diff --git a/monkey/infection_monkey/post_breach/actions/schedule_jobs.py b/monkey/infection_monkey/post_breach/actions/schedule_jobs.py index 0faddb08b..02cc4e19e 100644 --- a/monkey/infection_monkey/post_breach/actions/schedule_jobs.py +++ b/monkey/infection_monkey/post_breach/actions/schedule_jobs.py @@ -1,7 +1,7 @@ from common.data.post_breach_consts import POST_BREACH_JOB_SCHEDULING from infection_monkey.post_breach.pba import PBA from infection_monkey.post_breach.job_scheduling.job_scheduling import\ - get_commands_to_schedule_jobs + get_commands_to_schedule_jobs, remove_scheduled_jobs class ScheduleJobs(PBA): @@ -11,6 +11,9 @@ class ScheduleJobs(PBA): def __init__(self): linux_cmds, windows_cmds = get_commands_to_schedule_jobs() + super(ScheduleJobs, self).__init__(name=POST_BREACH_JOB_SCHEDULING, linux_cmd=' '.join(linux_cmds), windows_cmd=windows_cmds) + + remove_scheduled_jobs() diff --git a/monkey/infection_monkey/post_breach/job_scheduling/job_scheduling.py b/monkey/infection_monkey/post_breach/job_scheduling/job_scheduling.py index f7fbdf00a..fc93a96a3 100644 --- a/monkey/infection_monkey/post_breach/job_scheduling/job_scheduling.py +++ b/monkey/infection_monkey/post_breach/job_scheduling/job_scheduling.py @@ -1,10 +1,19 @@ +import subprocess from infection_monkey.post_breach.job_scheduling.linux.job_scheduling import\ get_linux_commands_to_schedule_jobs from infection_monkey.post_breach.job_scheduling.windows.job_scheduling import\ - get_windows_commands_to_schedule_jobs + get_windows_commands_to_schedule_jobs,\ + get_windows_commands_to_remove_scheduled_jobs +from infection_monkey.utils.environment import is_windows_os def get_commands_to_schedule_jobs(): linux_cmds = get_linux_commands_to_schedule_jobs() windows_cmds = get_windows_commands_to_schedule_jobs() return linux_cmds, windows_cmds + + +def remove_scheduled_jobs(): + subprocess.run(get_windows_commands_to_remove_scheduled_jobs() if is_windows_os() # noqa: DUO116 + else '', + shell=True) diff --git a/monkey/infection_monkey/post_breach/job_scheduling/windows/job_scheduling.py b/monkey/infection_monkey/post_breach/job_scheduling/windows/job_scheduling.py index 59c77dd9e..d3dcea8d5 100644 --- a/monkey/infection_monkey/post_breach/job_scheduling/windows/job_scheduling.py +++ b/monkey/infection_monkey/post_breach/job_scheduling/windows/job_scheduling.py @@ -1,2 +1,28 @@ +SCHEDULED_TASK_NAME = 'monkey-spawn-cmd' +SCHEDULED_TASK_COMMAND = 'C:\windows\system32\cmd.exe' + + def get_windows_commands_to_schedule_jobs(): - return '' + return [ + 'schtasks', + '/Create', + '/SC', + 'monthly', + '/TN', + SCHEDULED_TASK_NAME, + '/TR', + SCHEDULED_TASK_COMMAND + ] + + +def get_windows_commands_to_remove_scheduled_jobs(): + return [ + 'schtasks', + '/Delete', + '/TN', + SCHEDULED_TASK_NAME, + '/F', + '>', + 'nul', + '2>&1' + ] diff --git a/monkey/monkey_island/cc/services/attack/attack_report.py b/monkey/monkey_island/cc/services/attack/attack_report.py index 8df37a1d3..113dfc942 100644 --- a/monkey/monkey_island/cc/services/attack/attack_report.py +++ b/monkey/monkey_island/cc/services/attack/attack_report.py @@ -4,7 +4,7 @@ from monkey_island.cc.models import Monkey from monkey_island.cc.services.attack.technique_reports import T1210, T1197, T1110, T1075, T1003, T1059, T1086, T1082 from monkey_island.cc.services.attack.technique_reports import T1145, T1105, T1065, T1035, T1129, T1106, T1107, T1188 from monkey_island.cc.services.attack.technique_reports import T1090, T1041, T1222, T1005, T1018, T1016, T1021, T1064 -from monkey_island.cc.services.attack.technique_reports import T1136, T1156, T1504, T1158, T1154, T1166, T1168 +from monkey_island.cc.services.attack.technique_reports import T1136, T1156, T1504, T1158, T1154, T1166, T1168, T1053 from monkey_island.cc.services.attack.attack_config import AttackConfig from monkey_island.cc.database import mongo from monkey_island.cc.services.reporting.report_generation_synchronisation import safe_generate_attack_report @@ -43,7 +43,8 @@ TECHNIQUES = {'T1210': T1210.T1210, 'T1158': T1158.T1158, 'T1154': T1154.T1154, 'T1166': T1166.T1166, - 'T1168': T1168.T1168 + 'T1168': T1168.T1168, + 'T1053': T1053.T1053 } REPORT_NAME = 'new_report' diff --git a/monkey/monkey_island/cc/services/attack/attack_schema.py b/monkey/monkey_island/cc/services/attack/attack_schema.py index 9580ba711..4c9889df3 100644 --- a/monkey/monkey_island/cc/services/attack/attack_schema.py +++ b/monkey/monkey_island/cc/services/attack/attack_schema.py @@ -129,7 +129,6 @@ SCHEMA = { "in certain situations by abusing PowerShell profiles which " "are scripts that run when PowerShell starts." }, -<<<<<<< HEAD "T1053": { "title": "Scheduled task", "type": "bool", @@ -149,18 +148,6 @@ SCHEMA = { "description": "Adversaries can set the setuid or setgid bits to get code running in " "a different user’s context." } -======= - # "T1053": { - # "title": "Scheduled task", - # "type": "bool", - # "value": True, - # "necessary": False, - # "link": "https://attack.mitre.org/techniques/T1053", - # "description": "Windows utilities can be used to schedule programs or scripts to " - # "be executed at a date and time. An adversary may use task scheduling to " - # "execute programs at system startup or on a scheduled basis for persistence." - # }, ->>>>>>> Add T1168 (linux PBA) } }, "defence_evasion": { diff --git a/monkey/monkey_island/cc/services/attack/technique_reports/T1053.py b/monkey/monkey_island/cc/services/attack/technique_reports/T1053.py new file mode 100644 index 000000000..f2b5c6884 --- /dev/null +++ b/monkey/monkey_island/cc/services/attack/technique_reports/T1053.py @@ -0,0 +1,34 @@ +from monkey_island.cc.services.attack.technique_reports import AttackTechnique +from monkey_island.cc.database import mongo +from common.utils.attack_utils import ScanStatus +from common.data.post_breach_consts import POST_BREACH_JOB_SCHEDULING + + +__author__ = "shreyamalviya" + + +class T1053(AttackTechnique): + tech_id = "T1053" + unscanned_msg = "Monkey did not try scheduling a job." + scanned_msg = "Monkey tried scheduling a job on the system but failed." + used_msg = "Monkey scheduled a job on the system." + + query = [{'$match': {'telem_category': 'post_breach', + 'data.name': POST_BREACH_JOB_SCHEDULING}}, + {'$project': {'_id': 0, + 'machine': {'hostname': '$data.hostname', + 'ips': ['$data.ip']}, + 'result': '$data.result'}}] + + @staticmethod + def get_report_data(): + data = {'title': T1053.technique_title()} + + job_scheduling_info = list(mongo.db.telemetry.aggregate(T1053.query)) + + status = (ScanStatus.USED.value if job_scheduling_info[0]['result'][1] + else ScanStatus.SCANNED.value) if job_scheduling_info else ScanStatus.UNSCANNED.value + + data.update(T1053.get_base_data_by_status(status)) + data.update({'info': job_scheduling_info}) + return data diff --git a/monkey/monkey_island/cc/services/config_schema.py b/monkey/monkey_island/cc/services/config_schema.py index 276a7ae37..367c281f7 100644 --- a/monkey/monkey_island/cc/services/config_schema.py +++ b/monkey/monkey_island/cc/services/config_schema.py @@ -198,7 +198,7 @@ SCHEMA = { "ScheduleJobs" ], "title": "Job scheduling", - "attack_techniques": ["T1168"] + "attack_techniques": ["T1168", "T1053"] } ], }, diff --git a/monkey/monkey_island/cc/ui/src/components/attack/techniques/T1053.js b/monkey/monkey_island/cc/ui/src/components/attack/techniques/T1053.js new file mode 100644 index 000000000..11a27e156 --- /dev/null +++ b/monkey/monkey_island/cc/ui/src/components/attack/techniques/T1053.js @@ -0,0 +1,45 @@ +import React from 'react'; +import ReactTable from 'react-table'; +import {renderMachineFromSystemData, ScanStatus} from './Helpers'; +import MitigationsComponent from './MitigationsComponent'; + +class T1053 extends React.Component { + + constructor(props) { + super(props); + } + + static getColumns() { + return ([{ + columns: [ + { Header: 'Machine', + id: 'machine', + accessor: x => renderMachineFromSystemData(x.machine), + style: {'whiteSpace': 'unset'}}, + { Header: 'Result', + id: 'result', + accessor: x => x.result, + style: {'whiteSpace': 'unset'}} + ] + }]) + } + + render() { + return ( +
+
{this.props.data.message}
+
+ {this.props.data.status === ScanStatus.USED ? + : ''} + +
+ ); + } +} + +export default T1053;