYSTEM_INFO_COLLECTOR_TO_TELEMETRY_PROCESSORS = {
PROCESS_LIST_COLLECTOR: [check_antivirus_existence],
}
SYSTEM_INFO_COLLECTOR_TO_TELEMETRY_PROCESSORS = {}
class SystemInfoTelemetryDispatcher(object):