p34709852
/
monkey
forked from p15670423/monkey
1
0
Fork 1
Code Issues Pull Requests Projects Releases Wiki Activity

Agent: Pass telemetry messenger to PBAs for sending ATT&CK telem

This commit is contained in:
Shreya Malviya 2022-03-29 13:24:14 +05:30 committed by vakarisz
parent 8d4c29fc06
commit 1c24411b26
2 changed files with 17 additions and 11 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

17
monkey/infection_monkey/post_breach/actions/users_custom_pba.py
View File

@ -65,8 +65,7 @@ class UsersPBA(PBA):
return True return True
return False return False
@staticmethod def download_pba_file(self, dst_dir, filename):
def download_pba_file(dst_dir, filename):
""" """
Handles post breach action file download Handles post breach action file download
:param dst_dir: Destination directory :param dst_dir: Destination directory
@ -84,12 +83,14 @@ class UsersPBA(PBA):
if not status: if not status:
status = ScanStatus.USED status = ScanStatus.USED
T1105Telem( self._telemetry_messenger.send_telemetry(
status, T1105Telem(
WormConfiguration.current_server.split(":")[0], status,
get_interface_to_target(WormConfiguration.current_server.split(":")[0]), WormConfiguration.current_server.split(":")[0],
filename, get_interface_to_target(WormConfiguration.current_server.split(":")[0]),
).send() filename,
)
)
if status == ScanStatus.SCANNED: if status == ScanStatus.SCANNED:
return False return False

11
monkey/infection_monkey/post_breach/pba.py
View File

@ -5,6 +5,8 @@ from typing import Iterable
from common.utils.attack_utils import ScanStatus from common.utils.attack_utils import ScanStatus
from infection_monkey.i_puppet.i_puppet import PostBreachData from infection_monkey.i_puppet.i_puppet import PostBreachData
from infection_monkey.telemetry.attack.t1064_telem import T1064Telem from infection_monkey.telemetry.attack.t1064_telem import T1064Telem
from infection_monkey.telemetry.messengers.i_telemetry_messenger import ITelemetryMessenger
from infection_monkey.telemetry.post_breach_telem import PostBreachTelem
from infection_monkey.utils.environment import is_windows_os from infection_monkey.utils.environment import is_windows_os
logger = logging.getLogger(__name__) logger = logging.getLogger(__name__)
@ -34,9 +36,12 @@ class PBA:
exec_funct = self._execute_default exec_funct = self._execute_default
result = exec_funct() result = exec_funct()
if self.scripts_were_used_successfully(result): if self.scripts_were_used_successfully(result):
T1064Telem( self.telemetry_messenger.send_telemetry(
ScanStatus.USED, f"Scripts were used to execute {self.name} post breach action." T1064Telem(
).send() ScanStatus.USED,
f"Scripts were used to execute {self.name} post breach action.",
)
)
self.pba_data.append(PostBreachData(self.name, self.command, result)) self.pba_data.append(PostBreachData(self.name, self.command, result))
return self.pba_data return self.pba_data
else: else: