p34709852
/
monkey
forked from p15670423/monkey
1
0
Fork 1
Code Issues Pull Requests Projects Releases Wiki Activity

Document PostBreachTechnique class

This commit is contained in:
Shreya 2020-07-14 17:58:19 +05:30
parent 50aa068639
commit 41f2994c22
1 changed files with 17 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

22
monkey/monkey_island/cc/services/attack/technique_reports/pba_technique.py
View File

@ -7,6 +7,8 @@ from monkey_island.cc.services.attack.technique_reports import AttackTechnique
class PostBreachTechnique(AttackTechnique, metaclass=abc.ABCMeta): class PostBreachTechnique(AttackTechnique, metaclass=abc.ABCMeta):
""" Class for ATT&CK report components of post-breach actions """
@property @property
@abc.abstractmethod @abc.abstractmethod
def pba_names(self): def pba_names(self):
@ -17,6 +19,12 @@ class PostBreachTechnique(AttackTechnique, metaclass=abc.ABCMeta):
@classmethod @classmethod
def get_pba_query(cls, post_breach_action_names): def get_pba_query(cls, post_breach_action_names):
"""
:param post_breach_action_names: Names of post-breach actions with which the technique is associated
(example - `["Communicate as new user", "Backdoor user"]` for T1136)
:return: Mongo query that parses attack telemetries for a simple report component
(gets machines and post-breach action usage).
"""
return [{'$match': {'telem_category': 'post_breach', return [{'$match': {'telem_category': 'post_breach',
'$or': [{'data.name': pba_name} for pba_name in post_breach_action_names]}}, '$or': [{'data.name': pba_name} for pba_name in post_breach_action_names]}},
{'$project': {'_id': 0, {'$project': {'_id': 0,
@ -26,15 +34,19 @@ class PostBreachTechnique(AttackTechnique, metaclass=abc.ABCMeta):
@classmethod @classmethod
def get_report_data(cls): def get_report_data(cls):
"""
:return: Technique's report data aggregated from the database
"""
data = {'title': cls.technique_title(), 'info': []} data = {'title': cls.technique_title(), 'info': []}
info = list(mongo.db.telemetry.aggregate(cls.get_pba_query(cls.pba_names))) info = list(mongo.db.telemetry.aggregate(cls.get_pba_query(cls.pba_names)))
status = [] if info:
for pba_node in info: successful_PBAs = mongo.db.telemetry.count({
status.append(pba_node['result'][1]) '$or': [{'data.name': pba_name} for pba_name in post_breach_action_names],
status = (ScanStatus.USED.value if any(status) else ScanStatus.SCANNED.value)\ 'data.result.1': True
if status else ScanStatus.UNSCANNED.value })
status = ScanStatus.USED.value if successful_PBAs else ScanStatus.SCANNED.value
data.update(cls.get_base_data_by_status(status)) data.update(cls.get_base_data_by_status(status))
data.update({'info': info}) data.update({'info': info})