From b9a5ac1fe4b3822bb340e98a7b93df0fabf1191d Mon Sep 17 00:00:00 2001
From: VakarisZ <vakarisz@yahoo.com>
Date: Thu, 22 Aug 2019 14:04:45 +0300
Subject: [PATCH] Refactored: scripting telemetry is send as a string, without
 using UsageEnum

---
 monkey/infection_monkey/post_breach/pba.py    | 19 ++++++++++++-------
 .../telemetry/attack/t1064_telem.py           | 14 +++++++++++---
 .../attack/technique_reports/T1064.py         |  6 ++++--
 3 files changed, 27 insertions(+), 12 deletions(-)

diff --git a/monkey/infection_monkey/post_breach/pba.py b/monkey/infection_monkey/post_breach/pba.py
index e3eb533ae..86addd009 100644
--- a/monkey/infection_monkey/post_breach/pba.py
+++ b/monkey/infection_monkey/post_breach/pba.py
@@ -47,20 +47,25 @@ class PBA(object):
         """
         exec_funct = self._execute_default
         result = exec_funct()
-        if self.scripts_were_used(result):
-            T1064Telem(ScanStatus.USED, "Scripts used to execute %s post breach action." % self.name).send()
+        if self.scripts_were_used_successfully(result):
+            T1064Telem(ScanStatus.USED, "Scripts were used to execute %s post breach action." % self.name).send()
         PostBreachTelem(self, result).send()
 
-    def scripts_were_used(self, pba_execution_result):
+    def is_script(self):
         """
-        Determines if scripts were used to execute PBA
+        Determines if PBA is a script (PBA might be a single command)
+        :return: True if PBA is a script(series of OS commands)
+        """
+        return isinstance(self.command, list) and len(self.command) > 1
+
+    def scripts_were_used_successfully(self, pba_execution_result):
+        """
+        Determines if scripts were used to execute PBA and if they succeeded
         :param pba_execution_result: result of execution function. e.g. self._execute_default
         :return: True if scripts were used, False otherwise
         """
         pba_execution_succeeded = pba_execution_result[1]
-        if pba_execution_succeeded and isinstance(self.command, list) and len(self.command) > 1:
-            return True
-        return False
+        return pba_execution_succeeded and self.is_script()
 
     def _execute_default(self):
         """
diff --git a/monkey/infection_monkey/telemetry/attack/t1064_telem.py b/monkey/infection_monkey/telemetry/attack/t1064_telem.py
index fcb3c0bff..efea27063 100644
--- a/monkey/infection_monkey/telemetry/attack/t1064_telem.py
+++ b/monkey/infection_monkey/telemetry/attack/t1064_telem.py
@@ -1,11 +1,19 @@
-from infection_monkey.telemetry.attack.usage_telem import UsageTelem
+from infection_monkey.telemetry.attack.usage_telem import AttackTelem
 
 
-class T1064Telem(UsageTelem):
+class T1064Telem(AttackTelem):
     def __init__(self, status, usage):
         """
         T1064 telemetry.
         :param status: ScanStatus of technique
         :param usage: Usage string
         """
-        super(T1064Telem, self).__init__('T1064', status, usage)
+        super(T1064Telem, self).__init__('T1064', status)
+        self.usage = usage
+
+    def get_data(self):
+        data = super(T1064Telem, self).get_data()
+        data.update({
+            'usage': self.usage
+        })
+        return data
diff --git a/monkey/monkey_island/cc/services/attack/technique_reports/T1064.py b/monkey/monkey_island/cc/services/attack/technique_reports/T1064.py
index 9137f99e4..0b1b05489 100644
--- a/monkey/monkey_island/cc/services/attack/technique_reports/T1064.py
+++ b/monkey/monkey_island/cc/services/attack/technique_reports/T1064.py
@@ -1,16 +1,18 @@
 from monkey_island.cc.services.attack.technique_reports.usage_technique import UsageTechnique
+from monkey_island.cc.database import mongo
 
 __author__ = "VakarisZ"
 
 
 class T1064(UsageTechnique):
     tech_id = "T1064"
-    unscanned_msg = "Monkey didn't run scripts."
+    unscanned_msg = "Monkey didn't run scripts or tried to run and failed."
     scanned_msg = ""
     used_msg = "Monkey ran scripts on machines in the network."
 
     @staticmethod
     def get_report_data():
         data = T1064.get_tech_base_data()
-        data.update({'scripts': T1064.get_usage_data()})
+        script_usages = list(mongo.db.telemetry.aggregate(T1064.get_usage_query()))
+        data.update({'scripts': script_usages})
         return data