From 7cb0e111ccd41c32a100e40d13de132d856fd293 Mon Sep 17 00:00:00 2001
From: Shreya <shreya.malviya@gmail.com>
Date: Fri, 10 Jul 2020 20:42:37 +0530
Subject: [PATCH 01/40] Refactor PBA report data code

Only with T1158 for now
---
 .../attack/technique_reports/T1158.py         | 26 +-----------
 .../attack/technique_reports/pba_technique.py | 41 +++++++++++++++++++
 2 files changed, 43 insertions(+), 24 deletions(-)
 create mode 100644 monkey/monkey_island/cc/services/attack/technique_reports/pba_technique.py

diff --git a/monkey/monkey_island/cc/services/attack/technique_reports/T1158.py b/monkey/monkey_island/cc/services/attack/technique_reports/T1158.py
index 2db37bbbe..382fa6489 100644
--- a/monkey/monkey_island/cc/services/attack/technique_reports/T1158.py
+++ b/monkey/monkey_island/cc/services/attack/technique_reports/T1158.py
@@ -6,31 +6,9 @@ from monkey_island.cc.services.attack.technique_reports import AttackTechnique
 __author__ = "shreyamalviya"
 
 
-class T1158(AttackTechnique):
+class T1158(PostBreachTechnique):
     tech_id = "T1158"
     unscanned_msg = "Monkey did not try creating hidden files or folders."
     scanned_msg = "Monkey tried creating hidden files and folders on the system but failed."
     used_msg = "Monkey created hidden files and folders on the system."
-
-    query = [{'$match': {'telem_category': 'post_breach',
-                         'data.name': POST_BREACH_HIDDEN_FILES}},
-             {'$project': {'_id': 0,
-                           'machine': {'hostname': '$data.hostname',
-                                       'ips': ['$data.ip']},
-                           'result': '$data.result'}}]
-
-    @staticmethod
-    def get_report_data():
-        data = {'title': T1158.technique_title(), 'info': []}
-
-        hidden_file_info = list(mongo.db.telemetry.aggregate(T1158.query))
-
-        status = []
-        for pba_node in hidden_file_info:
-            status.append(pba_node['result'][1])
-        status = (ScanStatus.USED.value if any(status) else ScanStatus.SCANNED.value)\
-            if status else ScanStatus.UNSCANNED.value
-
-        data.update(T1158.get_base_data_by_status(status))
-        data.update({'info': hidden_file_info})
-        return data
+    pba_name = POST_BREACH_HIDDEN_FILES
diff --git a/monkey/monkey_island/cc/services/attack/technique_reports/pba_technique.py b/monkey/monkey_island/cc/services/attack/technique_reports/pba_technique.py
new file mode 100644
index 000000000..fce4edf70
--- /dev/null
+++ b/monkey/monkey_island/cc/services/attack/technique_reports/pba_technique.py
@@ -0,0 +1,41 @@
+import abc
+
+from monkey_island.cc.services.attack.attack_config import AttackConfig
+from monkey_island.cc.database import mongo
+from common.utils.attack_utils import ScanStatus
+from monkey_island.cc.services.attack.technique_reports import AttackTechnique
+
+
+class PostBreachTechnique(AttackTechnique, metaclass=abc.ABCMeta):
+    @property
+    @abc.abstractmethod
+    def pba_name(self):
+        """
+        :return: name of post breach action
+        """
+        pass
+
+    @classmethod
+    def get_pba_query(cls, post_breach_action_name):
+        return [{'$match': {'telem_category': 'post_breach',
+                            'data.name': post_breach_action_name}},
+                {'$project': {'_id': 0,
+                              'machine': {'hostname': '$data.hostname',
+                                          'ips': ['$data.ip']},
+                              'result': '$data.result'}}]
+
+    @classmethod
+    def get_report_data(cls):
+        data = {'title': cls.technique_title(), 'info': []}
+
+        info = list(mongo.db.telemetry.aggregate(cls.get_pba_query(cls.pba_name)))
+
+        status = []
+        for pba_node in info:
+            status.append(pba_node['result'][1])
+        status = (ScanStatus.USED.value if any(status) else ScanStatus.SCANNED.value)\
+            if status else ScanStatus.UNSCANNED.value
+
+        data.update(cls.get_base_data_by_status(status))
+        data.update({'info': info})
+        return data

From ab91f2486683442b3f8f4bdab771a69b0c92ab77 Mon Sep 17 00:00:00 2001
From: Shreya <shreya.malviya@gmail.com>
Date: Sat, 11 Jul 2020 01:08:41 +0530
Subject: [PATCH 02/40] Add DISABLED status for attack techniques

---
 monkey/common/utils/attack_utils.py           |  2 ++
 .../attack/technique_reports/T1136.py         | 32 ++++---------------
 .../attack/technique_reports/T1156.py         | 29 +++--------------
 .../attack/technique_reports/T1158.py         |  2 +-
 .../attack/technique_reports/T1504.py         | 29 +++--------------
 .../attack/technique_reports/__init__.py      | 18 ++++++++++-
 .../attack/technique_reports/pba_technique.py | 13 +++++---
 .../components/attack/techniques/Helpers.js   |  3 +-
 .../report-components/AttackReport.js         | 16 +++++++---
 .../cc/ui/src/styles/components/Collapse.scss | 11 +++++--
 .../pages/report/ReportAttackMatrix.scss      | 10 ++++++
 11 files changed, 74 insertions(+), 91 deletions(-)

diff --git a/monkey/common/utils/attack_utils.py b/monkey/common/utils/attack_utils.py
index 708bc8f3c..0eadbedcc 100644
--- a/monkey/common/utils/attack_utils.py
+++ b/monkey/common/utils/attack_utils.py
@@ -8,6 +8,8 @@ class ScanStatus(Enum):
     SCANNED = 1
     # Technique was attempted and succeeded
     USED = 2
+    # Techique was disabled
+    DISABLED = 3
 
 
 class UsageEnum(Enum):
diff --git a/monkey/monkey_island/cc/services/attack/technique_reports/T1136.py b/monkey/monkey_island/cc/services/attack/technique_reports/T1136.py
index cb68d3a4f..1bd3ba212 100644
--- a/monkey/monkey_island/cc/services/attack/technique_reports/T1136.py
+++ b/monkey/monkey_island/cc/services/attack/technique_reports/T1136.py
@@ -2,38 +2,18 @@ from common.data.post_breach_consts import (
     POST_BREACH_BACKDOOR_USER, POST_BREACH_COMMUNICATE_AS_NEW_USER)
 from common.utils.attack_utils import ScanStatus
 from monkey_island.cc.database import mongo
+from monkey_island.cc.services.attack.attack_config import AttackConfig
 from monkey_island.cc.services.attack.technique_reports import AttackTechnique
+from monkey_island.cc.services.attack.technique_reports.pba_technique import \
+    PostBreachTechnique
+from monkey_island.cc.services.reporting.report import ReportService
 
 __author__ = "shreyamalviya"
 
 
-class T1136(AttackTechnique):
+class T1136(PostBreachTechnique):
     tech_id = "T1136"
     unscanned_msg = "Monkey didn't try creating a new user on the network's systems."
     scanned_msg = "Monkey tried creating a new user on the network's systems, but failed."
     used_msg = "Monkey created a new user on the network's systems."
-
-    query = [{'$match': {'telem_category': 'post_breach',
-                         '$or': [{'data.name': POST_BREACH_BACKDOOR_USER},
-                                 {'data.name': POST_BREACH_COMMUNICATE_AS_NEW_USER}]}},
-             {'$project': {'_id': 0,
-                           'machine': {'hostname': '$data.hostname',
-                                       'ips': ['$data.ip']},
-                           'result': '$data.result'}}]
-
-    @staticmethod
-    def get_report_data():
-        data = {'title': T1136.technique_title()}
-
-        create_user_info = list(mongo.db.telemetry.aggregate(T1136.query))
-
-        status = ScanStatus.UNSCANNED.value
-        if create_user_info:
-            successful_PBAs = mongo.db.telemetry.count({'$or': [{'data.name': POST_BREACH_BACKDOOR_USER},
-                                                                {'data.name': POST_BREACH_COMMUNICATE_AS_NEW_USER}],
-                                                        'data.result.1': True})
-            status = ScanStatus.USED.value if successful_PBAs else ScanStatus.SCANNED.value
-
-        data.update(T1136.get_base_data_by_status(status))
-        data.update({'info': create_user_info})
-        return data
+    pba_names = [POST_BREACH_BACKDOOR_USER, POST_BREACH_COMMUNICATE_AS_NEW_USER]
diff --git a/monkey/monkey_island/cc/services/attack/technique_reports/T1156.py b/monkey/monkey_island/cc/services/attack/technique_reports/T1156.py
index 4c8f0d11f..48f12f5e3 100644
--- a/monkey/monkey_island/cc/services/attack/technique_reports/T1156.py
+++ b/monkey/monkey_island/cc/services/attack/technique_reports/T1156.py
@@ -3,36 +3,15 @@ from common.data.post_breach_consts import \
 from common.utils.attack_utils import ScanStatus
 from monkey_island.cc.database import mongo
 from monkey_island.cc.services.attack.technique_reports import AttackTechnique
+from monkey_island.cc.services.attack.technique_reports.pba_technique import \
+    PostBreachTechnique
 
 __author__ = "shreyamalviya"
 
 
-class T1156(AttackTechnique):
+class T1156(PostBreachTechnique):
     tech_id = "T1156"
     unscanned_msg = "Monkey did not try modifying bash startup files on the system."
     scanned_msg = "Monkey tried modifying bash startup files on the system but failed."
     used_msg = "Monkey modified bash startup files on the system."
-
-    query = [{'$match': {'telem_category': 'post_breach',
-                         'data.name': POST_BREACH_SHELL_STARTUP_FILE_MODIFICATION,
-                         'data.command': {'$regex': 'bash'}}},
-             {'$project': {'_id': 0,
-                           'machine': {'hostname': '$data.hostname',
-                                       'ips': ['$data.ip']},
-                           'result': '$data.result'}}]
-
-    @staticmethod
-    def get_report_data():
-        data = {'title': T1156.technique_title(), 'info': []}
-
-        bash_modification_info = list(mongo.db.telemetry.aggregate(T1156.query))
-
-        status = []
-        for pba_node in bash_modification_info:
-            status.append(pba_node['result'][1])
-        status = (ScanStatus.USED.value if any(status) else ScanStatus.SCANNED.value)\
-            if status else ScanStatus.UNSCANNED.value
-
-        data.update(T1156.get_base_data_by_status(status))
-        data.update({'info': bash_modification_info})
-        return data
+    pba_names = [POST_BREACH_SHELL_STARTUP_FILE_MODIFICATION]
diff --git a/monkey/monkey_island/cc/services/attack/technique_reports/T1158.py b/monkey/monkey_island/cc/services/attack/technique_reports/T1158.py
index 382fa6489..f83d818c4 100644
--- a/monkey/monkey_island/cc/services/attack/technique_reports/T1158.py
+++ b/monkey/monkey_island/cc/services/attack/technique_reports/T1158.py
@@ -11,4 +11,4 @@ class T1158(PostBreachTechnique):
     unscanned_msg = "Monkey did not try creating hidden files or folders."
     scanned_msg = "Monkey tried creating hidden files and folders on the system but failed."
     used_msg = "Monkey created hidden files and folders on the system."
-    pba_name = POST_BREACH_HIDDEN_FILES
+    pba_names = [POST_BREACH_HIDDEN_FILES]
diff --git a/monkey/monkey_island/cc/services/attack/technique_reports/T1504.py b/monkey/monkey_island/cc/services/attack/technique_reports/T1504.py
index a9aeb38b7..9f6a0fb83 100644
--- a/monkey/monkey_island/cc/services/attack/technique_reports/T1504.py
+++ b/monkey/monkey_island/cc/services/attack/technique_reports/T1504.py
@@ -3,36 +3,15 @@ from common.data.post_breach_consts import \
 from common.utils.attack_utils import ScanStatus
 from monkey_island.cc.database import mongo
 from monkey_island.cc.services.attack.technique_reports import AttackTechnique
+from monkey_island.cc.services.attack.technique_reports.pba_technique import \
+    PostBreachTechnique
 
 __author__ = "shreyamalviya"
 
 
-class T1504(AttackTechnique):
+class T1504(PostBreachTechnique):
     tech_id = "T1504"
     unscanned_msg = "Monkey did not try modifying powershell startup files on the system."
     scanned_msg = "Monkey tried modifying powershell startup files on the system but failed."
     used_msg = "Monkey modified powershell startup files on the system."
-
-    query = [{'$match': {'telem_category': 'post_breach',
-                         'data.name': POST_BREACH_SHELL_STARTUP_FILE_MODIFICATION,
-                         'data.command': {'$regex': 'powershell'}}},
-             {'$project': {'_id': 0,
-                           'machine': {'hostname': '$data.hostname',
-                                       'ips': ['$data.ip']},
-                           'result': '$data.result'}}]
-
-    @staticmethod
-    def get_report_data():
-        data = {'title': T1504.technique_title(), 'info': []}
-
-        powershell_profile_modification_info = list(mongo.db.telemetry.aggregate(T1504.query))
-
-        status = []
-        for pba_node in powershell_profile_modification_info:
-            status.append(pba_node['result'][1])
-        status = (ScanStatus.USED.value if any(status) else ScanStatus.SCANNED.value)\
-            if status else ScanStatus.UNSCANNED.value
-
-        data.update(T1504.get_base_data_by_status(status))
-        data.update({'info': powershell_profile_modification_info})
-        return data
+    pba_names = [POST_BREACH_SHELL_STARTUP_FILE_MODIFICATION]
diff --git a/monkey/monkey_island/cc/services/attack/technique_reports/__init__.py b/monkey/monkey_island/cc/services/attack/technique_reports/__init__.py
index 9b39f30ef..b93e15997 100644
--- a/monkey/monkey_island/cc/services/attack/technique_reports/__init__.py
+++ b/monkey/monkey_island/cc/services/attack/technique_reports/__init__.py
@@ -10,6 +10,9 @@ from monkey_island.cc.services.attack.attack_config import AttackConfig
 logger = logging.getLogger(__name__)
 
 
+disabled_msg = "This technique has been disabled. You can enable it from the configuration page."
+
+
 class AttackTechnique(object, metaclass=abc.ABCMeta):
     """ Abstract class for ATT&CK report components """
 
@@ -68,7 +71,8 @@ class AttackTechnique(object, metaclass=abc.ABCMeta):
                                           'data.technique': cls.tech_id}):
             return ScanStatus.SCANNED.value
         else:
-            return ScanStatus.UNSCANNED.value
+            return ScanStatus.DISABLED.value if not AttackConfig.get_technique_values()[cls.tech_id]\
+                else ScanStatus.UNSCANNED.value
 
     @classmethod
     def get_message_and_status(cls, status):
@@ -77,6 +81,7 @@ class AttackTechnique(object, metaclass=abc.ABCMeta):
         :param status: Enum from common/attack_utils.py integer value
         :return: Dict with message and status
         """
+        status = cls._check_status(status)
         return {'message': cls.get_message_by_status(status), 'status': status}
 
     @classmethod
@@ -86,6 +91,8 @@ class AttackTechnique(object, metaclass=abc.ABCMeta):
         :param status: Enum from common/attack_utils.py integer value
         :return: message string
         """
+        if status == ScanStatus.DISABLED.value:
+            return disabled_msg
         if status == ScanStatus.UNSCANNED.value:
             return cls.unscanned_msg
         elif status == ScanStatus.SCANNED.value:
@@ -117,6 +124,7 @@ class AttackTechnique(object, metaclass=abc.ABCMeta):
 
     @classmethod
     def get_base_data_by_status(cls, status):
+        status = cls._check_status(status)
         data = cls.get_message_and_status(status)
         data.update({'title': cls.technique_title()})
         data.update(cls.get_mitigation_by_status(status))
@@ -124,8 +132,16 @@ class AttackTechnique(object, metaclass=abc.ABCMeta):
 
     @classmethod
     def get_mitigation_by_status(cls, status: ScanStatus) -> dict:
+        status = cls._check_status(status)
         if status == ScanStatus.USED.value:
             mitigation_document = AttackMitigations.get_mitigation_by_technique_id(str(cls.tech_id))
             return {'mitigations': mitigation_document.to_mongo().to_dict()['mitigations']}
         else:
             return {}
+
+    @classmethod
+    def _check_status(cls, status):
+        if status == ScanStatus.UNSCANNED.value:
+            return ScanStatus.DISABLED.value if not AttackConfig.get_technique_values()[cls.tech_id]\
+                    else ScanStatus.UNSCANNED.value
+        return status
diff --git a/monkey/monkey_island/cc/services/attack/technique_reports/pba_technique.py b/monkey/monkey_island/cc/services/attack/technique_reports/pba_technique.py
index fce4edf70..c588bb3c9 100644
--- a/monkey/monkey_island/cc/services/attack/technique_reports/pba_technique.py
+++ b/monkey/monkey_island/cc/services/attack/technique_reports/pba_technique.py
@@ -9,16 +9,17 @@ from monkey_island.cc.services.attack.technique_reports import AttackTechnique
 class PostBreachTechnique(AttackTechnique, metaclass=abc.ABCMeta):
     @property
     @abc.abstractmethod
-    def pba_name(self):
+    def pba_names(self):
         """
         :return: name of post breach action
         """
         pass
 
     @classmethod
-    def get_pba_query(cls, post_breach_action_name):
+    def get_pba_query(cls, post_breach_action_names):
         return [{'$match': {'telem_category': 'post_breach',
-                            'data.name': post_breach_action_name}},
+                            # 'data.name': post_breach_action_name}},
+                            '$or': [{'data.name': pba_name} for pba_name in post_breach_action_names]}},
                 {'$project': {'_id': 0,
                               'machine': {'hostname': '$data.hostname',
                                           'ips': ['$data.ip']},
@@ -28,7 +29,7 @@ class PostBreachTechnique(AttackTechnique, metaclass=abc.ABCMeta):
     def get_report_data(cls):
         data = {'title': cls.technique_title(), 'info': []}
 
-        info = list(mongo.db.telemetry.aggregate(cls.get_pba_query(cls.pba_name)))
+        info = list(mongo.db.telemetry.aggregate(cls.get_pba_query(cls.pba_names)))
 
         status = []
         for pba_node in info:
@@ -36,6 +37,10 @@ class PostBreachTechnique(AttackTechnique, metaclass=abc.ABCMeta):
         status = (ScanStatus.USED.value if any(status) else ScanStatus.SCANNED.value)\
             if status else ScanStatus.UNSCANNED.value
 
+        if status == ScanStatus.UNSCANNED.value and\
+           not AttackConfig.get_technique_values()[cls.tech_id]:
+            status = ScanStatus.DISABLED.value
+
         data.update(cls.get_base_data_by_status(status))
         data.update({'info': info})
         return data
diff --git a/monkey/monkey_island/cc/ui/src/components/attack/techniques/Helpers.js b/monkey/monkey_island/cc/ui/src/components/attack/techniques/Helpers.js
index ebe12f25b..95820b82f 100644
--- a/monkey/monkey_island/cc/ui/src/components/attack/techniques/Helpers.js
+++ b/monkey/monkey_island/cc/ui/src/components/attack/techniques/Helpers.js
@@ -65,5 +65,6 @@ export function renderUsageFields(usages) {
 export const ScanStatus = {
   UNSCANNED: 0,
   SCANNED: 1,
-  USED: 2
+  USED: 2,
+  DISABLED: 3
 };
diff --git a/monkey/monkey_island/cc/ui/src/components/report-components/AttackReport.js b/monkey/monkey_island/cc/ui/src/components/report-components/AttackReport.js
index 5ab7e4f6e..ccc755687 100644
--- a/monkey/monkey_island/cc/ui/src/components/report-components/AttackReport.js
+++ b/monkey/monkey_island/cc/ui/src/components/report-components/AttackReport.js
@@ -62,8 +62,10 @@ class AttackReport extends React.Component {
         return 'collapse-warning';
       case ScanStatus.USED:
         return 'collapse-danger';
-      default:
-        return 'collapse-default';
+      case ScanStatus.UNSCANNED:
+        return 'collapse-unscanned';
+      case ScanStatus.DISABLED:
+        return 'collapse-disabled';
     }
   }
 
@@ -80,15 +82,19 @@ class AttackReport extends React.Component {
 
   renderLegend() {
     return (<div id='header' className='row justify-content-between attack-legend'>
-      <Col xs={4}>
+      <Col xs={3}>
+        <FontAwesomeIcon icon={faCircle} className='technique-disabled'/>
+        <span> - Disabled</span>
+      </Col>
+      <Col xs={3}>
         <FontAwesomeIcon icon={faCircle} className='technique-not-attempted'/>
         <span> - Not attempted</span>
       </Col>
-      <Col xs={4}>
+      <Col xs={3}>
         <FontAwesomeIcon icon={faCircle} className='technique-attempted'/>
         <span> - Tried (but failed)</span>
       </Col>
-      <Col xs={4}>
+      <Col xs={3}>
         <FontAwesomeIcon icon={faCircle} className='technique-used'/>
         <span> - Successfully used</span>
       </Col>
diff --git a/monkey/monkey_island/cc/ui/src/styles/components/Collapse.scss b/monkey/monkey_island/cc/ui/src/styles/components/Collapse.scss
index 5d49b13a0..618bfb15b 100644
--- a/monkey/monkey_island/cc/ui/src/styles/components/Collapse.scss
+++ b/monkey/monkey_island/cc/ui/src/styles/components/Collapse.scss
@@ -1,8 +1,9 @@
 $transition: 300ms cubic-bezier(0.6, 0.3, 0.3, 0.6);
 
 $danger-color: #ebbcba;
+$disabled-color: #b7c2ff;
 $info-color: #ade3eb;
-$default-color: #e0ddde;
+$unscanned-color: #e0ddde;
 $warning-color: #ffe28d;
 
 .collapse-item button {
@@ -50,8 +51,12 @@ $warning-color: #ffe28d;
   background-color: $info-color !important;
 }
 
-.collapse-default {
-  background-color: $default-color !important;
+.collapse-unscanned {
+  background-color: $unscanned-color !important;
+}
+
+.collapse-disabled {
+  background-color: $disabled-color !important;
 }
 
 .collapse-item {
diff --git a/monkey/monkey_island/cc/ui/src/styles/pages/report/ReportAttackMatrix.scss b/monkey/monkey_island/cc/ui/src/styles/pages/report/ReportAttackMatrix.scss
index f6eedf353..4f42f49d9 100644
--- a/monkey/monkey_island/cc/ui/src/styles/pages/report/ReportAttackMatrix.scss
+++ b/monkey/monkey_island/cc/ui/src/styles/pages/report/ReportAttackMatrix.scss
@@ -1,4 +1,5 @@
 // colors
+$disabled: #b7c2ff;
 $not-attempted: #e0ddde;
 $attempted: #ffe28d;
 $used: #ebbcba;
@@ -19,6 +20,11 @@ $black: #3a3a3a;
   color: $black;
 }
 
+.attack-matrix .status-3 {
+  background-color: $disabled !important;
+  color: $black;
+}
+
 .attack-matrix div.rt-td:hover {
     transform: scale(1.08);
     filter: brightness(110%);
@@ -29,6 +35,10 @@ $black: #3a3a3a;
   border-bottom: 1px solid #0000000f;
 }
 
+.technique-disabled {
+  color: $disabled;
+}
+
 .technique-not-attempted {
   color: $not-attempted;
 }

From fa7cff755ff08cc48887907091f17911906a69ee Mon Sep 17 00:00:00 2001
From: Shreya <shreya.malviya@gmail.com>
Date: Sat, 11 Jul 2020 01:38:05 +0530
Subject: [PATCH 03/40] Pass build

---
 .../cc/services/attack/technique_reports/T1136.py            | 5 -----
 .../cc/services/attack/technique_reports/T1156.py            | 3 ---
 .../cc/services/attack/technique_reports/T1158.py            | 5 ++---
 .../cc/services/attack/technique_reports/T1504.py            | 3 ---
 4 files changed, 2 insertions(+), 14 deletions(-)

diff --git a/monkey/monkey_island/cc/services/attack/technique_reports/T1136.py b/monkey/monkey_island/cc/services/attack/technique_reports/T1136.py
index 1bd3ba212..086a1c139 100644
--- a/monkey/monkey_island/cc/services/attack/technique_reports/T1136.py
+++ b/monkey/monkey_island/cc/services/attack/technique_reports/T1136.py
@@ -1,12 +1,7 @@
 from common.data.post_breach_consts import (
     POST_BREACH_BACKDOOR_USER, POST_BREACH_COMMUNICATE_AS_NEW_USER)
-from common.utils.attack_utils import ScanStatus
-from monkey_island.cc.database import mongo
-from monkey_island.cc.services.attack.attack_config import AttackConfig
-from monkey_island.cc.services.attack.technique_reports import AttackTechnique
 from monkey_island.cc.services.attack.technique_reports.pba_technique import \
     PostBreachTechnique
-from monkey_island.cc.services.reporting.report import ReportService
 
 __author__ = "shreyamalviya"
 
diff --git a/monkey/monkey_island/cc/services/attack/technique_reports/T1156.py b/monkey/monkey_island/cc/services/attack/technique_reports/T1156.py
index 48f12f5e3..aa1fe598a 100644
--- a/monkey/monkey_island/cc/services/attack/technique_reports/T1156.py
+++ b/monkey/monkey_island/cc/services/attack/technique_reports/T1156.py
@@ -1,8 +1,5 @@
 from common.data.post_breach_consts import \
     POST_BREACH_SHELL_STARTUP_FILE_MODIFICATION
-from common.utils.attack_utils import ScanStatus
-from monkey_island.cc.database import mongo
-from monkey_island.cc.services.attack.technique_reports import AttackTechnique
 from monkey_island.cc.services.attack.technique_reports.pba_technique import \
     PostBreachTechnique
 
diff --git a/monkey/monkey_island/cc/services/attack/technique_reports/T1158.py b/monkey/monkey_island/cc/services/attack/technique_reports/T1158.py
index f83d818c4..a80bd2e77 100644
--- a/monkey/monkey_island/cc/services/attack/technique_reports/T1158.py
+++ b/monkey/monkey_island/cc/services/attack/technique_reports/T1158.py
@@ -1,7 +1,6 @@
 from common.data.post_breach_consts import POST_BREACH_HIDDEN_FILES
-from common.utils.attack_utils import ScanStatus
-from monkey_island.cc.database import mongo
-from monkey_island.cc.services.attack.technique_reports import AttackTechnique
+from monkey_island.cc.services.attack.technique_reports.pba_technique import \
+    PostBreachTechnique
 
 __author__ = "shreyamalviya"
 
diff --git a/monkey/monkey_island/cc/services/attack/technique_reports/T1504.py b/monkey/monkey_island/cc/services/attack/technique_reports/T1504.py
index 9f6a0fb83..1516bfdee 100644
--- a/monkey/monkey_island/cc/services/attack/technique_reports/T1504.py
+++ b/monkey/monkey_island/cc/services/attack/technique_reports/T1504.py
@@ -1,8 +1,5 @@
 from common.data.post_breach_consts import \
     POST_BREACH_SHELL_STARTUP_FILE_MODIFICATION
-from common.utils.attack_utils import ScanStatus
-from monkey_island.cc.database import mongo
-from monkey_island.cc.services.attack.technique_reports import AttackTechnique
 from monkey_island.cc.services.attack.technique_reports.pba_technique import \
     PostBreachTechnique
 

From c77467079bcc7e0d73df6ae417f1de821e54f006 Mon Sep 17 00:00:00 2001
From: Shreya <shreya.malviya@gmail.com>
Date: Sun, 12 Jul 2020 00:06:06 +0530
Subject: [PATCH 04/40] Small changes

---
 .../cc/services/attack/technique_reports/T1136.py     |  1 +
 .../cc/services/attack/technique_reports/__init__.py  | 11 ++++++-----
 .../attack/technique_reports/pba_technique.py         |  5 -----
 3 files changed, 7 insertions(+), 10 deletions(-)

diff --git a/monkey/monkey_island/cc/services/attack/technique_reports/T1136.py b/monkey/monkey_island/cc/services/attack/technique_reports/T1136.py
index 086a1c139..2022aa3be 100644
--- a/monkey/monkey_island/cc/services/attack/technique_reports/T1136.py
+++ b/monkey/monkey_island/cc/services/attack/technique_reports/T1136.py
@@ -3,6 +3,7 @@ from common.data.post_breach_consts import (
 from monkey_island.cc.services.attack.technique_reports.pba_technique import \
     PostBreachTechnique
 
+
 __author__ = "shreyamalviya"
 
 
diff --git a/monkey/monkey_island/cc/services/attack/technique_reports/__init__.py b/monkey/monkey_island/cc/services/attack/technique_reports/__init__.py
index b93e15997..e237dd5e2 100644
--- a/monkey/monkey_island/cc/services/attack/technique_reports/__init__.py
+++ b/monkey/monkey_island/cc/services/attack/technique_reports/__init__.py
@@ -70,9 +70,10 @@ class AttackTechnique(object, metaclass=abc.ABCMeta):
                                           'data.status': ScanStatus.SCANNED.value,
                                           'data.technique': cls.tech_id}):
             return ScanStatus.SCANNED.value
+        elif not AttackConfig.get_technique_values()[cls.tech_id]:
+            return ScanStatus.DISABLED.value
         else:
-            return ScanStatus.DISABLED.value if not AttackConfig.get_technique_values()[cls.tech_id]\
-                else ScanStatus.UNSCANNED.value
+            return ScanStatus.UNSCANNED.value
 
     @classmethod
     def get_message_and_status(cls, status):
@@ -91,6 +92,7 @@ class AttackTechnique(object, metaclass=abc.ABCMeta):
         :param status: Enum from common/attack_utils.py integer value
         :return: message string
         """
+        status = cls._check_status(status)
         if status == ScanStatus.DISABLED.value:
             return disabled_msg
         if status == ScanStatus.UNSCANNED.value:
@@ -141,7 +143,6 @@ class AttackTechnique(object, metaclass=abc.ABCMeta):
 
     @classmethod
     def _check_status(cls, status):
-        if status == ScanStatus.UNSCANNED.value:
-            return ScanStatus.DISABLED.value if not AttackConfig.get_technique_values()[cls.tech_id]\
-                    else ScanStatus.UNSCANNED.value
+        if status == ScanStatus.UNSCANNED.value and not AttackConfig.get_technique_values()[cls.tech_id]:
+            return ScanStatus.DISABLED.value
         return status
diff --git a/monkey/monkey_island/cc/services/attack/technique_reports/pba_technique.py b/monkey/monkey_island/cc/services/attack/technique_reports/pba_technique.py
index c588bb3c9..ef34eb417 100644
--- a/monkey/monkey_island/cc/services/attack/technique_reports/pba_technique.py
+++ b/monkey/monkey_island/cc/services/attack/technique_reports/pba_technique.py
@@ -18,7 +18,6 @@ class PostBreachTechnique(AttackTechnique, metaclass=abc.ABCMeta):
     @classmethod
     def get_pba_query(cls, post_breach_action_names):
         return [{'$match': {'telem_category': 'post_breach',
-                            # 'data.name': post_breach_action_name}},
                             '$or': [{'data.name': pba_name} for pba_name in post_breach_action_names]}},
                 {'$project': {'_id': 0,
                               'machine': {'hostname': '$data.hostname',
@@ -37,10 +36,6 @@ class PostBreachTechnique(AttackTechnique, metaclass=abc.ABCMeta):
         status = (ScanStatus.USED.value if any(status) else ScanStatus.SCANNED.value)\
             if status else ScanStatus.UNSCANNED.value
 
-        if status == ScanStatus.UNSCANNED.value and\
-           not AttackConfig.get_technique_values()[cls.tech_id]:
-            status = ScanStatus.DISABLED.value
-
         data.update(cls.get_base_data_by_status(status))
         data.update({'info': info})
         return data

From cd7cdf846eeac1f7ff18c1782c57a04f73d281df Mon Sep 17 00:00:00 2001
From: Shreya <shreya.malviya@gmail.com>
Date: Sun, 12 Jul 2020 01:17:14 +0530
Subject: [PATCH 05/40] Change icon for disabled status

---
 .../cc/ui/src/components/report-components/AttackReport.js   | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/monkey/monkey_island/cc/ui/src/components/report-components/AttackReport.js b/monkey/monkey_island/cc/ui/src/components/report-components/AttackReport.js
index ccc755687..5c24ba7a7 100644
--- a/monkey/monkey_island/cc/ui/src/components/report-components/AttackReport.js
+++ b/monkey/monkey_island/cc/ui/src/components/report-components/AttackReport.js
@@ -6,6 +6,7 @@ import {faCircle} from '@fortawesome/free-solid-svg-icons/faCircle';
 import {faRadiation} from '@fortawesome/free-solid-svg-icons/faRadiation';
 import {faEye} from '@fortawesome/free-solid-svg-icons/faEye';
 import {faEyeSlash} from '@fortawesome/free-solid-svg-icons/faEyeSlash';
+import {faToggleOff} from '@fortawesome/free-solid-svg-icons/faToggleOff';
 
 import ReportHeader, {ReportTypes} from './common/ReportHeader';
 import {ScanStatus} from '../attack/techniques/Helpers';
@@ -75,8 +76,10 @@ class AttackReport extends React.Component {
         return <FontAwesomeIcon icon={faEye} className={'technique-status-icon'}/>;
       case ScanStatus.USED:
         return <FontAwesomeIcon icon={faRadiation} className={'technique-status-icon'}/>;
-      default:
+      case ScanStatus.UNSCANNED:
         return <FontAwesomeIcon icon={faEyeSlash} className={'technique-status-icon'}/>;
+      case ScanStatus.DISABLED:
+        return <FontAwesomeIcon icon={faToggleOff} className={'technique-status-icon'}/>;
     }
   }
 

From 50aa068639577e7345acf51b2524957b99d463d1 Mon Sep 17 00:00:00 2001
From: Shreya <shreya.malviya@gmail.com>
Date: Tue, 14 Jul 2020 17:42:49 +0530
Subject: [PATCH 06/40] Add fn to check if disabled in config

---
 .../attack/technique_reports/__init__.py         | 16 ++++++++++------
 1 file changed, 10 insertions(+), 6 deletions(-)

diff --git a/monkey/monkey_island/cc/services/attack/technique_reports/__init__.py b/monkey/monkey_island/cc/services/attack/technique_reports/__init__.py
index e237dd5e2..3930b07dd 100644
--- a/monkey/monkey_island/cc/services/attack/technique_reports/__init__.py
+++ b/monkey/monkey_island/cc/services/attack/technique_reports/__init__.py
@@ -62,16 +62,16 @@ class AttackTechnique(object, metaclass=abc.ABCMeta):
         Gets the status of a certain attack technique.
         :return: ScanStatus numeric value
         """
-        if mongo.db.telemetry.find_one({'telem_category': 'attack',
-                                        'data.status': ScanStatus.USED.value,
-                                        'data.technique': cls.tech_id}):
+        if cls._is_disabled_in_config():
+            return ScanStatus.DISABLED.value
+        elif mongo.db.telemetry.find_one({'telem_category': 'attack',
+                                          'data.status': ScanStatus.USED.value,
+                                          'data.technique': cls.tech_id}):
             return ScanStatus.USED.value
         elif mongo.db.telemetry.find_one({'telem_category': 'attack',
                                           'data.status': ScanStatus.SCANNED.value,
                                           'data.technique': cls.tech_id}):
             return ScanStatus.SCANNED.value
-        elif not AttackConfig.get_technique_values()[cls.tech_id]:
-            return ScanStatus.DISABLED.value
         else:
             return ScanStatus.UNSCANNED.value
 
@@ -143,6 +143,10 @@ class AttackTechnique(object, metaclass=abc.ABCMeta):
 
     @classmethod
     def _check_status(cls, status):
-        if status == ScanStatus.UNSCANNED.value and not AttackConfig.get_technique_values()[cls.tech_id]:
+        if status == ScanStatus.UNSCANNED.value and cls._is_disabled_in_config():
             return ScanStatus.DISABLED.value
         return status
+
+    @classmethod
+    def _is_disabled_in_config(cls):
+        return not AttackConfig.get_technique_values()[cls.tech_id]

From 41f2994c22581c1f8346b5c56c22ca7dab96f15e Mon Sep 17 00:00:00 2001
From: Shreya <shreya.malviya@gmail.com>
Date: Tue, 14 Jul 2020 17:58:19 +0530
Subject: [PATCH 07/40] Document PostBreachTechnique class

---
 .../attack/technique_reports/pba_technique.py | 22 ++++++++++++++-----
 1 file changed, 17 insertions(+), 5 deletions(-)

diff --git a/monkey/monkey_island/cc/services/attack/technique_reports/pba_technique.py b/monkey/monkey_island/cc/services/attack/technique_reports/pba_technique.py
index ef34eb417..f603b757e 100644
--- a/monkey/monkey_island/cc/services/attack/technique_reports/pba_technique.py
+++ b/monkey/monkey_island/cc/services/attack/technique_reports/pba_technique.py
@@ -7,6 +7,8 @@ from monkey_island.cc.services.attack.technique_reports import AttackTechnique
 
 
 class PostBreachTechnique(AttackTechnique, metaclass=abc.ABCMeta):
+    """ Class for ATT&CK report components of post-breach actions """
+
     @property
     @abc.abstractmethod
     def pba_names(self):
@@ -17,6 +19,12 @@ class PostBreachTechnique(AttackTechnique, metaclass=abc.ABCMeta):
 
     @classmethod
     def get_pba_query(cls, post_breach_action_names):
+        """
+        :param post_breach_action_names: Names of post-breach actions with which the technique is associated
+        (example - `["Communicate as new user", "Backdoor user"]` for T1136)
+        :return: Mongo query that parses attack telemetries for a simple report component
+        (gets machines and post-breach action usage).
+        """
         return [{'$match': {'telem_category': 'post_breach',
                             '$or': [{'data.name': pba_name} for pba_name in post_breach_action_names]}},
                 {'$project': {'_id': 0,
@@ -26,15 +34,19 @@ class PostBreachTechnique(AttackTechnique, metaclass=abc.ABCMeta):
 
     @classmethod
     def get_report_data(cls):
+        """
+        :return: Technique's report data aggregated from the database
+        """
         data = {'title': cls.technique_title(), 'info': []}
 
         info = list(mongo.db.telemetry.aggregate(cls.get_pba_query(cls.pba_names)))
 
-        status = []
-        for pba_node in info:
-            status.append(pba_node['result'][1])
-        status = (ScanStatus.USED.value if any(status) else ScanStatus.SCANNED.value)\
-            if status else ScanStatus.UNSCANNED.value
+        if info:
+            successful_PBAs = mongo.db.telemetry.count({
+                '$or': [{'data.name': pba_name} for pba_name in post_breach_action_names],
+                'data.result.1': True
+            })
+            status = ScanStatus.USED.value if successful_PBAs else ScanStatus.SCANNED.value
 
         data.update(cls.get_base_data_by_status(status))
         data.update({'info': info})

From aa599cbb108ddaa79c5d247bbd485dca80f2a658 Mon Sep 17 00:00:00 2001
From: Shreya <shreya.malviya@gmail.com>
Date: Tue, 14 Jul 2020 18:15:15 +0530
Subject: [PATCH 08/40] Keep default

---
 .../src/components/report-components/AttackReport.js   | 10 +++++-----
 .../cc/ui/src/styles/components/Collapse.scss          |  6 +++---
 2 files changed, 8 insertions(+), 8 deletions(-)

diff --git a/monkey/monkey_island/cc/ui/src/components/report-components/AttackReport.js b/monkey/monkey_island/cc/ui/src/components/report-components/AttackReport.js
index 5c24ba7a7..f28e25601 100644
--- a/monkey/monkey_island/cc/ui/src/components/report-components/AttackReport.js
+++ b/monkey/monkey_island/cc/ui/src/components/report-components/AttackReport.js
@@ -63,10 +63,10 @@ class AttackReport extends React.Component {
         return 'collapse-warning';
       case ScanStatus.USED:
         return 'collapse-danger';
-      case ScanStatus.UNSCANNED:
-        return 'collapse-unscanned';
       case ScanStatus.DISABLED:
         return 'collapse-disabled';
+      default:
+        return 'collapse-default';
     }
   }
 
@@ -76,11 +76,11 @@ class AttackReport extends React.Component {
         return <FontAwesomeIcon icon={faEye} className={'technique-status-icon'}/>;
       case ScanStatus.USED:
         return <FontAwesomeIcon icon={faRadiation} className={'technique-status-icon'}/>;
-      case ScanStatus.UNSCANNED:
-        return <FontAwesomeIcon icon={faEyeSlash} className={'technique-status-icon'}/>;
       case ScanStatus.DISABLED:
         return <FontAwesomeIcon icon={faToggleOff} className={'technique-status-icon'}/>;
-    }
+      default:
+        return <FontAwesomeIcon icon={faEyeSlash} className={'technique-status-icon'}/>;
+      }
   }
 
   renderLegend() {
diff --git a/monkey/monkey_island/cc/ui/src/styles/components/Collapse.scss b/monkey/monkey_island/cc/ui/src/styles/components/Collapse.scss
index 618bfb15b..63f503095 100644
--- a/monkey/monkey_island/cc/ui/src/styles/components/Collapse.scss
+++ b/monkey/monkey_island/cc/ui/src/styles/components/Collapse.scss
@@ -3,7 +3,7 @@ $transition: 300ms cubic-bezier(0.6, 0.3, 0.3, 0.6);
 $danger-color: #ebbcba;
 $disabled-color: #b7c2ff;
 $info-color: #ade3eb;
-$unscanned-color: #e0ddde;
+$default-color: #e0ddde;
 $warning-color: #ffe28d;
 
 .collapse-item button {
@@ -51,8 +51,8 @@ $warning-color: #ffe28d;
   background-color: $info-color !important;
 }
 
-.collapse-unscanned {
-  background-color: $unscanned-color !important;
+.collapse-default {
+  background-color: $default-color !important;
 }
 
 .collapse-disabled {

From 82f1e531e7dec391e85d0fae26a2660be4755589 Mon Sep 17 00:00:00 2001
From: Shreya <shreya.malviya@gmail.com>
Date: Tue, 14 Jul 2020 20:24:11 +0530
Subject: [PATCH 09/40] Update after pulling from develop

---
 .../attack/technique_reports/T1154.py         | 28 +++----------------
 .../attack/technique_reports/T1166.py         | 26 ++---------------
 2 files changed, 7 insertions(+), 47 deletions(-)

diff --git a/monkey/monkey_island/cc/services/attack/technique_reports/T1154.py b/monkey/monkey_island/cc/services/attack/technique_reports/T1154.py
index c7bace482..c4ec9a918 100644
--- a/monkey/monkey_island/cc/services/attack/technique_reports/T1154.py
+++ b/monkey/monkey_island/cc/services/attack/technique_reports/T1154.py
@@ -2,35 +2,15 @@ from common.data.post_breach_consts import POST_BREACH_TRAP_COMMAND
 from common.utils.attack_utils import ScanStatus
 from monkey_island.cc.database import mongo
 from monkey_island.cc.services.attack.technique_reports import AttackTechnique
+from monkey_island.cc.services.attack.technique_reports.pba_technique import \
+    PostBreachTechnique
 
 __author__ = "shreyamalviya"
 
 
-class T1154(AttackTechnique):
+class T1154(PostBreachTechnique):
     tech_id = "T1154"
     unscanned_msg = "Monkey did not use the trap command."
     scanned_msg = "Monkey tried using the trap command but failed."
     used_msg = "Monkey used the trap command successfully."
-
-    query = [{'$match': {'telem_category': 'post_breach',
-                         'data.name': POST_BREACH_TRAP_COMMAND}},
-             {'$project': {'_id': 0,
-                           'machine': {'hostname': '$data.hostname',
-                                       'ips': ['$data.ip']},
-                           'result': '$data.result'}}]
-
-    @staticmethod
-    def get_report_data():
-        data = {'title': T1154.technique_title(), 'info': []}
-
-        trap_command_info = list(mongo.db.telemetry.aggregate(T1154.query))
-
-        status = ScanStatus.UNSCANNED.value
-        if trap_command_info:
-            successful_PBAs = mongo.db.telemetry.count({'data.name': POST_BREACH_TRAP_COMMAND,
-                                                        'data.result.1': True})
-            status = ScanStatus.USED.value if successful_PBAs else ScanStatus.SCANNED.value
-
-        data.update(T1154.get_base_data_by_status(status))
-        data.update({'info': trap_command_info})
-        return data
+    pba_names = [POST_BREACH_TRAP_COMMAND]
diff --git a/monkey/monkey_island/cc/services/attack/technique_reports/T1166.py b/monkey/monkey_island/cc/services/attack/technique_reports/T1166.py
index 3c5b9b0bf..075a74ba0 100644
--- a/monkey/monkey_island/cc/services/attack/technique_reports/T1166.py
+++ b/monkey/monkey_island/cc/services/attack/technique_reports/T1166.py
@@ -2,6 +2,8 @@ from common.data.post_breach_consts import POST_BREACH_SETUID_SETGID
 from common.utils.attack_utils import ScanStatus
 from monkey_island.cc.database import mongo
 from monkey_island.cc.services.attack.technique_reports import AttackTechnique
+from monkey_island.cc.services.attack.technique_reports.pba_technique import \
+    PostBreachTechnique
 
 __author__ = "shreyamalviya"
 
@@ -11,26 +13,4 @@ class T1166(AttackTechnique):
     unscanned_msg = "Monkey did not try creating hidden files or folders."
     scanned_msg = "Monkey tried creating hidden files and folders on the system but failed."
     used_msg = "Monkey created hidden files and folders on the system."
-
-    query = [{'$match': {'telem_category': 'post_breach',
-                         'data.name': POST_BREACH_SETUID_SETGID}},
-             {'$project': {'_id': 0,
-                           'machine': {'hostname': '$data.hostname',
-                                       'ips': ['$data.ip']},
-                           'result': '$data.result'}}]
-
-    @staticmethod
-    def get_report_data():
-        data = {'title': T1166.technique_title(), 'info': []}
-
-        setuid_setgid_info = list(mongo.db.telemetry.aggregate(T1166.query))
-
-        status = ScanStatus.UNSCANNED.value
-        if setuid_setgid_info:
-            successful_PBAs = mongo.db.telemetry.count({'data.name': POST_BREACH_SETUID_SETGID,
-                                                        'data.result.1': True})
-            status = ScanStatus.USED.value if successful_PBAs else ScanStatus.SCANNED.value
-
-        data.update(T1166.get_base_data_by_status(status))
-        data.update({'info': setuid_setgid_info})
-        return data
+    pba_names = [POST_BREACH_SETUID_SETGID]

From ed269577b3eb129508cceefbd89e57663d5c10e7 Mon Sep 17 00:00:00 2001
From: Shreya <shreya.malviya@gmail.com>
Date: Wed, 15 Jul 2020 00:32:52 +0530
Subject: [PATCH 10/40] Update after pulling from develop

---
 .../attack/technique_reports/T1053.py         | 26 +++----------------
 .../attack/technique_reports/T1136.py         |  1 -
 .../attack/technique_reports/T1166.py         |  2 +-
 .../attack/technique_reports/T1168.py         | 26 +++----------------
 .../attack/technique_reports/pba_technique.py |  7 ++---
 5 files changed, 13 insertions(+), 49 deletions(-)

diff --git a/monkey/monkey_island/cc/services/attack/technique_reports/T1053.py b/monkey/monkey_island/cc/services/attack/technique_reports/T1053.py
index 7af3978d5..a7db16632 100644
--- a/monkey/monkey_island/cc/services/attack/technique_reports/T1053.py
+++ b/monkey/monkey_island/cc/services/attack/technique_reports/T1053.py
@@ -2,33 +2,15 @@ from common.data.post_breach_consts import POST_BREACH_JOB_SCHEDULING
 from common.utils.attack_utils import ScanStatus
 from monkey_island.cc.database import mongo
 from monkey_island.cc.services.attack.technique_reports import AttackTechnique
+from monkey_island.cc.services.attack.technique_reports.pba_technique import \
+    PostBreachTechnique
 
 __author__ = "shreyamalviya"
 
 
-class T1053(AttackTechnique):
+class T1053(PostBreachTechnique):
     tech_id = "T1053"
     unscanned_msg = "Monkey did not try scheduling a job on Windows."
     scanned_msg = "Monkey tried scheduling a job on the Windows system but failed."
     used_msg = "Monkey scheduled a job on the Windows system."
-
-    query = [{'$match': {'telem_category': 'post_breach',
-                         'data.name': POST_BREACH_JOB_SCHEDULING,
-                         'data.command': {'$regex': 'schtasks'}}},
-             {'$project': {'_id': 0,
-                           'machine': {'hostname': '$data.hostname',
-                                       'ips': ['$data.ip']},
-                           'result': '$data.result'}}]
-
-    @staticmethod
-    def get_report_data():
-        data = {'title': T1053.technique_title()}
-
-        job_scheduling_info = list(mongo.db.telemetry.aggregate(T1053.query))
-
-        status = (ScanStatus.USED.value if job_scheduling_info[0]['result'][1]
-                  else ScanStatus.SCANNED.value) if job_scheduling_info else ScanStatus.UNSCANNED.value
-
-        data.update(T1053.get_base_data_by_status(status))
-        data.update({'info': job_scheduling_info})
-        return data
+    pba_names = [POST_BREACH_JOB_SCHEDULING]
diff --git a/monkey/monkey_island/cc/services/attack/technique_reports/T1136.py b/monkey/monkey_island/cc/services/attack/technique_reports/T1136.py
index 2022aa3be..086a1c139 100644
--- a/monkey/monkey_island/cc/services/attack/technique_reports/T1136.py
+++ b/monkey/monkey_island/cc/services/attack/technique_reports/T1136.py
@@ -3,7 +3,6 @@ from common.data.post_breach_consts import (
 from monkey_island.cc.services.attack.technique_reports.pba_technique import \
     PostBreachTechnique
 
-
 __author__ = "shreyamalviya"
 
 
diff --git a/monkey/monkey_island/cc/services/attack/technique_reports/T1166.py b/monkey/monkey_island/cc/services/attack/technique_reports/T1166.py
index 075a74ba0..3d29ebed6 100644
--- a/monkey/monkey_island/cc/services/attack/technique_reports/T1166.py
+++ b/monkey/monkey_island/cc/services/attack/technique_reports/T1166.py
@@ -8,7 +8,7 @@ from monkey_island.cc.services.attack.technique_reports.pba_technique import \
 __author__ = "shreyamalviya"
 
 
-class T1166(AttackTechnique):
+class T1166(PostBreachTechnique):
     tech_id = "T1166"
     unscanned_msg = "Monkey did not try creating hidden files or folders."
     scanned_msg = "Monkey tried creating hidden files and folders on the system but failed."
diff --git a/monkey/monkey_island/cc/services/attack/technique_reports/T1168.py b/monkey/monkey_island/cc/services/attack/technique_reports/T1168.py
index 48298a7fe..54709b507 100644
--- a/monkey/monkey_island/cc/services/attack/technique_reports/T1168.py
+++ b/monkey/monkey_island/cc/services/attack/technique_reports/T1168.py
@@ -2,33 +2,15 @@ from common.data.post_breach_consts import POST_BREACH_JOB_SCHEDULING
 from common.utils.attack_utils import ScanStatus
 from monkey_island.cc.database import mongo
 from monkey_island.cc.services.attack.technique_reports import AttackTechnique
+from monkey_island.cc.services.attack.technique_reports.pba_technique import \
+    PostBreachTechnique
 
 __author__ = "shreyamalviya"
 
 
-class T1168(AttackTechnique):
+class T1168(PostBreachTechnique):
     tech_id = "T1168"
     unscanned_msg = "Monkey did not try scheduling a job on Linux."
     scanned_msg = "Monkey tried scheduling a job on the Linux system but failed."
     used_msg = "Monkey scheduled a job on the Linux system."
-
-    query = [{'$match': {'telem_category': 'post_breach',
-                         'data.name': POST_BREACH_JOB_SCHEDULING,
-                         'data.command': {'$regex': 'crontab'}}},
-             {'$project': {'_id': 0,
-                           'machine': {'hostname': '$data.hostname',
-                                       'ips': ['$data.ip']},
-                           'result': '$data.result'}}]
-
-    @staticmethod
-    def get_report_data():
-        data = {'title': T1168.technique_title()}
-
-        job_scheduling_info = list(mongo.db.telemetry.aggregate(T1168.query))
-
-        status = (ScanStatus.USED.value if job_scheduling_info[0]['result'][1]
-                  else ScanStatus.SCANNED.value) if job_scheduling_info else ScanStatus.UNSCANNED.value
-
-        data.update(T1168.get_base_data_by_status(status))
-        data.update({'info': job_scheduling_info})
-        return data
+    pba_names = [POST_BREACH_JOB_SCHEDULING]
diff --git a/monkey/monkey_island/cc/services/attack/technique_reports/pba_technique.py b/monkey/monkey_island/cc/services/attack/technique_reports/pba_technique.py
index f603b757e..a7ef96803 100644
--- a/monkey/monkey_island/cc/services/attack/technique_reports/pba_technique.py
+++ b/monkey/monkey_island/cc/services/attack/technique_reports/pba_technique.py
@@ -1,8 +1,8 @@
 import abc
 
-from monkey_island.cc.services.attack.attack_config import AttackConfig
-from monkey_island.cc.database import mongo
 from common.utils.attack_utils import ScanStatus
+from monkey_island.cc.database import mongo
+from monkey_island.cc.services.attack.attack_config import AttackConfig
 from monkey_island.cc.services.attack.technique_reports import AttackTechnique
 
 
@@ -41,9 +41,10 @@ class PostBreachTechnique(AttackTechnique, metaclass=abc.ABCMeta):
 
         info = list(mongo.db.telemetry.aggregate(cls.get_pba_query(cls.pba_names)))
 
+        status = ScanStatus.UNSCANNED.value
         if info:
             successful_PBAs = mongo.db.telemetry.count({
-                '$or': [{'data.name': pba_name} for pba_name in post_breach_action_names],
+                '$or': [{'data.name': pba_name} for pba_name in cls.pba_names],
                 'data.result.1': True
             })
             status = ScanStatus.USED.value if successful_PBAs else ScanStatus.SCANNED.value

From 103b1348b71d7bd9a91cdbde6358bc41553e427f Mon Sep 17 00:00:00 2001
From: Shreya <shreya.malviya@gmail.com>
Date: Fri, 17 Jul 2020 00:31:46 +0530
Subject: [PATCH 11/40] Add hyperlink to configuration page in "disabled"
 status message in MITRE report

---
 .../services/attack/technique_reports/__init__.py   |  3 ++-
 .../components/report-components/AttackReport.js    | 13 ++++++++++---
 2 files changed, 12 insertions(+), 4 deletions(-)

diff --git a/monkey/monkey_island/cc/services/attack/technique_reports/__init__.py b/monkey/monkey_island/cc/services/attack/technique_reports/__init__.py
index 3930b07dd..64b6a13f7 100644
--- a/monkey/monkey_island/cc/services/attack/technique_reports/__init__.py
+++ b/monkey/monkey_island/cc/services/attack/technique_reports/__init__.py
@@ -10,7 +10,8 @@ from monkey_island.cc.services.attack.attack_config import AttackConfig
 logger = logging.getLogger(__name__)
 
 
-disabled_msg = "This technique has been disabled. You can enable it from the configuration page."
+disabled_msg = "This technique has been disabled. " +\
+               "You can enable it from the [configuration page](../../configure)."
 
 
 class AttackTechnique(object, metaclass=abc.ABCMeta):
diff --git a/monkey/monkey_island/cc/ui/src/components/report-components/AttackReport.js b/monkey/monkey_island/cc/ui/src/components/report-components/AttackReport.js
index f28e25601..97f3c1a18 100644
--- a/monkey/monkey_island/cc/ui/src/components/report-components/AttackReport.js
+++ b/monkey/monkey_island/cc/ui/src/components/report-components/AttackReport.js
@@ -7,6 +7,7 @@ import {faRadiation} from '@fortawesome/free-solid-svg-icons/faRadiation';
 import {faEye} from '@fortawesome/free-solid-svg-icons/faEye';
 import {faEyeSlash} from '@fortawesome/free-solid-svg-icons/faEyeSlash';
 import {faToggleOff} from '@fortawesome/free-solid-svg-icons/faToggleOff';
+import marked from 'marked';
 
 import ReportHeader, {ReportTypes} from './common/ReportHeader';
 import {ScanStatus} from '../attack/techniques/Helpers';
@@ -38,14 +39,14 @@ class AttackReport extends React.Component {
     };
     if (typeof this.props.report.schema !== 'undefined' && typeof this.props.report.techniques !== 'undefined'){
       this.state['schema'] = this.props.report['schema'];
-      this.state['techniques'] = AttackReport.addLinksToTechniques(this.props.report['schema'], this.props.report['techniques']);
+      this.state['techniques'] = AttackReport.modifyTechniqueData(this.props.report['schema'], this.props.report['techniques']);
     }
   }
 
   componentDidUpdate(prevProps) {
     if (this.props.report !== prevProps.report) {
      this.setState({schema: this.props.report['schema'],
-      techniques: AttackReport.addLinksToTechniques(this.props.report['schema'], this.props.report['techniques'])})
+      techniques: AttackReport.modifyTechniqueData(this.props.report['schema'], this.props.report['techniques'])})
     }
   }
 
@@ -143,7 +144,8 @@ class AttackReport extends React.Component {
     return false;
   }
 
-  static addLinksToTechniques(schema, techniques){
+  static modifyTechniqueData(schema, techniques){
+    // add links to techniques
     schema = schema.properties;
     for(const type in schema){
       if (! schema.hasOwnProperty(type)) {return false;}
@@ -155,6 +157,11 @@ class AttackReport extends React.Component {
         }
       }
     }
+    // modify techniques' messages
+    for (const tech_id in techniques){
+      techniques[tech_id]['message'] = <div dangerouslySetInnerHTML={{__html: marked(techniques[tech_id]['message'])}} />;
+    }
+
     return techniques
   }
 

From ad771fb2ce7dbb0b7edf09e09e7889624d04d29c Mon Sep 17 00:00:00 2001
From: Shreya <shreya.malviya@gmail.com>
Date: Fri, 17 Jul 2020 00:46:26 +0530
Subject: [PATCH 12/40] Pass build

---
 .../cc/services/attack/technique_reports/T1053.py              | 3 ---
 .../cc/services/attack/technique_reports/T1154.py              | 3 ---
 .../cc/services/attack/technique_reports/T1166.py              | 3 ---
 .../cc/services/attack/technique_reports/T1168.py              | 3 ---
 4 files changed, 12 deletions(-)

diff --git a/monkey/monkey_island/cc/services/attack/technique_reports/T1053.py b/monkey/monkey_island/cc/services/attack/technique_reports/T1053.py
index a7db16632..503ebe1f0 100644
--- a/monkey/monkey_island/cc/services/attack/technique_reports/T1053.py
+++ b/monkey/monkey_island/cc/services/attack/technique_reports/T1053.py
@@ -1,7 +1,4 @@
 from common.data.post_breach_consts import POST_BREACH_JOB_SCHEDULING
-from common.utils.attack_utils import ScanStatus
-from monkey_island.cc.database import mongo
-from monkey_island.cc.services.attack.technique_reports import AttackTechnique
 from monkey_island.cc.services.attack.technique_reports.pba_technique import \
     PostBreachTechnique
 
diff --git a/monkey/monkey_island/cc/services/attack/technique_reports/T1154.py b/monkey/monkey_island/cc/services/attack/technique_reports/T1154.py
index c4ec9a918..03c2040d1 100644
--- a/monkey/monkey_island/cc/services/attack/technique_reports/T1154.py
+++ b/monkey/monkey_island/cc/services/attack/technique_reports/T1154.py
@@ -1,7 +1,4 @@
 from common.data.post_breach_consts import POST_BREACH_TRAP_COMMAND
-from common.utils.attack_utils import ScanStatus
-from monkey_island.cc.database import mongo
-from monkey_island.cc.services.attack.technique_reports import AttackTechnique
 from monkey_island.cc.services.attack.technique_reports.pba_technique import \
     PostBreachTechnique
 
diff --git a/monkey/monkey_island/cc/services/attack/technique_reports/T1166.py b/monkey/monkey_island/cc/services/attack/technique_reports/T1166.py
index 3d29ebed6..d9aee9df5 100644
--- a/monkey/monkey_island/cc/services/attack/technique_reports/T1166.py
+++ b/monkey/monkey_island/cc/services/attack/technique_reports/T1166.py
@@ -1,7 +1,4 @@
 from common.data.post_breach_consts import POST_BREACH_SETUID_SETGID
-from common.utils.attack_utils import ScanStatus
-from monkey_island.cc.database import mongo
-from monkey_island.cc.services.attack.technique_reports import AttackTechnique
 from monkey_island.cc.services.attack.technique_reports.pba_technique import \
     PostBreachTechnique
 
diff --git a/monkey/monkey_island/cc/services/attack/technique_reports/T1168.py b/monkey/monkey_island/cc/services/attack/technique_reports/T1168.py
index 54709b507..9630791c6 100644
--- a/monkey/monkey_island/cc/services/attack/technique_reports/T1168.py
+++ b/monkey/monkey_island/cc/services/attack/technique_reports/T1168.py
@@ -1,7 +1,4 @@
 from common.data.post_breach_consts import POST_BREACH_JOB_SCHEDULING
-from common.utils.attack_utils import ScanStatus
-from monkey_island.cc.database import mongo
-from monkey_island.cc.services.attack.technique_reports import AttackTechnique
 from monkey_island.cc.services.attack.technique_reports.pba_technique import \
     PostBreachTechnique
 

From 172f72b7301f3fca4d5d2f7e20ace45675df2888 Mon Sep 17 00:00:00 2001
From: Shreya <shreya.malviya@gmail.com>
Date: Sat, 18 Jul 2020 00:26:54 +0530
Subject: [PATCH 13/40] Modify "unscanned" messages for some techniques

+ other tiny changes in techniques' messages
---
 .../cc/services/attack/technique_reports/T1035.py           | 2 +-
 .../cc/services/attack/technique_reports/T1053.py           | 2 +-
 .../cc/services/attack/technique_reports/T1075.py           | 2 +-
 .../cc/services/attack/technique_reports/T1086.py           | 2 +-
 .../cc/services/attack/technique_reports/T1129.py           | 6 +++---
 .../cc/services/attack/technique_reports/T1154.py           | 2 +-
 .../cc/services/attack/technique_reports/T1156.py           | 6 +++---
 .../cc/services/attack/technique_reports/T1158.py           | 2 +-
 .../cc/services/attack/technique_reports/T1166.py           | 6 +++---
 .../cc/services/attack/technique_reports/T1168.py           | 2 +-
 .../cc/services/attack/technique_reports/T1197.py           | 2 +-
 .../cc/services/attack/technique_reports/T1504.py           | 6 +++---
 12 files changed, 20 insertions(+), 20 deletions(-)

diff --git a/monkey/monkey_island/cc/services/attack/technique_reports/T1035.py b/monkey/monkey_island/cc/services/attack/technique_reports/T1035.py
index df4ae4ca5..025c9f9a8 100644
--- a/monkey/monkey_island/cc/services/attack/technique_reports/T1035.py
+++ b/monkey/monkey_island/cc/services/attack/technique_reports/T1035.py
@@ -6,7 +6,7 @@ __author__ = "VakarisZ"
 
 class T1035(UsageTechnique):
     tech_id = "T1035"
-    unscanned_msg = "Monkey didn't try to interact with Windows services."
+    unscanned_msg = "Monkey didn't try to interact with Windows services since it found no Windows machines."
     scanned_msg = "Monkey tried to interact with Windows services, but failed."
     used_msg = "Monkey successfully interacted with Windows services."
 
diff --git a/monkey/monkey_island/cc/services/attack/technique_reports/T1053.py b/monkey/monkey_island/cc/services/attack/technique_reports/T1053.py
index 503ebe1f0..103f2409b 100644
--- a/monkey/monkey_island/cc/services/attack/technique_reports/T1053.py
+++ b/monkey/monkey_island/cc/services/attack/technique_reports/T1053.py
@@ -7,7 +7,7 @@ __author__ = "shreyamalviya"
 
 class T1053(PostBreachTechnique):
     tech_id = "T1053"
-    unscanned_msg = "Monkey did not try scheduling a job on Windows."
+    unscanned_msg = "Monkey didn't try scheduling a job on Windows since it found no Windows machines."
     scanned_msg = "Monkey tried scheduling a job on the Windows system but failed."
     used_msg = "Monkey scheduled a job on the Windows system."
     pba_names = [POST_BREACH_JOB_SCHEDULING]
diff --git a/monkey/monkey_island/cc/services/attack/technique_reports/T1075.py b/monkey/monkey_island/cc/services/attack/technique_reports/T1075.py
index 29bbc366c..e8f3a6e4e 100644
--- a/monkey/monkey_island/cc/services/attack/technique_reports/T1075.py
+++ b/monkey/monkey_island/cc/services/attack/technique_reports/T1075.py
@@ -7,7 +7,7 @@ __author__ = "VakarisZ"
 
 class T1075(AttackTechnique):
     tech_id = "T1075"
-    unscanned_msg = "Monkey didn't try to use pass the hash attack."
+    unscanned_msg = "Monkey didn't try to use pass the hash attack since it found no Windows machines."
     scanned_msg = "Monkey tried to use hashes while logging in but didn't succeed."
     used_msg = "Monkey successfully used hashed credentials."
 
diff --git a/monkey/monkey_island/cc/services/attack/technique_reports/T1086.py b/monkey/monkey_island/cc/services/attack/technique_reports/T1086.py
index ad5ddc974..bd164c6af 100644
--- a/monkey/monkey_island/cc/services/attack/technique_reports/T1086.py
+++ b/monkey/monkey_island/cc/services/attack/technique_reports/T1086.py
@@ -7,7 +7,7 @@ __author__ = "VakarisZ"
 
 class T1086(AttackTechnique):
     tech_id = "T1086"
-    unscanned_msg = "Monkey didn't run powershell."
+    unscanned_msg = "Monkey didn't run powershell since it found no Windows machines."
     scanned_msg = ""
     used_msg = "Monkey successfully ran powershell commands on exploited machines in the network."
 
diff --git a/monkey/monkey_island/cc/services/attack/technique_reports/T1129.py b/monkey/monkey_island/cc/services/attack/technique_reports/T1129.py
index fac76fb47..a91803428 100644
--- a/monkey/monkey_island/cc/services/attack/technique_reports/T1129.py
+++ b/monkey/monkey_island/cc/services/attack/technique_reports/T1129.py
@@ -6,9 +6,9 @@ __author__ = "VakarisZ"
 
 class T1129(UsageTechnique):
     tech_id = "T1129"
-    unscanned_msg = "Monkey didn't try to load any DLL's."
-    scanned_msg = "Monkey tried to load DLL's, but failed."
-    used_msg = "Monkey successfully loaded DLL's using Windows module loader."
+    unscanned_msg = "Monkey didn't try to load any DLLs since it found no Windows machines."
+    scanned_msg = "Monkey tried to load DLLs, but failed."
+    used_msg = "Monkey successfully loaded DLLs using Windows module loader."
 
     @staticmethod
     def get_report_data():
diff --git a/monkey/monkey_island/cc/services/attack/technique_reports/T1154.py b/monkey/monkey_island/cc/services/attack/technique_reports/T1154.py
index 03c2040d1..29df2eb65 100644
--- a/monkey/monkey_island/cc/services/attack/technique_reports/T1154.py
+++ b/monkey/monkey_island/cc/services/attack/technique_reports/T1154.py
@@ -7,7 +7,7 @@ __author__ = "shreyamalviya"
 
 class T1154(PostBreachTechnique):
     tech_id = "T1154"
-    unscanned_msg = "Monkey did not use the trap command."
+    unscanned_msg = "Monkey didn't use the trap command since it found no Linux machines."
     scanned_msg = "Monkey tried using the trap command but failed."
     used_msg = "Monkey used the trap command successfully."
     pba_names = [POST_BREACH_TRAP_COMMAND]
diff --git a/monkey/monkey_island/cc/services/attack/technique_reports/T1156.py b/monkey/monkey_island/cc/services/attack/technique_reports/T1156.py
index aa1fe598a..939ebc946 100644
--- a/monkey/monkey_island/cc/services/attack/technique_reports/T1156.py
+++ b/monkey/monkey_island/cc/services/attack/technique_reports/T1156.py
@@ -8,7 +8,7 @@ __author__ = "shreyamalviya"
 
 class T1156(PostBreachTechnique):
     tech_id = "T1156"
-    unscanned_msg = "Monkey did not try modifying bash startup files on the system."
-    scanned_msg = "Monkey tried modifying bash startup files on the system but failed."
-    used_msg = "Monkey modified bash startup files on the system."
+    unscanned_msg = "Monkey didn't try modifying bash startup files since it found no Linux machines."
+    scanned_msg = "Monkey tried modifying bash startup files but failed."
+    used_msg = "Monkey successfully modified bash startup files."
     pba_names = [POST_BREACH_SHELL_STARTUP_FILE_MODIFICATION]
diff --git a/monkey/monkey_island/cc/services/attack/technique_reports/T1158.py b/monkey/monkey_island/cc/services/attack/technique_reports/T1158.py
index a80bd2e77..7b0f87358 100644
--- a/monkey/monkey_island/cc/services/attack/technique_reports/T1158.py
+++ b/monkey/monkey_island/cc/services/attack/technique_reports/T1158.py
@@ -7,7 +7,7 @@ __author__ = "shreyamalviya"
 
 class T1158(PostBreachTechnique):
     tech_id = "T1158"
-    unscanned_msg = "Monkey did not try creating hidden files or folders."
+    unscanned_msg = "Monkey didn't try creating hidden files or folders."
     scanned_msg = "Monkey tried creating hidden files and folders on the system but failed."
     used_msg = "Monkey created hidden files and folders on the system."
     pba_names = [POST_BREACH_HIDDEN_FILES]
diff --git a/monkey/monkey_island/cc/services/attack/technique_reports/T1166.py b/monkey/monkey_island/cc/services/attack/technique_reports/T1166.py
index d9aee9df5..f8aae194d 100644
--- a/monkey/monkey_island/cc/services/attack/technique_reports/T1166.py
+++ b/monkey/monkey_island/cc/services/attack/technique_reports/T1166.py
@@ -7,7 +7,7 @@ __author__ = "shreyamalviya"
 
 class T1166(PostBreachTechnique):
     tech_id = "T1166"
-    unscanned_msg = "Monkey did not try creating hidden files or folders."
-    scanned_msg = "Monkey tried creating hidden files and folders on the system but failed."
-    used_msg = "Monkey created hidden files and folders on the system."
+    unscanned_msg = "Monkey didn't try setting the setuid or setgid bits since it found no Linux machines."
+    scanned_msg = "Monkey tried setting the setuid or setgid bits but failed."
+    used_msg = "Monkey successfully set the setuid or setgid bits."
     pba_names = [POST_BREACH_SETUID_SETGID]
diff --git a/monkey/monkey_island/cc/services/attack/technique_reports/T1168.py b/monkey/monkey_island/cc/services/attack/technique_reports/T1168.py
index 9630791c6..d7390e913 100644
--- a/monkey/monkey_island/cc/services/attack/technique_reports/T1168.py
+++ b/monkey/monkey_island/cc/services/attack/technique_reports/T1168.py
@@ -7,7 +7,7 @@ __author__ = "shreyamalviya"
 
 class T1168(PostBreachTechnique):
     tech_id = "T1168"
-    unscanned_msg = "Monkey did not try scheduling a job on Linux."
+    unscanned_msg = "Monkey didn't try scheduling a job on Linux since it found no Linux machines."
     scanned_msg = "Monkey tried scheduling a job on the Linux system but failed."
     used_msg = "Monkey scheduled a job on the Linux system."
     pba_names = [POST_BREACH_JOB_SCHEDULING]
diff --git a/monkey/monkey_island/cc/services/attack/technique_reports/T1197.py b/monkey/monkey_island/cc/services/attack/technique_reports/T1197.py
index b6bd316af..c967c6239 100644
--- a/monkey/monkey_island/cc/services/attack/technique_reports/T1197.py
+++ b/monkey/monkey_island/cc/services/attack/technique_reports/T1197.py
@@ -6,7 +6,7 @@ __author__ = "VakarisZ"
 
 class T1197(AttackTechnique):
     tech_id = "T1197"
-    unscanned_msg = "Monkey didn't try to use any bits jobs."
+    unscanned_msg = "Monkey didn't try to use any bits jobs since it found no Windows machines."
     scanned_msg = "Monkey tried to use bits jobs but failed."
     used_msg = "Monkey successfully used bits jobs at least once in the network."
 
diff --git a/monkey/monkey_island/cc/services/attack/technique_reports/T1504.py b/monkey/monkey_island/cc/services/attack/technique_reports/T1504.py
index 1516bfdee..5e38b6630 100644
--- a/monkey/monkey_island/cc/services/attack/technique_reports/T1504.py
+++ b/monkey/monkey_island/cc/services/attack/technique_reports/T1504.py
@@ -8,7 +8,7 @@ __author__ = "shreyamalviya"
 
 class T1504(PostBreachTechnique):
     tech_id = "T1504"
-    unscanned_msg = "Monkey did not try modifying powershell startup files on the system."
-    scanned_msg = "Monkey tried modifying powershell startup files on the system but failed."
-    used_msg = "Monkey modified powershell startup files on the system."
+    unscanned_msg = "Monkey didn't try modifying powershell startup files since it found no Windows machines."
+    scanned_msg = "Monkey tried modifying powershell startup files but failed."
+    used_msg = "Monkey successfully modified powershell startup files."
     pba_names = [POST_BREACH_SHELL_STARTUP_FILE_MODIFICATION]

From 2d45439ecb3c10fd05f5e96059f2558d1fc18f0e Mon Sep 17 00:00:00 2001
From: Shreya <shreya.malviya@gmail.com>
Date: Sat, 18 Jul 2020 19:10:34 +0530
Subject: [PATCH 14/40] Add test for AttackTechnique

Issue with `_check_status` function since it tries to fetch from mongodb which doesn't exist in testing env
---
 .../attack_technique_test.py                  | 97 +++++++++++++++++++
 1 file changed, 97 insertions(+)
 create mode 100644 monkey/monkey_island/cc/services/attack/technique_reports/attack_technique_test.py

diff --git a/monkey/monkey_island/cc/services/attack/technique_reports/attack_technique_test.py b/monkey/monkey_island/cc/services/attack/technique_reports/attack_technique_test.py
new file mode 100644
index 000000000..ca58f9fd5
--- /dev/null
+++ b/monkey/monkey_island/cc/services/attack/technique_reports/attack_technique_test.py
@@ -0,0 +1,97 @@
+import json
+from unittest import TestCase
+
+from common.utils.attack_utils import ScanStatus
+from monkey_island.cc.database import mongo
+
+from . import AttackTechnique
+from .pba_technique import PostBreachTechnique
+
+
+class T9999(PostBreachTechnique):
+    tech_id = "T9999"
+    unscanned_msg = "Unscanned"
+    scanned_msg = "Scanned"
+    used_msg = "Used"
+    pba_names = ["PBA Name"]
+
+
+config =\
+    {
+        'category': {
+            'link': '',
+            'properties': {
+                'T9999': {
+                    'description': '',
+                    'link': '',
+                    'necessary': False,
+                    'title': '',
+                    'type': 'bool',
+                    'value': False  # this field denotes whether technique is enabled or disabled in config
+                }
+            }
+        }
+    }
+
+
+def set_config(value: bool):
+    config['category']['properties']['T9999']['value'] = value
+    return config
+
+
+param_list = [
+    # unscanned
+    (
+        {  # telemetry data
+            'info': [],
+            'message': 'Unscanned',
+            'status': 0,
+            'title': 'Unscanned technique'
+        },
+        set_config(True),  # configuration
+        ScanStatus.UNSCANNED.value  # expected status
+    ),
+
+    # scanned
+    (
+        {  # telemetry data
+            'info': [],
+            'message': 'Scanned',
+            'status': 1,
+            'title': 'Scanned technique'
+        },
+        set_config(True),  # configuration
+        ScanStatus.SCANNED.value  # expected status
+    ),
+
+    # used
+    (
+        {  # telemetry data
+            'info': [],
+            'message': 'Used',
+            'status': 2,
+            'title': 'Used technique'
+        },
+        set_config(True),  # configuration
+        ScanStatus.USED.value  # expected status
+    ),
+
+    # disabled
+    (
+        {  # telemetry data
+            'info': [],
+            'message': 'Disabled',
+            'status': 0,
+            'title': 'Disabled technique'
+        },
+        set_config(False),  # configuration
+        ScanStatus.DISABLED.value  # expected status
+    )
+]
+
+
+class TestAttackTechnique(TestCase):
+    def test__check_status(self):
+        for telem_data, config, expected_status in param_list:
+            with self.subTest(msg=f"Checking if correct status is returned (status: {telem_data['message']})"):
+                self.assertEqual(T9999._check_status(telem_data['status']), expected_status)

From 6512d5de1144641eb8fa30fcf12355bfdd0548b3 Mon Sep 17 00:00:00 2001
From: Shreya <shreya.malviya@gmail.com>
Date: Sat, 18 Jul 2020 19:58:53 +0530
Subject: [PATCH 15/40] Pass build

---
 .../services/attack/technique_reports/attack_technique_test.py | 3 ---
 1 file changed, 3 deletions(-)

diff --git a/monkey/monkey_island/cc/services/attack/technique_reports/attack_technique_test.py b/monkey/monkey_island/cc/services/attack/technique_reports/attack_technique_test.py
index ca58f9fd5..43c312e3f 100644
--- a/monkey/monkey_island/cc/services/attack/technique_reports/attack_technique_test.py
+++ b/monkey/monkey_island/cc/services/attack/technique_reports/attack_technique_test.py
@@ -1,10 +1,7 @@
-import json
 from unittest import TestCase
 
 from common.utils.attack_utils import ScanStatus
-from monkey_island.cc.database import mongo
 
-from . import AttackTechnique
 from .pba_technique import PostBreachTechnique
 
 

From 9217581e1cfa4dee120c605d35773f9150524ba6 Mon Sep 17 00:00:00 2001
From: Shreya <shreya.malviya@gmail.com>
Date: Sat, 18 Jul 2020 23:43:47 +0530
Subject: [PATCH 16/40] Add optional parameter 'configuration' in
 _check_status()

---
 .../attack/technique_reports/__init__.py      | 11 ++--
 .../attack_technique_test.py                  | 54 ++++++++++---------
 2 files changed, 36 insertions(+), 29 deletions(-)

diff --git a/monkey/monkey_island/cc/services/attack/technique_reports/__init__.py b/monkey/monkey_island/cc/services/attack/technique_reports/__init__.py
index 64b6a13f7..14bd1012e 100644
--- a/monkey/monkey_island/cc/services/attack/technique_reports/__init__.py
+++ b/monkey/monkey_island/cc/services/attack/technique_reports/__init__.py
@@ -63,7 +63,7 @@ class AttackTechnique(object, metaclass=abc.ABCMeta):
         Gets the status of a certain attack technique.
         :return: ScanStatus numeric value
         """
-        if cls._is_disabled_in_config():
+        if not cls._is_enabled_in_config():
             return ScanStatus.DISABLED.value
         elif mongo.db.telemetry.find_one({'telem_category': 'attack',
                                           'data.status': ScanStatus.USED.value,
@@ -143,11 +143,12 @@ class AttackTechnique(object, metaclass=abc.ABCMeta):
             return {}
 
     @classmethod
-    def _check_status(cls, status):
-        if status == ScanStatus.UNSCANNED.value and cls._is_disabled_in_config():
+    def _check_status(cls, status, *args):
+        enabled_in_config = args[0] if args else cls._is_enabled_in_config()
+        if status == ScanStatus.UNSCANNED.value and not enabled_in_config:
             return ScanStatus.DISABLED.value
         return status
 
     @classmethod
-    def _is_disabled_in_config(cls):
-        return not AttackConfig.get_technique_values()[cls.tech_id]
+    def _is_enabled_in_config(cls):
+        return AttackConfig.get_technique_values()[cls.tech_id]
diff --git a/monkey/monkey_island/cc/services/attack/technique_reports/attack_technique_test.py b/monkey/monkey_island/cc/services/attack/technique_reports/attack_technique_test.py
index 43c312e3f..94facd1b9 100644
--- a/monkey/monkey_island/cc/services/attack/technique_reports/attack_technique_test.py
+++ b/monkey/monkey_island/cc/services/attack/technique_reports/attack_technique_test.py
@@ -13,27 +13,27 @@ class T9999(PostBreachTechnique):
     pba_names = ["PBA Name"]
 
 
-config =\
-    {
-        'category': {
-            'link': '',
-            'properties': {
-                'T9999': {
-                    'description': '',
-                    'link': '',
-                    'necessary': False,
-                    'title': '',
-                    'type': 'bool',
-                    'value': False  # this field denotes whether technique is enabled or disabled in config
-                }
-            }
-        }
-    }
+# config =\
+#     {
+#         'category': {
+#             'link': '',
+#             'properties': {
+#                 'T9999': {
+#                     'description': '',
+#                     'link': '',
+#                     'necessary': False,
+#                     'title': '',
+#                     'type': 'bool',
+#                     'value': False  # this field denotes whether technique is enabled or disabled in config
+#                 }
+#             }
+#         }
+#     }
 
 
-def set_config(value: bool):
-    config['category']['properties']['T9999']['value'] = value
-    return config
+# def set_config(value: bool):
+#     config['category']['properties']['T9999']['value'] = value
+#     return config
 
 
 param_list = [
@@ -45,7 +45,8 @@ param_list = [
             'status': 0,
             'title': 'Unscanned technique'
         },
-        set_config(True),  # configuration
+        # set_config(True),  # configuration
+        True,  # configuration
         ScanStatus.UNSCANNED.value  # expected status
     ),
 
@@ -57,7 +58,8 @@ param_list = [
             'status': 1,
             'title': 'Scanned technique'
         },
-        set_config(True),  # configuration
+        # set_config(True),  # configuration
+        True,  # configuration
         ScanStatus.SCANNED.value  # expected status
     ),
 
@@ -69,7 +71,8 @@ param_list = [
             'status': 2,
             'title': 'Used technique'
         },
-        set_config(True),  # configuration
+        # set_config(True),  # configuration
+        True,  # configuration
         ScanStatus.USED.value  # expected status
     ),
 
@@ -81,7 +84,8 @@ param_list = [
             'status': 0,
             'title': 'Disabled technique'
         },
-        set_config(False),  # configuration
+        # set_config(False),  # configuration
+        False,  # configuration
         ScanStatus.DISABLED.value  # expected status
     )
 ]
@@ -91,4 +95,6 @@ class TestAttackTechnique(TestCase):
     def test__check_status(self):
         for telem_data, config, expected_status in param_list:
             with self.subTest(msg=f"Checking if correct status is returned (status: {telem_data['message']})"):
-                self.assertEqual(T9999._check_status(telem_data['status']), expected_status)
+                # self.assertEqual(T9999._check_status(telem_data['status']), expected_status)
+                self.assertEqual(T9999._check_status(telem_data['status'], config),
+                                 expected_status)

From d25ad3a209bd1d9e1c7b5e4e312b59e61362ee8c Mon Sep 17 00:00:00 2001
From: Shreya <shreya.malviya@gmail.com>
Date: Fri, 10 Jul 2020 20:42:37 +0530
Subject: [PATCH 17/40] Refactor PBA report data code

Only with T1158 for now
---
 .../attack/technique_reports/T1158.py         |  2 +-
 .../attack/technique_reports/pba_technique.py | 35 ++++++-------------
 2 files changed, 12 insertions(+), 25 deletions(-)

diff --git a/monkey/monkey_island/cc/services/attack/technique_reports/T1158.py b/monkey/monkey_island/cc/services/attack/technique_reports/T1158.py
index 7b0f87358..dce2b3adb 100644
--- a/monkey/monkey_island/cc/services/attack/technique_reports/T1158.py
+++ b/monkey/monkey_island/cc/services/attack/technique_reports/T1158.py
@@ -10,4 +10,4 @@ class T1158(PostBreachTechnique):
     unscanned_msg = "Monkey didn't try creating hidden files or folders."
     scanned_msg = "Monkey tried creating hidden files and folders on the system but failed."
     used_msg = "Monkey created hidden files and folders on the system."
-    pba_names = [POST_BREACH_HIDDEN_FILES]
+    pba_name = POST_BREACH_HIDDEN_FILES
diff --git a/monkey/monkey_island/cc/services/attack/technique_reports/pba_technique.py b/monkey/monkey_island/cc/services/attack/technique_reports/pba_technique.py
index a7ef96803..fce4edf70 100644
--- a/monkey/monkey_island/cc/services/attack/technique_reports/pba_technique.py
+++ b/monkey/monkey_island/cc/services/attack/technique_reports/pba_technique.py
@@ -1,32 +1,24 @@
 import abc
 
-from common.utils.attack_utils import ScanStatus
-from monkey_island.cc.database import mongo
 from monkey_island.cc.services.attack.attack_config import AttackConfig
+from monkey_island.cc.database import mongo
+from common.utils.attack_utils import ScanStatus
 from monkey_island.cc.services.attack.technique_reports import AttackTechnique
 
 
 class PostBreachTechnique(AttackTechnique, metaclass=abc.ABCMeta):
-    """ Class for ATT&CK report components of post-breach actions """
-
     @property
     @abc.abstractmethod
-    def pba_names(self):
+    def pba_name(self):
         """
         :return: name of post breach action
         """
         pass
 
     @classmethod
-    def get_pba_query(cls, post_breach_action_names):
-        """
-        :param post_breach_action_names: Names of post-breach actions with which the technique is associated
-        (example - `["Communicate as new user", "Backdoor user"]` for T1136)
-        :return: Mongo query that parses attack telemetries for a simple report component
-        (gets machines and post-breach action usage).
-        """
+    def get_pba_query(cls, post_breach_action_name):
         return [{'$match': {'telem_category': 'post_breach',
-                            '$or': [{'data.name': pba_name} for pba_name in post_breach_action_names]}},
+                            'data.name': post_breach_action_name}},
                 {'$project': {'_id': 0,
                               'machine': {'hostname': '$data.hostname',
                                           'ips': ['$data.ip']},
@@ -34,20 +26,15 @@ class PostBreachTechnique(AttackTechnique, metaclass=abc.ABCMeta):
 
     @classmethod
     def get_report_data(cls):
-        """
-        :return: Technique's report data aggregated from the database
-        """
         data = {'title': cls.technique_title(), 'info': []}
 
-        info = list(mongo.db.telemetry.aggregate(cls.get_pba_query(cls.pba_names)))
+        info = list(mongo.db.telemetry.aggregate(cls.get_pba_query(cls.pba_name)))
 
-        status = ScanStatus.UNSCANNED.value
-        if info:
-            successful_PBAs = mongo.db.telemetry.count({
-                '$or': [{'data.name': pba_name} for pba_name in cls.pba_names],
-                'data.result.1': True
-            })
-            status = ScanStatus.USED.value if successful_PBAs else ScanStatus.SCANNED.value
+        status = []
+        for pba_node in info:
+            status.append(pba_node['result'][1])
+        status = (ScanStatus.USED.value if any(status) else ScanStatus.SCANNED.value)\
+            if status else ScanStatus.UNSCANNED.value
 
         data.update(cls.get_base_data_by_status(status))
         data.update({'info': info})

From 8078acdf7fe6fdf5ea6e6871d05fd977c83e1ecc Mon Sep 17 00:00:00 2001
From: Shreya <shreya.malviya@gmail.com>
Date: Sat, 11 Jul 2020 01:08:41 +0530
Subject: [PATCH 18/40] Add DISABLED status for attack techniques

---
 .../attack/technique_reports/T1136.py         |  5 +++++
 .../attack/technique_reports/T1156.py         |  9 ++++++---
 .../attack/technique_reports/T1158.py         |  2 +-
 .../attack/technique_reports/T1504.py         |  9 ++++++---
 .../attack/technique_reports/__init__.py      | 19 +++++++------------
 .../attack/technique_reports/pba_technique.py | 13 +++++++++----
 .../report-components/AttackReport.js         |  4 ++--
 .../cc/ui/src/styles/components/Collapse.scss | 10 +++++++---
 8 files changed, 43 insertions(+), 28 deletions(-)

diff --git a/monkey/monkey_island/cc/services/attack/technique_reports/T1136.py b/monkey/monkey_island/cc/services/attack/technique_reports/T1136.py
index 086a1c139..1bd3ba212 100644
--- a/monkey/monkey_island/cc/services/attack/technique_reports/T1136.py
+++ b/monkey/monkey_island/cc/services/attack/technique_reports/T1136.py
@@ -1,7 +1,12 @@
 from common.data.post_breach_consts import (
     POST_BREACH_BACKDOOR_USER, POST_BREACH_COMMUNICATE_AS_NEW_USER)
+from common.utils.attack_utils import ScanStatus
+from monkey_island.cc.database import mongo
+from monkey_island.cc.services.attack.attack_config import AttackConfig
+from monkey_island.cc.services.attack.technique_reports import AttackTechnique
 from monkey_island.cc.services.attack.technique_reports.pba_technique import \
     PostBreachTechnique
+from monkey_island.cc.services.reporting.report import ReportService
 
 __author__ = "shreyamalviya"
 
diff --git a/monkey/monkey_island/cc/services/attack/technique_reports/T1156.py b/monkey/monkey_island/cc/services/attack/technique_reports/T1156.py
index 939ebc946..48f12f5e3 100644
--- a/monkey/monkey_island/cc/services/attack/technique_reports/T1156.py
+++ b/monkey/monkey_island/cc/services/attack/technique_reports/T1156.py
@@ -1,5 +1,8 @@
 from common.data.post_breach_consts import \
     POST_BREACH_SHELL_STARTUP_FILE_MODIFICATION
+from common.utils.attack_utils import ScanStatus
+from monkey_island.cc.database import mongo
+from monkey_island.cc.services.attack.technique_reports import AttackTechnique
 from monkey_island.cc.services.attack.technique_reports.pba_technique import \
     PostBreachTechnique
 
@@ -8,7 +11,7 @@ __author__ = "shreyamalviya"
 
 class T1156(PostBreachTechnique):
     tech_id = "T1156"
-    unscanned_msg = "Monkey didn't try modifying bash startup files since it found no Linux machines."
-    scanned_msg = "Monkey tried modifying bash startup files but failed."
-    used_msg = "Monkey successfully modified bash startup files."
+    unscanned_msg = "Monkey did not try modifying bash startup files on the system."
+    scanned_msg = "Monkey tried modifying bash startup files on the system but failed."
+    used_msg = "Monkey modified bash startup files on the system."
     pba_names = [POST_BREACH_SHELL_STARTUP_FILE_MODIFICATION]
diff --git a/monkey/monkey_island/cc/services/attack/technique_reports/T1158.py b/monkey/monkey_island/cc/services/attack/technique_reports/T1158.py
index dce2b3adb..7b0f87358 100644
--- a/monkey/monkey_island/cc/services/attack/technique_reports/T1158.py
+++ b/monkey/monkey_island/cc/services/attack/technique_reports/T1158.py
@@ -10,4 +10,4 @@ class T1158(PostBreachTechnique):
     unscanned_msg = "Monkey didn't try creating hidden files or folders."
     scanned_msg = "Monkey tried creating hidden files and folders on the system but failed."
     used_msg = "Monkey created hidden files and folders on the system."
-    pba_name = POST_BREACH_HIDDEN_FILES
+    pba_names = [POST_BREACH_HIDDEN_FILES]
diff --git a/monkey/monkey_island/cc/services/attack/technique_reports/T1504.py b/monkey/monkey_island/cc/services/attack/technique_reports/T1504.py
index 5e38b6630..9f6a0fb83 100644
--- a/monkey/monkey_island/cc/services/attack/technique_reports/T1504.py
+++ b/monkey/monkey_island/cc/services/attack/technique_reports/T1504.py
@@ -1,5 +1,8 @@
 from common.data.post_breach_consts import \
     POST_BREACH_SHELL_STARTUP_FILE_MODIFICATION
+from common.utils.attack_utils import ScanStatus
+from monkey_island.cc.database import mongo
+from monkey_island.cc.services.attack.technique_reports import AttackTechnique
 from monkey_island.cc.services.attack.technique_reports.pba_technique import \
     PostBreachTechnique
 
@@ -8,7 +11,7 @@ __author__ = "shreyamalviya"
 
 class T1504(PostBreachTechnique):
     tech_id = "T1504"
-    unscanned_msg = "Monkey didn't try modifying powershell startup files since it found no Windows machines."
-    scanned_msg = "Monkey tried modifying powershell startup files but failed."
-    used_msg = "Monkey successfully modified powershell startup files."
+    unscanned_msg = "Monkey did not try modifying powershell startup files on the system."
+    scanned_msg = "Monkey tried modifying powershell startup files on the system but failed."
+    used_msg = "Monkey modified powershell startup files on the system."
     pba_names = [POST_BREACH_SHELL_STARTUP_FILE_MODIFICATION]
diff --git a/monkey/monkey_island/cc/services/attack/technique_reports/__init__.py b/monkey/monkey_island/cc/services/attack/technique_reports/__init__.py
index 14bd1012e..1dd9cfb24 100644
--- a/monkey/monkey_island/cc/services/attack/technique_reports/__init__.py
+++ b/monkey/monkey_island/cc/services/attack/technique_reports/__init__.py
@@ -10,8 +10,7 @@ from monkey_island.cc.services.attack.attack_config import AttackConfig
 logger = logging.getLogger(__name__)
 
 
-disabled_msg = "This technique has been disabled. " +\
-               "You can enable it from the [configuration page](../../configure)."
+disabled_msg = "This technique has been disabled. You can enable it from the configuration page."
 
 
 class AttackTechnique(object, metaclass=abc.ABCMeta):
@@ -74,7 +73,8 @@ class AttackTechnique(object, metaclass=abc.ABCMeta):
                                           'data.technique': cls.tech_id}):
             return ScanStatus.SCANNED.value
         else:
-            return ScanStatus.UNSCANNED.value
+            return ScanStatus.DISABLED.value if not AttackConfig.get_technique_values()[cls.tech_id]\
+                else ScanStatus.UNSCANNED.value
 
     @classmethod
     def get_message_and_status(cls, status):
@@ -93,7 +93,6 @@ class AttackTechnique(object, metaclass=abc.ABCMeta):
         :param status: Enum from common/attack_utils.py integer value
         :return: message string
         """
-        status = cls._check_status(status)
         if status == ScanStatus.DISABLED.value:
             return disabled_msg
         if status == ScanStatus.UNSCANNED.value:
@@ -143,12 +142,8 @@ class AttackTechnique(object, metaclass=abc.ABCMeta):
             return {}
 
     @classmethod
-    def _check_status(cls, status, *args):
-        enabled_in_config = args[0] if args else cls._is_enabled_in_config()
-        if status == ScanStatus.UNSCANNED.value and not enabled_in_config:
-            return ScanStatus.DISABLED.value
+    def _check_status(cls, status):
+        if status == ScanStatus.UNSCANNED.value:
+            return ScanStatus.DISABLED.value if not AttackConfig.get_technique_values()[cls.tech_id]\
+                    else ScanStatus.UNSCANNED.value
         return status
-
-    @classmethod
-    def _is_enabled_in_config(cls):
-        return AttackConfig.get_technique_values()[cls.tech_id]
diff --git a/monkey/monkey_island/cc/services/attack/technique_reports/pba_technique.py b/monkey/monkey_island/cc/services/attack/technique_reports/pba_technique.py
index fce4edf70..c588bb3c9 100644
--- a/monkey/monkey_island/cc/services/attack/technique_reports/pba_technique.py
+++ b/monkey/monkey_island/cc/services/attack/technique_reports/pba_technique.py
@@ -9,16 +9,17 @@ from monkey_island.cc.services.attack.technique_reports import AttackTechnique
 class PostBreachTechnique(AttackTechnique, metaclass=abc.ABCMeta):
     @property
     @abc.abstractmethod
-    def pba_name(self):
+    def pba_names(self):
         """
         :return: name of post breach action
         """
         pass
 
     @classmethod
-    def get_pba_query(cls, post_breach_action_name):
+    def get_pba_query(cls, post_breach_action_names):
         return [{'$match': {'telem_category': 'post_breach',
-                            'data.name': post_breach_action_name}},
+                            # 'data.name': post_breach_action_name}},
+                            '$or': [{'data.name': pba_name} for pba_name in post_breach_action_names]}},
                 {'$project': {'_id': 0,
                               'machine': {'hostname': '$data.hostname',
                                           'ips': ['$data.ip']},
@@ -28,7 +29,7 @@ class PostBreachTechnique(AttackTechnique, metaclass=abc.ABCMeta):
     def get_report_data(cls):
         data = {'title': cls.technique_title(), 'info': []}
 
-        info = list(mongo.db.telemetry.aggregate(cls.get_pba_query(cls.pba_name)))
+        info = list(mongo.db.telemetry.aggregate(cls.get_pba_query(cls.pba_names)))
 
         status = []
         for pba_node in info:
@@ -36,6 +37,10 @@ class PostBreachTechnique(AttackTechnique, metaclass=abc.ABCMeta):
         status = (ScanStatus.USED.value if any(status) else ScanStatus.SCANNED.value)\
             if status else ScanStatus.UNSCANNED.value
 
+        if status == ScanStatus.UNSCANNED.value and\
+           not AttackConfig.get_technique_values()[cls.tech_id]:
+            status = ScanStatus.DISABLED.value
+
         data.update(cls.get_base_data_by_status(status))
         data.update({'info': info})
         return data
diff --git a/monkey/monkey_island/cc/ui/src/components/report-components/AttackReport.js b/monkey/monkey_island/cc/ui/src/components/report-components/AttackReport.js
index 97f3c1a18..4376fcf0c 100644
--- a/monkey/monkey_island/cc/ui/src/components/report-components/AttackReport.js
+++ b/monkey/monkey_island/cc/ui/src/components/report-components/AttackReport.js
@@ -64,10 +64,10 @@ class AttackReport extends React.Component {
         return 'collapse-warning';
       case ScanStatus.USED:
         return 'collapse-danger';
+      case ScanStatus.UNSCANNED:
+        return 'collapse-unscanned';
       case ScanStatus.DISABLED:
         return 'collapse-disabled';
-      default:
-        return 'collapse-default';
     }
   }
 
diff --git a/monkey/monkey_island/cc/ui/src/styles/components/Collapse.scss b/monkey/monkey_island/cc/ui/src/styles/components/Collapse.scss
index 63f503095..fd004f783 100644
--- a/monkey/monkey_island/cc/ui/src/styles/components/Collapse.scss
+++ b/monkey/monkey_island/cc/ui/src/styles/components/Collapse.scss
@@ -3,7 +3,7 @@ $transition: 300ms cubic-bezier(0.6, 0.3, 0.3, 0.6);
 $danger-color: #ebbcba;
 $disabled-color: #b7c2ff;
 $info-color: #ade3eb;
-$default-color: #e0ddde;
+$unscanned-color: #e0ddde;
 $warning-color: #ffe28d;
 
 .collapse-item button {
@@ -51,8 +51,12 @@ $warning-color: #ffe28d;
   background-color: $info-color !important;
 }
 
-.collapse-default {
-  background-color: $default-color !important;
+.collapse-unscanned {
+  background-color: $unscanned-color !important;
+}
+
+.collapse-disabled {
+  background-color: $disabled-color !important;
 }
 
 .collapse-disabled {

From d8adaef046abe7c6fdd566ef0fd629782f2336d1 Mon Sep 17 00:00:00 2001
From: Shreya <shreya.malviya@gmail.com>
Date: Sat, 11 Jul 2020 01:38:05 +0530
Subject: [PATCH 19/40] Pass build

---
 .../cc/services/attack/technique_reports/T1136.py            | 5 -----
 .../cc/services/attack/technique_reports/T1156.py            | 3 ---
 .../cc/services/attack/technique_reports/T1504.py            | 3 ---
 3 files changed, 11 deletions(-)

diff --git a/monkey/monkey_island/cc/services/attack/technique_reports/T1136.py b/monkey/monkey_island/cc/services/attack/technique_reports/T1136.py
index 1bd3ba212..086a1c139 100644
--- a/monkey/monkey_island/cc/services/attack/technique_reports/T1136.py
+++ b/monkey/monkey_island/cc/services/attack/technique_reports/T1136.py
@@ -1,12 +1,7 @@
 from common.data.post_breach_consts import (
     POST_BREACH_BACKDOOR_USER, POST_BREACH_COMMUNICATE_AS_NEW_USER)
-from common.utils.attack_utils import ScanStatus
-from monkey_island.cc.database import mongo
-from monkey_island.cc.services.attack.attack_config import AttackConfig
-from monkey_island.cc.services.attack.technique_reports import AttackTechnique
 from monkey_island.cc.services.attack.technique_reports.pba_technique import \
     PostBreachTechnique
-from monkey_island.cc.services.reporting.report import ReportService
 
 __author__ = "shreyamalviya"
 
diff --git a/monkey/monkey_island/cc/services/attack/technique_reports/T1156.py b/monkey/monkey_island/cc/services/attack/technique_reports/T1156.py
index 48f12f5e3..aa1fe598a 100644
--- a/monkey/monkey_island/cc/services/attack/technique_reports/T1156.py
+++ b/monkey/monkey_island/cc/services/attack/technique_reports/T1156.py
@@ -1,8 +1,5 @@
 from common.data.post_breach_consts import \
     POST_BREACH_SHELL_STARTUP_FILE_MODIFICATION
-from common.utils.attack_utils import ScanStatus
-from monkey_island.cc.database import mongo
-from monkey_island.cc.services.attack.technique_reports import AttackTechnique
 from monkey_island.cc.services.attack.technique_reports.pba_technique import \
     PostBreachTechnique
 
diff --git a/monkey/monkey_island/cc/services/attack/technique_reports/T1504.py b/monkey/monkey_island/cc/services/attack/technique_reports/T1504.py
index 9f6a0fb83..1516bfdee 100644
--- a/monkey/monkey_island/cc/services/attack/technique_reports/T1504.py
+++ b/monkey/monkey_island/cc/services/attack/technique_reports/T1504.py
@@ -1,8 +1,5 @@
 from common.data.post_breach_consts import \
     POST_BREACH_SHELL_STARTUP_FILE_MODIFICATION
-from common.utils.attack_utils import ScanStatus
-from monkey_island.cc.database import mongo
-from monkey_island.cc.services.attack.technique_reports import AttackTechnique
 from monkey_island.cc.services.attack.technique_reports.pba_technique import \
     PostBreachTechnique
 

From e9dfd0bc54d3f1fb4253130dcf21fdb596d8fb4c Mon Sep 17 00:00:00 2001
From: Shreya <shreya.malviya@gmail.com>
Date: Sun, 12 Jul 2020 00:06:06 +0530
Subject: [PATCH 20/40] Small changes

---
 .../cc/services/attack/technique_reports/T1136.py     |  1 +
 .../cc/services/attack/technique_reports/__init__.py  | 11 ++++++-----
 .../attack/technique_reports/pba_technique.py         |  5 -----
 3 files changed, 7 insertions(+), 10 deletions(-)

diff --git a/monkey/monkey_island/cc/services/attack/technique_reports/T1136.py b/monkey/monkey_island/cc/services/attack/technique_reports/T1136.py
index 086a1c139..2022aa3be 100644
--- a/monkey/monkey_island/cc/services/attack/technique_reports/T1136.py
+++ b/monkey/monkey_island/cc/services/attack/technique_reports/T1136.py
@@ -3,6 +3,7 @@ from common.data.post_breach_consts import (
 from monkey_island.cc.services.attack.technique_reports.pba_technique import \
     PostBreachTechnique
 
+
 __author__ = "shreyamalviya"
 
 
diff --git a/monkey/monkey_island/cc/services/attack/technique_reports/__init__.py b/monkey/monkey_island/cc/services/attack/technique_reports/__init__.py
index 1dd9cfb24..1a8e79a79 100644
--- a/monkey/monkey_island/cc/services/attack/technique_reports/__init__.py
+++ b/monkey/monkey_island/cc/services/attack/technique_reports/__init__.py
@@ -72,9 +72,10 @@ class AttackTechnique(object, metaclass=abc.ABCMeta):
                                           'data.status': ScanStatus.SCANNED.value,
                                           'data.technique': cls.tech_id}):
             return ScanStatus.SCANNED.value
+        elif not AttackConfig.get_technique_values()[cls.tech_id]:
+            return ScanStatus.DISABLED.value
         else:
-            return ScanStatus.DISABLED.value if not AttackConfig.get_technique_values()[cls.tech_id]\
-                else ScanStatus.UNSCANNED.value
+            return ScanStatus.UNSCANNED.value
 
     @classmethod
     def get_message_and_status(cls, status):
@@ -93,6 +94,7 @@ class AttackTechnique(object, metaclass=abc.ABCMeta):
         :param status: Enum from common/attack_utils.py integer value
         :return: message string
         """
+        status = cls._check_status(status)
         if status == ScanStatus.DISABLED.value:
             return disabled_msg
         if status == ScanStatus.UNSCANNED.value:
@@ -143,7 +145,6 @@ class AttackTechnique(object, metaclass=abc.ABCMeta):
 
     @classmethod
     def _check_status(cls, status):
-        if status == ScanStatus.UNSCANNED.value:
-            return ScanStatus.DISABLED.value if not AttackConfig.get_technique_values()[cls.tech_id]\
-                    else ScanStatus.UNSCANNED.value
+        if status == ScanStatus.UNSCANNED.value and not AttackConfig.get_technique_values()[cls.tech_id]:
+            return ScanStatus.DISABLED.value
         return status
diff --git a/monkey/monkey_island/cc/services/attack/technique_reports/pba_technique.py b/monkey/monkey_island/cc/services/attack/technique_reports/pba_technique.py
index c588bb3c9..ef34eb417 100644
--- a/monkey/monkey_island/cc/services/attack/technique_reports/pba_technique.py
+++ b/monkey/monkey_island/cc/services/attack/technique_reports/pba_technique.py
@@ -18,7 +18,6 @@ class PostBreachTechnique(AttackTechnique, metaclass=abc.ABCMeta):
     @classmethod
     def get_pba_query(cls, post_breach_action_names):
         return [{'$match': {'telem_category': 'post_breach',
-                            # 'data.name': post_breach_action_name}},
                             '$or': [{'data.name': pba_name} for pba_name in post_breach_action_names]}},
                 {'$project': {'_id': 0,
                               'machine': {'hostname': '$data.hostname',
@@ -37,10 +36,6 @@ class PostBreachTechnique(AttackTechnique, metaclass=abc.ABCMeta):
         status = (ScanStatus.USED.value if any(status) else ScanStatus.SCANNED.value)\
             if status else ScanStatus.UNSCANNED.value
 
-        if status == ScanStatus.UNSCANNED.value and\
-           not AttackConfig.get_technique_values()[cls.tech_id]:
-            status = ScanStatus.DISABLED.value
-
         data.update(cls.get_base_data_by_status(status))
         data.update({'info': info})
         return data

From 2685c5084172dfcd890998734bd1f195ef027e56 Mon Sep 17 00:00:00 2001
From: Shreya <shreya.malviya@gmail.com>
Date: Sun, 12 Jul 2020 01:17:14 +0530
Subject: [PATCH 21/40] Change icon for disabled status

---
 .../cc/ui/src/components/report-components/AttackReport.js | 7 +++----
 1 file changed, 3 insertions(+), 4 deletions(-)

diff --git a/monkey/monkey_island/cc/ui/src/components/report-components/AttackReport.js b/monkey/monkey_island/cc/ui/src/components/report-components/AttackReport.js
index 4376fcf0c..b5aa94b82 100644
--- a/monkey/monkey_island/cc/ui/src/components/report-components/AttackReport.js
+++ b/monkey/monkey_island/cc/ui/src/components/report-components/AttackReport.js
@@ -7,7 +7,6 @@ import {faRadiation} from '@fortawesome/free-solid-svg-icons/faRadiation';
 import {faEye} from '@fortawesome/free-solid-svg-icons/faEye';
 import {faEyeSlash} from '@fortawesome/free-solid-svg-icons/faEyeSlash';
 import {faToggleOff} from '@fortawesome/free-solid-svg-icons/faToggleOff';
-import marked from 'marked';
 
 import ReportHeader, {ReportTypes} from './common/ReportHeader';
 import {ScanStatus} from '../attack/techniques/Helpers';
@@ -77,11 +76,11 @@ class AttackReport extends React.Component {
         return <FontAwesomeIcon icon={faEye} className={'technique-status-icon'}/>;
       case ScanStatus.USED:
         return <FontAwesomeIcon icon={faRadiation} className={'technique-status-icon'}/>;
+      case ScanStatus.UNSCANNED:
+        return <FontAwesomeIcon icon={faEyeSlash} className={'technique-status-icon'}/>;
       case ScanStatus.DISABLED:
         return <FontAwesomeIcon icon={faToggleOff} className={'technique-status-icon'}/>;
-      default:
-        return <FontAwesomeIcon icon={faEyeSlash} className={'technique-status-icon'}/>;
-      }
+    }
   }
 
   renderLegend() {

From ce5921eaad0202c31c890eced448d951a7a73a7d Mon Sep 17 00:00:00 2001
From: Shreya <shreya.malviya@gmail.com>
Date: Tue, 14 Jul 2020 17:42:49 +0530
Subject: [PATCH 22/40] Add fn to check if disabled in config

---
 .../cc/services/attack/technique_reports/__init__.py   | 10 ++++++----
 1 file changed, 6 insertions(+), 4 deletions(-)

diff --git a/monkey/monkey_island/cc/services/attack/technique_reports/__init__.py b/monkey/monkey_island/cc/services/attack/technique_reports/__init__.py
index 1a8e79a79..3930b07dd 100644
--- a/monkey/monkey_island/cc/services/attack/technique_reports/__init__.py
+++ b/monkey/monkey_island/cc/services/attack/technique_reports/__init__.py
@@ -62,7 +62,7 @@ class AttackTechnique(object, metaclass=abc.ABCMeta):
         Gets the status of a certain attack technique.
         :return: ScanStatus numeric value
         """
-        if not cls._is_enabled_in_config():
+        if cls._is_disabled_in_config():
             return ScanStatus.DISABLED.value
         elif mongo.db.telemetry.find_one({'telem_category': 'attack',
                                           'data.status': ScanStatus.USED.value,
@@ -72,8 +72,6 @@ class AttackTechnique(object, metaclass=abc.ABCMeta):
                                           'data.status': ScanStatus.SCANNED.value,
                                           'data.technique': cls.tech_id}):
             return ScanStatus.SCANNED.value
-        elif not AttackConfig.get_technique_values()[cls.tech_id]:
-            return ScanStatus.DISABLED.value
         else:
             return ScanStatus.UNSCANNED.value
 
@@ -145,6 +143,10 @@ class AttackTechnique(object, metaclass=abc.ABCMeta):
 
     @classmethod
     def _check_status(cls, status):
-        if status == ScanStatus.UNSCANNED.value and not AttackConfig.get_technique_values()[cls.tech_id]:
+        if status == ScanStatus.UNSCANNED.value and cls._is_disabled_in_config():
             return ScanStatus.DISABLED.value
         return status
+
+    @classmethod
+    def _is_disabled_in_config(cls):
+        return not AttackConfig.get_technique_values()[cls.tech_id]

From 0cbb0b931d21be118392876252ed05cd8d0aa7ef Mon Sep 17 00:00:00 2001
From: Shreya <shreya.malviya@gmail.com>
Date: Tue, 14 Jul 2020 17:58:19 +0530
Subject: [PATCH 23/40] Document PostBreachTechnique class

---
 .../attack/technique_reports/pba_technique.py | 22 ++++++++++++++-----
 1 file changed, 17 insertions(+), 5 deletions(-)

diff --git a/monkey/monkey_island/cc/services/attack/technique_reports/pba_technique.py b/monkey/monkey_island/cc/services/attack/technique_reports/pba_technique.py
index ef34eb417..f603b757e 100644
--- a/monkey/monkey_island/cc/services/attack/technique_reports/pba_technique.py
+++ b/monkey/monkey_island/cc/services/attack/technique_reports/pba_technique.py
@@ -7,6 +7,8 @@ from monkey_island.cc.services.attack.technique_reports import AttackTechnique
 
 
 class PostBreachTechnique(AttackTechnique, metaclass=abc.ABCMeta):
+    """ Class for ATT&CK report components of post-breach actions """
+
     @property
     @abc.abstractmethod
     def pba_names(self):
@@ -17,6 +19,12 @@ class PostBreachTechnique(AttackTechnique, metaclass=abc.ABCMeta):
 
     @classmethod
     def get_pba_query(cls, post_breach_action_names):
+        """
+        :param post_breach_action_names: Names of post-breach actions with which the technique is associated
+        (example - `["Communicate as new user", "Backdoor user"]` for T1136)
+        :return: Mongo query that parses attack telemetries for a simple report component
+        (gets machines and post-breach action usage).
+        """
         return [{'$match': {'telem_category': 'post_breach',
                             '$or': [{'data.name': pba_name} for pba_name in post_breach_action_names]}},
                 {'$project': {'_id': 0,
@@ -26,15 +34,19 @@ class PostBreachTechnique(AttackTechnique, metaclass=abc.ABCMeta):
 
     @classmethod
     def get_report_data(cls):
+        """
+        :return: Technique's report data aggregated from the database
+        """
         data = {'title': cls.technique_title(), 'info': []}
 
         info = list(mongo.db.telemetry.aggregate(cls.get_pba_query(cls.pba_names)))
 
-        status = []
-        for pba_node in info:
-            status.append(pba_node['result'][1])
-        status = (ScanStatus.USED.value if any(status) else ScanStatus.SCANNED.value)\
-            if status else ScanStatus.UNSCANNED.value
+        if info:
+            successful_PBAs = mongo.db.telemetry.count({
+                '$or': [{'data.name': pba_name} for pba_name in post_breach_action_names],
+                'data.result.1': True
+            })
+            status = ScanStatus.USED.value if successful_PBAs else ScanStatus.SCANNED.value
 
         data.update(cls.get_base_data_by_status(status))
         data.update({'info': info})

From e377e72a4c36f6a8692429eda4f16c4b4b2833e6 Mon Sep 17 00:00:00 2001
From: Shreya <shreya.malviya@gmail.com>
Date: Tue, 14 Jul 2020 18:15:15 +0530
Subject: [PATCH 24/40] Keep default

---
 .../src/components/report-components/AttackReport.js   | 10 +++++-----
 .../cc/ui/src/styles/components/Collapse.scss          |  6 +++---
 2 files changed, 8 insertions(+), 8 deletions(-)

diff --git a/monkey/monkey_island/cc/ui/src/components/report-components/AttackReport.js b/monkey/monkey_island/cc/ui/src/components/report-components/AttackReport.js
index b5aa94b82..18cfe2113 100644
--- a/monkey/monkey_island/cc/ui/src/components/report-components/AttackReport.js
+++ b/monkey/monkey_island/cc/ui/src/components/report-components/AttackReport.js
@@ -63,10 +63,10 @@ class AttackReport extends React.Component {
         return 'collapse-warning';
       case ScanStatus.USED:
         return 'collapse-danger';
-      case ScanStatus.UNSCANNED:
-        return 'collapse-unscanned';
       case ScanStatus.DISABLED:
         return 'collapse-disabled';
+      default:
+        return 'collapse-default';
     }
   }
 
@@ -76,11 +76,11 @@ class AttackReport extends React.Component {
         return <FontAwesomeIcon icon={faEye} className={'technique-status-icon'}/>;
       case ScanStatus.USED:
         return <FontAwesomeIcon icon={faRadiation} className={'technique-status-icon'}/>;
-      case ScanStatus.UNSCANNED:
-        return <FontAwesomeIcon icon={faEyeSlash} className={'technique-status-icon'}/>;
       case ScanStatus.DISABLED:
         return <FontAwesomeIcon icon={faToggleOff} className={'technique-status-icon'}/>;
-    }
+      default:
+        return <FontAwesomeIcon icon={faEyeSlash} className={'technique-status-icon'}/>;
+      }
   }
 
   renderLegend() {
diff --git a/monkey/monkey_island/cc/ui/src/styles/components/Collapse.scss b/monkey/monkey_island/cc/ui/src/styles/components/Collapse.scss
index fd004f783..8d412c15d 100644
--- a/monkey/monkey_island/cc/ui/src/styles/components/Collapse.scss
+++ b/monkey/monkey_island/cc/ui/src/styles/components/Collapse.scss
@@ -3,7 +3,7 @@ $transition: 300ms cubic-bezier(0.6, 0.3, 0.3, 0.6);
 $danger-color: #ebbcba;
 $disabled-color: #b7c2ff;
 $info-color: #ade3eb;
-$unscanned-color: #e0ddde;
+$default-color: #e0ddde;
 $warning-color: #ffe28d;
 
 .collapse-item button {
@@ -51,8 +51,8 @@ $warning-color: #ffe28d;
   background-color: $info-color !important;
 }
 
-.collapse-unscanned {
-  background-color: $unscanned-color !important;
+.collapse-default {
+  background-color: $default-color !important;
 }
 
 .collapse-disabled {

From 57f30a89791eebcce28ad9ab28f93dd126a2f533 Mon Sep 17 00:00:00 2001
From: Shreya <shreya.malviya@gmail.com>
Date: Tue, 14 Jul 2020 20:24:11 +0530
Subject: [PATCH 25/40] Update after pulling from develop

---
 .../cc/services/attack/technique_reports/T1154.py        | 3 +++
 .../cc/services/attack/technique_reports/T1166.py        | 9 ++++++---
 2 files changed, 9 insertions(+), 3 deletions(-)

diff --git a/monkey/monkey_island/cc/services/attack/technique_reports/T1154.py b/monkey/monkey_island/cc/services/attack/technique_reports/T1154.py
index 29df2eb65..1c8dc9cd2 100644
--- a/monkey/monkey_island/cc/services/attack/technique_reports/T1154.py
+++ b/monkey/monkey_island/cc/services/attack/technique_reports/T1154.py
@@ -1,4 +1,7 @@
 from common.data.post_breach_consts import POST_BREACH_TRAP_COMMAND
+from common.utils.attack_utils import ScanStatus
+from monkey_island.cc.database import mongo
+from monkey_island.cc.services.attack.technique_reports import AttackTechnique
 from monkey_island.cc.services.attack.technique_reports.pba_technique import \
     PostBreachTechnique
 
diff --git a/monkey/monkey_island/cc/services/attack/technique_reports/T1166.py b/monkey/monkey_island/cc/services/attack/technique_reports/T1166.py
index f8aae194d..3d29ebed6 100644
--- a/monkey/monkey_island/cc/services/attack/technique_reports/T1166.py
+++ b/monkey/monkey_island/cc/services/attack/technique_reports/T1166.py
@@ -1,4 +1,7 @@
 from common.data.post_breach_consts import POST_BREACH_SETUID_SETGID
+from common.utils.attack_utils import ScanStatus
+from monkey_island.cc.database import mongo
+from monkey_island.cc.services.attack.technique_reports import AttackTechnique
 from monkey_island.cc.services.attack.technique_reports.pba_technique import \
     PostBreachTechnique
 
@@ -7,7 +10,7 @@ __author__ = "shreyamalviya"
 
 class T1166(PostBreachTechnique):
     tech_id = "T1166"
-    unscanned_msg = "Monkey didn't try setting the setuid or setgid bits since it found no Linux machines."
-    scanned_msg = "Monkey tried setting the setuid or setgid bits but failed."
-    used_msg = "Monkey successfully set the setuid or setgid bits."
+    unscanned_msg = "Monkey did not try creating hidden files or folders."
+    scanned_msg = "Monkey tried creating hidden files and folders on the system but failed."
+    used_msg = "Monkey created hidden files and folders on the system."
     pba_names = [POST_BREACH_SETUID_SETGID]

From 60f67f9ee40df3855e3a7eeb76a73ba896c653b3 Mon Sep 17 00:00:00 2001
From: Shreya <shreya.malviya@gmail.com>
Date: Wed, 15 Jul 2020 00:32:52 +0530
Subject: [PATCH 26/40] Update after pulling from develop

---
 .../cc/services/attack/technique_reports/T1053.py          | 3 +++
 .../cc/services/attack/technique_reports/T1136.py          | 1 -
 .../cc/services/attack/technique_reports/T1168.py          | 3 +++
 .../cc/services/attack/technique_reports/pba_technique.py  | 7 ++++---
 4 files changed, 10 insertions(+), 4 deletions(-)

diff --git a/monkey/monkey_island/cc/services/attack/technique_reports/T1053.py b/monkey/monkey_island/cc/services/attack/technique_reports/T1053.py
index 103f2409b..a25bcee91 100644
--- a/monkey/monkey_island/cc/services/attack/technique_reports/T1053.py
+++ b/monkey/monkey_island/cc/services/attack/technique_reports/T1053.py
@@ -1,4 +1,7 @@
 from common.data.post_breach_consts import POST_BREACH_JOB_SCHEDULING
+from common.utils.attack_utils import ScanStatus
+from monkey_island.cc.database import mongo
+from monkey_island.cc.services.attack.technique_reports import AttackTechnique
 from monkey_island.cc.services.attack.technique_reports.pba_technique import \
     PostBreachTechnique
 
diff --git a/monkey/monkey_island/cc/services/attack/technique_reports/T1136.py b/monkey/monkey_island/cc/services/attack/technique_reports/T1136.py
index 2022aa3be..086a1c139 100644
--- a/monkey/monkey_island/cc/services/attack/technique_reports/T1136.py
+++ b/monkey/monkey_island/cc/services/attack/technique_reports/T1136.py
@@ -3,7 +3,6 @@ from common.data.post_breach_consts import (
 from monkey_island.cc.services.attack.technique_reports.pba_technique import \
     PostBreachTechnique
 
-
 __author__ = "shreyamalviya"
 
 
diff --git a/monkey/monkey_island/cc/services/attack/technique_reports/T1168.py b/monkey/monkey_island/cc/services/attack/technique_reports/T1168.py
index d7390e913..34d5f9f4a 100644
--- a/monkey/monkey_island/cc/services/attack/technique_reports/T1168.py
+++ b/monkey/monkey_island/cc/services/attack/technique_reports/T1168.py
@@ -1,4 +1,7 @@
 from common.data.post_breach_consts import POST_BREACH_JOB_SCHEDULING
+from common.utils.attack_utils import ScanStatus
+from monkey_island.cc.database import mongo
+from monkey_island.cc.services.attack.technique_reports import AttackTechnique
 from monkey_island.cc.services.attack.technique_reports.pba_technique import \
     PostBreachTechnique
 
diff --git a/monkey/monkey_island/cc/services/attack/technique_reports/pba_technique.py b/monkey/monkey_island/cc/services/attack/technique_reports/pba_technique.py
index f603b757e..a7ef96803 100644
--- a/monkey/monkey_island/cc/services/attack/technique_reports/pba_technique.py
+++ b/monkey/monkey_island/cc/services/attack/technique_reports/pba_technique.py
@@ -1,8 +1,8 @@
 import abc
 
-from monkey_island.cc.services.attack.attack_config import AttackConfig
-from monkey_island.cc.database import mongo
 from common.utils.attack_utils import ScanStatus
+from monkey_island.cc.database import mongo
+from monkey_island.cc.services.attack.attack_config import AttackConfig
 from monkey_island.cc.services.attack.technique_reports import AttackTechnique
 
 
@@ -41,9 +41,10 @@ class PostBreachTechnique(AttackTechnique, metaclass=abc.ABCMeta):
 
         info = list(mongo.db.telemetry.aggregate(cls.get_pba_query(cls.pba_names)))
 
+        status = ScanStatus.UNSCANNED.value
         if info:
             successful_PBAs = mongo.db.telemetry.count({
-                '$or': [{'data.name': pba_name} for pba_name in post_breach_action_names],
+                '$or': [{'data.name': pba_name} for pba_name in cls.pba_names],
                 'data.result.1': True
             })
             status = ScanStatus.USED.value if successful_PBAs else ScanStatus.SCANNED.value

From 83a362bf90c45ec08d1d2d5e2e9e8ae7fd9672b8 Mon Sep 17 00:00:00 2001
From: Shreya <shreya.malviya@gmail.com>
Date: Fri, 17 Jul 2020 00:31:46 +0530
Subject: [PATCH 27/40] Add hyperlink to configuration page in "disabled"
 status message in MITRE report

---
 .../cc/services/attack/technique_reports/__init__.py           | 3 ++-
 .../cc/ui/src/components/report-components/AttackReport.js     | 1 +
 2 files changed, 3 insertions(+), 1 deletion(-)

diff --git a/monkey/monkey_island/cc/services/attack/technique_reports/__init__.py b/monkey/monkey_island/cc/services/attack/technique_reports/__init__.py
index 3930b07dd..64b6a13f7 100644
--- a/monkey/monkey_island/cc/services/attack/technique_reports/__init__.py
+++ b/monkey/monkey_island/cc/services/attack/technique_reports/__init__.py
@@ -10,7 +10,8 @@ from monkey_island.cc.services.attack.attack_config import AttackConfig
 logger = logging.getLogger(__name__)
 
 
-disabled_msg = "This technique has been disabled. You can enable it from the configuration page."
+disabled_msg = "This technique has been disabled. " +\
+               "You can enable it from the [configuration page](../../configure)."
 
 
 class AttackTechnique(object, metaclass=abc.ABCMeta):
diff --git a/monkey/monkey_island/cc/ui/src/components/report-components/AttackReport.js b/monkey/monkey_island/cc/ui/src/components/report-components/AttackReport.js
index 18cfe2113..97f3c1a18 100644
--- a/monkey/monkey_island/cc/ui/src/components/report-components/AttackReport.js
+++ b/monkey/monkey_island/cc/ui/src/components/report-components/AttackReport.js
@@ -7,6 +7,7 @@ import {faRadiation} from '@fortawesome/free-solid-svg-icons/faRadiation';
 import {faEye} from '@fortawesome/free-solid-svg-icons/faEye';
 import {faEyeSlash} from '@fortawesome/free-solid-svg-icons/faEyeSlash';
 import {faToggleOff} from '@fortawesome/free-solid-svg-icons/faToggleOff';
+import marked from 'marked';
 
 import ReportHeader, {ReportTypes} from './common/ReportHeader';
 import {ScanStatus} from '../attack/techniques/Helpers';

From d313985661e8623f66c76be4022310999dd49dcd Mon Sep 17 00:00:00 2001
From: Shreya <shreya.malviya@gmail.com>
Date: Fri, 17 Jul 2020 00:46:26 +0530
Subject: [PATCH 28/40] Pass build

---
 .../cc/services/attack/technique_reports/T1053.py              | 3 ---
 .../cc/services/attack/technique_reports/T1154.py              | 3 ---
 .../cc/services/attack/technique_reports/T1166.py              | 3 ---
 .../cc/services/attack/technique_reports/T1168.py              | 3 ---
 4 files changed, 12 deletions(-)

diff --git a/monkey/monkey_island/cc/services/attack/technique_reports/T1053.py b/monkey/monkey_island/cc/services/attack/technique_reports/T1053.py
index a25bcee91..103f2409b 100644
--- a/monkey/monkey_island/cc/services/attack/technique_reports/T1053.py
+++ b/monkey/monkey_island/cc/services/attack/technique_reports/T1053.py
@@ -1,7 +1,4 @@
 from common.data.post_breach_consts import POST_BREACH_JOB_SCHEDULING
-from common.utils.attack_utils import ScanStatus
-from monkey_island.cc.database import mongo
-from monkey_island.cc.services.attack.technique_reports import AttackTechnique
 from monkey_island.cc.services.attack.technique_reports.pba_technique import \
     PostBreachTechnique
 
diff --git a/monkey/monkey_island/cc/services/attack/technique_reports/T1154.py b/monkey/monkey_island/cc/services/attack/technique_reports/T1154.py
index 1c8dc9cd2..29df2eb65 100644
--- a/monkey/monkey_island/cc/services/attack/technique_reports/T1154.py
+++ b/monkey/monkey_island/cc/services/attack/technique_reports/T1154.py
@@ -1,7 +1,4 @@
 from common.data.post_breach_consts import POST_BREACH_TRAP_COMMAND
-from common.utils.attack_utils import ScanStatus
-from monkey_island.cc.database import mongo
-from monkey_island.cc.services.attack.technique_reports import AttackTechnique
 from monkey_island.cc.services.attack.technique_reports.pba_technique import \
     PostBreachTechnique
 
diff --git a/monkey/monkey_island/cc/services/attack/technique_reports/T1166.py b/monkey/monkey_island/cc/services/attack/technique_reports/T1166.py
index 3d29ebed6..d9aee9df5 100644
--- a/monkey/monkey_island/cc/services/attack/technique_reports/T1166.py
+++ b/monkey/monkey_island/cc/services/attack/technique_reports/T1166.py
@@ -1,7 +1,4 @@
 from common.data.post_breach_consts import POST_BREACH_SETUID_SETGID
-from common.utils.attack_utils import ScanStatus
-from monkey_island.cc.database import mongo
-from monkey_island.cc.services.attack.technique_reports import AttackTechnique
 from monkey_island.cc.services.attack.technique_reports.pba_technique import \
     PostBreachTechnique
 
diff --git a/monkey/monkey_island/cc/services/attack/technique_reports/T1168.py b/monkey/monkey_island/cc/services/attack/technique_reports/T1168.py
index 34d5f9f4a..d7390e913 100644
--- a/monkey/monkey_island/cc/services/attack/technique_reports/T1168.py
+++ b/monkey/monkey_island/cc/services/attack/technique_reports/T1168.py
@@ -1,7 +1,4 @@
 from common.data.post_breach_consts import POST_BREACH_JOB_SCHEDULING
-from common.utils.attack_utils import ScanStatus
-from monkey_island.cc.database import mongo
-from monkey_island.cc.services.attack.technique_reports import AttackTechnique
 from monkey_island.cc.services.attack.technique_reports.pba_technique import \
     PostBreachTechnique
 

From 740dc437276bea6e59be47570c5f8fe2e0d6f472 Mon Sep 17 00:00:00 2001
From: Shreya <shreya.malviya@gmail.com>
Date: Sat, 18 Jul 2020 00:26:54 +0530
Subject: [PATCH 29/40] Modify "unscanned" messages for some techniques

+ other tiny changes in techniques' messages
---
 .../cc/services/attack/technique_reports/T1156.py           | 6 +++---
 .../cc/services/attack/technique_reports/T1166.py           | 6 +++---
 .../cc/services/attack/technique_reports/T1504.py           | 6 +++---
 3 files changed, 9 insertions(+), 9 deletions(-)

diff --git a/monkey/monkey_island/cc/services/attack/technique_reports/T1156.py b/monkey/monkey_island/cc/services/attack/technique_reports/T1156.py
index aa1fe598a..939ebc946 100644
--- a/monkey/monkey_island/cc/services/attack/technique_reports/T1156.py
+++ b/monkey/monkey_island/cc/services/attack/technique_reports/T1156.py
@@ -8,7 +8,7 @@ __author__ = "shreyamalviya"
 
 class T1156(PostBreachTechnique):
     tech_id = "T1156"
-    unscanned_msg = "Monkey did not try modifying bash startup files on the system."
-    scanned_msg = "Monkey tried modifying bash startup files on the system but failed."
-    used_msg = "Monkey modified bash startup files on the system."
+    unscanned_msg = "Monkey didn't try modifying bash startup files since it found no Linux machines."
+    scanned_msg = "Monkey tried modifying bash startup files but failed."
+    used_msg = "Monkey successfully modified bash startup files."
     pba_names = [POST_BREACH_SHELL_STARTUP_FILE_MODIFICATION]
diff --git a/monkey/monkey_island/cc/services/attack/technique_reports/T1166.py b/monkey/monkey_island/cc/services/attack/technique_reports/T1166.py
index d9aee9df5..f8aae194d 100644
--- a/monkey/monkey_island/cc/services/attack/technique_reports/T1166.py
+++ b/monkey/monkey_island/cc/services/attack/technique_reports/T1166.py
@@ -7,7 +7,7 @@ __author__ = "shreyamalviya"
 
 class T1166(PostBreachTechnique):
     tech_id = "T1166"
-    unscanned_msg = "Monkey did not try creating hidden files or folders."
-    scanned_msg = "Monkey tried creating hidden files and folders on the system but failed."
-    used_msg = "Monkey created hidden files and folders on the system."
+    unscanned_msg = "Monkey didn't try setting the setuid or setgid bits since it found no Linux machines."
+    scanned_msg = "Monkey tried setting the setuid or setgid bits but failed."
+    used_msg = "Monkey successfully set the setuid or setgid bits."
     pba_names = [POST_BREACH_SETUID_SETGID]
diff --git a/monkey/monkey_island/cc/services/attack/technique_reports/T1504.py b/monkey/monkey_island/cc/services/attack/technique_reports/T1504.py
index 1516bfdee..5e38b6630 100644
--- a/monkey/monkey_island/cc/services/attack/technique_reports/T1504.py
+++ b/monkey/monkey_island/cc/services/attack/technique_reports/T1504.py
@@ -8,7 +8,7 @@ __author__ = "shreyamalviya"
 
 class T1504(PostBreachTechnique):
     tech_id = "T1504"
-    unscanned_msg = "Monkey did not try modifying powershell startup files on the system."
-    scanned_msg = "Monkey tried modifying powershell startup files on the system but failed."
-    used_msg = "Monkey modified powershell startup files on the system."
+    unscanned_msg = "Monkey didn't try modifying powershell startup files since it found no Windows machines."
+    scanned_msg = "Monkey tried modifying powershell startup files but failed."
+    used_msg = "Monkey successfully modified powershell startup files."
     pba_names = [POST_BREACH_SHELL_STARTUP_FILE_MODIFICATION]

From 6456564cae8594938c5ab04e486d132f9342b203 Mon Sep 17 00:00:00 2001
From: Shreya <shreya.malviya@gmail.com>
Date: Sat, 18 Jul 2020 19:10:34 +0530
Subject: [PATCH 30/40] Add test for AttackTechnique

Issue with `_check_status` function since it tries to fetch from mongodb which doesn't exist in testing env
---
 .../attack_technique_test.py                  | 57 +++++++++----------
 1 file changed, 27 insertions(+), 30 deletions(-)

diff --git a/monkey/monkey_island/cc/services/attack/technique_reports/attack_technique_test.py b/monkey/monkey_island/cc/services/attack/technique_reports/attack_technique_test.py
index 94facd1b9..ca58f9fd5 100644
--- a/monkey/monkey_island/cc/services/attack/technique_reports/attack_technique_test.py
+++ b/monkey/monkey_island/cc/services/attack/technique_reports/attack_technique_test.py
@@ -1,7 +1,10 @@
+import json
 from unittest import TestCase
 
 from common.utils.attack_utils import ScanStatus
+from monkey_island.cc.database import mongo
 
+from . import AttackTechnique
 from .pba_technique import PostBreachTechnique
 
 
@@ -13,27 +16,27 @@ class T9999(PostBreachTechnique):
     pba_names = ["PBA Name"]
 
 
-# config =\
-#     {
-#         'category': {
-#             'link': '',
-#             'properties': {
-#                 'T9999': {
-#                     'description': '',
-#                     'link': '',
-#                     'necessary': False,
-#                     'title': '',
-#                     'type': 'bool',
-#                     'value': False  # this field denotes whether technique is enabled or disabled in config
-#                 }
-#             }
-#         }
-#     }
+config =\
+    {
+        'category': {
+            'link': '',
+            'properties': {
+                'T9999': {
+                    'description': '',
+                    'link': '',
+                    'necessary': False,
+                    'title': '',
+                    'type': 'bool',
+                    'value': False  # this field denotes whether technique is enabled or disabled in config
+                }
+            }
+        }
+    }
 
 
-# def set_config(value: bool):
-#     config['category']['properties']['T9999']['value'] = value
-#     return config
+def set_config(value: bool):
+    config['category']['properties']['T9999']['value'] = value
+    return config
 
 
 param_list = [
@@ -45,8 +48,7 @@ param_list = [
             'status': 0,
             'title': 'Unscanned technique'
         },
-        # set_config(True),  # configuration
-        True,  # configuration
+        set_config(True),  # configuration
         ScanStatus.UNSCANNED.value  # expected status
     ),
 
@@ -58,8 +60,7 @@ param_list = [
             'status': 1,
             'title': 'Scanned technique'
         },
-        # set_config(True),  # configuration
-        True,  # configuration
+        set_config(True),  # configuration
         ScanStatus.SCANNED.value  # expected status
     ),
 
@@ -71,8 +72,7 @@ param_list = [
             'status': 2,
             'title': 'Used technique'
         },
-        # set_config(True),  # configuration
-        True,  # configuration
+        set_config(True),  # configuration
         ScanStatus.USED.value  # expected status
     ),
 
@@ -84,8 +84,7 @@ param_list = [
             'status': 0,
             'title': 'Disabled technique'
         },
-        # set_config(False),  # configuration
-        False,  # configuration
+        set_config(False),  # configuration
         ScanStatus.DISABLED.value  # expected status
     )
 ]
@@ -95,6 +94,4 @@ class TestAttackTechnique(TestCase):
     def test__check_status(self):
         for telem_data, config, expected_status in param_list:
             with self.subTest(msg=f"Checking if correct status is returned (status: {telem_data['message']})"):
-                # self.assertEqual(T9999._check_status(telem_data['status']), expected_status)
-                self.assertEqual(T9999._check_status(telem_data['status'], config),
-                                 expected_status)
+                self.assertEqual(T9999._check_status(telem_data['status']), expected_status)

From 07457457b253fbbd32fd422e43fcb553e1ff3b3b Mon Sep 17 00:00:00 2001
From: Shreya <shreya.malviya@gmail.com>
Date: Sat, 18 Jul 2020 19:58:53 +0530
Subject: [PATCH 31/40] Pass build

---
 .../services/attack/technique_reports/attack_technique_test.py | 3 ---
 1 file changed, 3 deletions(-)

diff --git a/monkey/monkey_island/cc/services/attack/technique_reports/attack_technique_test.py b/monkey/monkey_island/cc/services/attack/technique_reports/attack_technique_test.py
index ca58f9fd5..43c312e3f 100644
--- a/monkey/monkey_island/cc/services/attack/technique_reports/attack_technique_test.py
+++ b/monkey/monkey_island/cc/services/attack/technique_reports/attack_technique_test.py
@@ -1,10 +1,7 @@
-import json
 from unittest import TestCase
 
 from common.utils.attack_utils import ScanStatus
-from monkey_island.cc.database import mongo
 
-from . import AttackTechnique
 from .pba_technique import PostBreachTechnique
 
 

From a927da3befbfb6a9ea07e4a8e235fb92856cb943 Mon Sep 17 00:00:00 2001
From: Shreya <shreya.malviya@gmail.com>
Date: Wed, 22 Jul 2020 02:21:19 +0530
Subject: [PATCH 32/40] CR changes

---
 .../attack/technique_reports/attack_technique_test.py     | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/monkey/monkey_island/cc/services/attack/technique_reports/attack_technique_test.py b/monkey/monkey_island/cc/services/attack/technique_reports/attack_technique_test.py
index 43c312e3f..7b7a71d9b 100644
--- a/monkey/monkey_island/cc/services/attack/technique_reports/attack_technique_test.py
+++ b/monkey/monkey_island/cc/services/attack/technique_reports/attack_technique_test.py
@@ -42,7 +42,7 @@ param_list = [
         {  # telemetry data
             'info': [],
             'message': 'Unscanned',
-            'status': 0,
+            'status': ScanStatus.UNSCANNED.value,
             'title': 'Unscanned technique'
         },
         set_config(True),  # configuration
@@ -54,7 +54,7 @@ param_list = [
         {  # telemetry data
             'info': [],
             'message': 'Scanned',
-            'status': 1,
+            'status': ScanStatus.SCANNED.value,
             'title': 'Scanned technique'
         },
         set_config(True),  # configuration
@@ -66,7 +66,7 @@ param_list = [
         {  # telemetry data
             'info': [],
             'message': 'Used',
-            'status': 2,
+            'status': ScanStatus.USED.value,
             'title': 'Used technique'
         },
         set_config(True),  # configuration
@@ -78,7 +78,7 @@ param_list = [
         {  # telemetry data
             'info': [],
             'message': 'Disabled',
-            'status': 0,
+            'status': ScanStatus.UNSCANNED.value,
             'title': 'Disabled technique'
         },
         set_config(False),  # configuration

From 92ab1ad2f2d9a13c804b77a3f24f6a11980a94a0 Mon Sep 17 00:00:00 2001
From: Shreya <shreya.malviya@gmail.com>
Date: Sun, 26 Jul 2020 12:18:20 +0530
Subject: [PATCH 33/40] Test for AttackTechnique

---
 .../attack/technique_reports/__init__.py         |  2 +-
 .../technique_reports/attack_technique_test.py   | 16 ++++++++++------
 2 files changed, 11 insertions(+), 7 deletions(-)

diff --git a/monkey/monkey_island/cc/services/attack/technique_reports/__init__.py b/monkey/monkey_island/cc/services/attack/technique_reports/__init__.py
index 64b6a13f7..3cc79ae17 100644
--- a/monkey/monkey_island/cc/services/attack/technique_reports/__init__.py
+++ b/monkey/monkey_island/cc/services/attack/technique_reports/__init__.py
@@ -144,7 +144,7 @@ class AttackTechnique(object, metaclass=abc.ABCMeta):
 
     @classmethod
     def _check_status(cls, status):
-        if status == ScanStatus.UNSCANNED.value and cls._is_disabled_in_config():
+        if status == ScanStatus.UNSCANNED.value and not cls._is_enabled_in_config():
             return ScanStatus.DISABLED.value
         return status
 
diff --git a/monkey/monkey_island/cc/services/attack/technique_reports/attack_technique_test.py b/monkey/monkey_island/cc/services/attack/technique_reports/attack_technique_test.py
index 7b7a71d9b..d5b61c760 100644
--- a/monkey/monkey_island/cc/services/attack/technique_reports/attack_technique_test.py
+++ b/monkey/monkey_island/cc/services/attack/technique_reports/attack_technique_test.py
@@ -1,6 +1,9 @@
+import copy
 from unittest import TestCase
+from unittest.mock import patch
 
 from common.utils.attack_utils import ScanStatus
+from monkey_island.cc.services.attack.attack_config import AttackConfig
 
 from .pba_technique import PostBreachTechnique
 
@@ -24,7 +27,7 @@ config =\
                     'necessary': False,
                     'title': '',
                     'type': 'bool',
-                    'value': False  # this field denotes whether technique is enabled or disabled in config
+                    'value': None  # denotes whether technique is enabled/disabled in config (set below in param_list)
                 }
             }
         }
@@ -45,7 +48,7 @@ param_list = [
             'status': ScanStatus.UNSCANNED.value,
             'title': 'Unscanned technique'
         },
-        set_config(True),  # configuration
+        copy.deepcopy(set_config(True)),  # configuration
         ScanStatus.UNSCANNED.value  # expected status
     ),
 
@@ -57,7 +60,7 @@ param_list = [
             'status': ScanStatus.SCANNED.value,
             'title': 'Scanned technique'
         },
-        set_config(True),  # configuration
+        copy.deepcopy(set_config(True)),  # configuration
         ScanStatus.SCANNED.value  # expected status
     ),
 
@@ -69,7 +72,7 @@ param_list = [
             'status': ScanStatus.USED.value,
             'title': 'Used technique'
         },
-        set_config(True),  # configuration
+        copy.deepcopy(set_config(True)),  # configuration
         ScanStatus.USED.value  # expected status
     ),
 
@@ -81,7 +84,7 @@ param_list = [
             'status': ScanStatus.UNSCANNED.value,
             'title': 'Disabled technique'
         },
-        set_config(False),  # configuration
+        copy.deepcopy(set_config(False)),  # configuration
         ScanStatus.DISABLED.value  # expected status
     )
 ]
@@ -91,4 +94,5 @@ class TestAttackTechnique(TestCase):
     def test__check_status(self):
         for telem_data, config, expected_status in param_list:
             with self.subTest(msg=f"Checking if correct status is returned (status: {telem_data['message']})"):
-                self.assertEqual(T9999._check_status(telem_data['status']), expected_status)
+                with patch.object(AttackConfig, 'get_config', return_value=config):
+                    self.assertEqual(T9999._check_status(telem_data['status']), expected_status)

From 877b08fa6bb61c29adf20e46e83b1ce8afbe1947 Mon Sep 17 00:00:00 2001
From: Shreya <shreya.malviya@gmail.com>
Date: Sun, 26 Jul 2020 20:16:58 +0530
Subject: [PATCH 34/40] Techniques' unscanned messages' phrasing changes

---
 .../monkey_island/cc/services/attack/technique_reports/T1035.py | 2 +-
 .../monkey_island/cc/services/attack/technique_reports/T1053.py | 2 +-
 .../monkey_island/cc/services/attack/technique_reports/T1075.py | 2 +-
 .../monkey_island/cc/services/attack/technique_reports/T1086.py | 2 +-
 .../monkey_island/cc/services/attack/technique_reports/T1129.py | 2 +-
 .../monkey_island/cc/services/attack/technique_reports/T1154.py | 2 +-
 .../monkey_island/cc/services/attack/technique_reports/T1156.py | 2 +-
 .../monkey_island/cc/services/attack/technique_reports/T1166.py | 2 +-
 .../monkey_island/cc/services/attack/technique_reports/T1168.py | 2 +-
 .../monkey_island/cc/services/attack/technique_reports/T1197.py | 2 +-
 .../monkey_island/cc/services/attack/technique_reports/T1504.py | 2 +-
 11 files changed, 11 insertions(+), 11 deletions(-)

diff --git a/monkey/monkey_island/cc/services/attack/technique_reports/T1035.py b/monkey/monkey_island/cc/services/attack/technique_reports/T1035.py
index 025c9f9a8..f56b3e23f 100644
--- a/monkey/monkey_island/cc/services/attack/technique_reports/T1035.py
+++ b/monkey/monkey_island/cc/services/attack/technique_reports/T1035.py
@@ -6,7 +6,7 @@ __author__ = "VakarisZ"
 
 class T1035(UsageTechnique):
     tech_id = "T1035"
-    unscanned_msg = "Monkey didn't try to interact with Windows services since it found no Windows machines."
+    unscanned_msg = "Monkey didn't try to interact with Windows services since it didn't run on any Windows machines."
     scanned_msg = "Monkey tried to interact with Windows services, but failed."
     used_msg = "Monkey successfully interacted with Windows services."
 
diff --git a/monkey/monkey_island/cc/services/attack/technique_reports/T1053.py b/monkey/monkey_island/cc/services/attack/technique_reports/T1053.py
index 103f2409b..511f819e3 100644
--- a/monkey/monkey_island/cc/services/attack/technique_reports/T1053.py
+++ b/monkey/monkey_island/cc/services/attack/technique_reports/T1053.py
@@ -7,7 +7,7 @@ __author__ = "shreyamalviya"
 
 class T1053(PostBreachTechnique):
     tech_id = "T1053"
-    unscanned_msg = "Monkey didn't try scheduling a job on Windows since it found no Windows machines."
+    unscanned_msg = "Monkey didn't try scheduling a job on Windows since it didn't run on any Windows machines."
     scanned_msg = "Monkey tried scheduling a job on the Windows system but failed."
     used_msg = "Monkey scheduled a job on the Windows system."
     pba_names = [POST_BREACH_JOB_SCHEDULING]
diff --git a/monkey/monkey_island/cc/services/attack/technique_reports/T1075.py b/monkey/monkey_island/cc/services/attack/technique_reports/T1075.py
index e8f3a6e4e..56e5f1e82 100644
--- a/monkey/monkey_island/cc/services/attack/technique_reports/T1075.py
+++ b/monkey/monkey_island/cc/services/attack/technique_reports/T1075.py
@@ -7,7 +7,7 @@ __author__ = "VakarisZ"
 
 class T1075(AttackTechnique):
     tech_id = "T1075"
-    unscanned_msg = "Monkey didn't try to use pass the hash attack since it found no Windows machines."
+    unscanned_msg = "Monkey didn't try to use pass the hash attack since it didn't run on any Windows machines."
     scanned_msg = "Monkey tried to use hashes while logging in but didn't succeed."
     used_msg = "Monkey successfully used hashed credentials."
 
diff --git a/monkey/monkey_island/cc/services/attack/technique_reports/T1086.py b/monkey/monkey_island/cc/services/attack/technique_reports/T1086.py
index bd164c6af..c40f2e0ca 100644
--- a/monkey/monkey_island/cc/services/attack/technique_reports/T1086.py
+++ b/monkey/monkey_island/cc/services/attack/technique_reports/T1086.py
@@ -7,7 +7,7 @@ __author__ = "VakarisZ"
 
 class T1086(AttackTechnique):
     tech_id = "T1086"
-    unscanned_msg = "Monkey didn't run powershell since it found no Windows machines."
+    unscanned_msg = "Monkey didn't run powershell since it didn't run on any Windows machines."
     scanned_msg = ""
     used_msg = "Monkey successfully ran powershell commands on exploited machines in the network."
 
diff --git a/monkey/monkey_island/cc/services/attack/technique_reports/T1129.py b/monkey/monkey_island/cc/services/attack/technique_reports/T1129.py
index a91803428..e84698058 100644
--- a/monkey/monkey_island/cc/services/attack/technique_reports/T1129.py
+++ b/monkey/monkey_island/cc/services/attack/technique_reports/T1129.py
@@ -6,7 +6,7 @@ __author__ = "VakarisZ"
 
 class T1129(UsageTechnique):
     tech_id = "T1129"
-    unscanned_msg = "Monkey didn't try to load any DLLs since it found no Windows machines."
+    unscanned_msg = "Monkey didn't try to load any DLLs since it didn't run on any Windows machines."
     scanned_msg = "Monkey tried to load DLLs, but failed."
     used_msg = "Monkey successfully loaded DLLs using Windows module loader."
 
diff --git a/monkey/monkey_island/cc/services/attack/technique_reports/T1154.py b/monkey/monkey_island/cc/services/attack/technique_reports/T1154.py
index 29df2eb65..c905fc9ca 100644
--- a/monkey/monkey_island/cc/services/attack/technique_reports/T1154.py
+++ b/monkey/monkey_island/cc/services/attack/technique_reports/T1154.py
@@ -7,7 +7,7 @@ __author__ = "shreyamalviya"
 
 class T1154(PostBreachTechnique):
     tech_id = "T1154"
-    unscanned_msg = "Monkey didn't use the trap command since it found no Linux machines."
+    unscanned_msg = "Monkey didn't use the trap command since it didn't run on any Linux machines."
     scanned_msg = "Monkey tried using the trap command but failed."
     used_msg = "Monkey used the trap command successfully."
     pba_names = [POST_BREACH_TRAP_COMMAND]
diff --git a/monkey/monkey_island/cc/services/attack/technique_reports/T1156.py b/monkey/monkey_island/cc/services/attack/technique_reports/T1156.py
index 939ebc946..f09b70391 100644
--- a/monkey/monkey_island/cc/services/attack/technique_reports/T1156.py
+++ b/monkey/monkey_island/cc/services/attack/technique_reports/T1156.py
@@ -8,7 +8,7 @@ __author__ = "shreyamalviya"
 
 class T1156(PostBreachTechnique):
     tech_id = "T1156"
-    unscanned_msg = "Monkey didn't try modifying bash startup files since it found no Linux machines."
+    unscanned_msg = "Monkey didn't try modifying bash startup files since it didn't run on any Linux machines."
     scanned_msg = "Monkey tried modifying bash startup files but failed."
     used_msg = "Monkey successfully modified bash startup files."
     pba_names = [POST_BREACH_SHELL_STARTUP_FILE_MODIFICATION]
diff --git a/monkey/monkey_island/cc/services/attack/technique_reports/T1166.py b/monkey/monkey_island/cc/services/attack/technique_reports/T1166.py
index f8aae194d..e3b74e5c5 100644
--- a/monkey/monkey_island/cc/services/attack/technique_reports/T1166.py
+++ b/monkey/monkey_island/cc/services/attack/technique_reports/T1166.py
@@ -7,7 +7,7 @@ __author__ = "shreyamalviya"
 
 class T1166(PostBreachTechnique):
     tech_id = "T1166"
-    unscanned_msg = "Monkey didn't try setting the setuid or setgid bits since it found no Linux machines."
+    unscanned_msg = "Monkey didn't try setting the setuid or setgid bits since it didn't run on any Linux machines."
     scanned_msg = "Monkey tried setting the setuid or setgid bits but failed."
     used_msg = "Monkey successfully set the setuid or setgid bits."
     pba_names = [POST_BREACH_SETUID_SETGID]
diff --git a/monkey/monkey_island/cc/services/attack/technique_reports/T1168.py b/monkey/monkey_island/cc/services/attack/technique_reports/T1168.py
index d7390e913..76806806c 100644
--- a/monkey/monkey_island/cc/services/attack/technique_reports/T1168.py
+++ b/monkey/monkey_island/cc/services/attack/technique_reports/T1168.py
@@ -7,7 +7,7 @@ __author__ = "shreyamalviya"
 
 class T1168(PostBreachTechnique):
     tech_id = "T1168"
-    unscanned_msg = "Monkey didn't try scheduling a job on Linux since it found no Linux machines."
+    unscanned_msg = "Monkey didn't try scheduling a job on Linux since it didn't run on any Linux machines."
     scanned_msg = "Monkey tried scheduling a job on the Linux system but failed."
     used_msg = "Monkey scheduled a job on the Linux system."
     pba_names = [POST_BREACH_JOB_SCHEDULING]
diff --git a/monkey/monkey_island/cc/services/attack/technique_reports/T1197.py b/monkey/monkey_island/cc/services/attack/technique_reports/T1197.py
index c967c6239..b87aeb275 100644
--- a/monkey/monkey_island/cc/services/attack/technique_reports/T1197.py
+++ b/monkey/monkey_island/cc/services/attack/technique_reports/T1197.py
@@ -6,7 +6,7 @@ __author__ = "VakarisZ"
 
 class T1197(AttackTechnique):
     tech_id = "T1197"
-    unscanned_msg = "Monkey didn't try to use any bits jobs since it found no Windows machines."
+    unscanned_msg = "Monkey didn't try to use any bits jobs since it didn't run on any Windows machines."
     scanned_msg = "Monkey tried to use bits jobs but failed."
     used_msg = "Monkey successfully used bits jobs at least once in the network."
 
diff --git a/monkey/monkey_island/cc/services/attack/technique_reports/T1504.py b/monkey/monkey_island/cc/services/attack/technique_reports/T1504.py
index 5e38b6630..db1ea8aa5 100644
--- a/monkey/monkey_island/cc/services/attack/technique_reports/T1504.py
+++ b/monkey/monkey_island/cc/services/attack/technique_reports/T1504.py
@@ -8,7 +8,7 @@ __author__ = "shreyamalviya"
 
 class T1504(PostBreachTechnique):
     tech_id = "T1504"
-    unscanned_msg = "Monkey didn't try modifying powershell startup files since it found no Windows machines."
+    unscanned_msg = "Monkey didn't try modifying powershell startup files since it didn't run on any Windows machines."
     scanned_msg = "Monkey tried modifying powershell startup files but failed."
     used_msg = "Monkey successfully modified powershell startup files."
     pba_names = [POST_BREACH_SHELL_STARTUP_FILE_MODIFICATION]

From 005278cda0812d530e519ebf39a1db22acff697a Mon Sep 17 00:00:00 2001
From: Shreya <shreya.malviya@gmail.com>
Date: Mon, 27 Jul 2020 21:46:17 +0530
Subject: [PATCH 35/40] Small CR changes

---
 .../cc/services/attack/technique_reports/pba_technique.py    | 5 +++--
 .../{attack_technique_test.py => test_attack_technique.py}   | 0
 2 files changed, 3 insertions(+), 2 deletions(-)
 rename monkey/monkey_island/cc/services/attack/technique_reports/{attack_technique_test.py => test_attack_technique.py} (100%)

diff --git a/monkey/monkey_island/cc/services/attack/technique_reports/pba_technique.py b/monkey/monkey_island/cc/services/attack/technique_reports/pba_technique.py
index a7ef96803..393bbc9db 100644
--- a/monkey/monkey_island/cc/services/attack/technique_reports/pba_technique.py
+++ b/monkey/monkey_island/cc/services/attack/technique_reports/pba_technique.py
@@ -1,4 +1,5 @@
 import abc
+from typing import List
 
 from common.utils.attack_utils import ScanStatus
 from monkey_island.cc.database import mongo
@@ -11,9 +12,9 @@ class PostBreachTechnique(AttackTechnique, metaclass=abc.ABCMeta):
 
     @property
     @abc.abstractmethod
-    def pba_names(self):
+    def pba_names(self) -> List[str]:
         """
-        :return: name of post breach action
+        :return: names of post breach action
         """
         pass
 
diff --git a/monkey/monkey_island/cc/services/attack/technique_reports/attack_technique_test.py b/monkey/monkey_island/cc/services/attack/technique_reports/test_attack_technique.py
similarity index 100%
rename from monkey/monkey_island/cc/services/attack/technique_reports/attack_technique_test.py
rename to monkey/monkey_island/cc/services/attack/technique_reports/test_attack_technique.py

From 76aae1faeca7cc6e822ab4f818cccaafd7ec86a7 Mon Sep 17 00:00:00 2001
From: Shreya <shreya.malviya@gmail.com>
Date: Mon, 27 Jul 2020 22:56:35 +0530
Subject: [PATCH 36/40] Change MITRE report color scheme

---
 .../monkey_island/cc/ui/src/styles/components/Collapse.scss | 4 ++--
 .../cc/ui/src/styles/pages/report/ReportAttackMatrix.scss   | 6 +++---
 2 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/monkey/monkey_island/cc/ui/src/styles/components/Collapse.scss b/monkey/monkey_island/cc/ui/src/styles/components/Collapse.scss
index 8d412c15d..b74088a77 100644
--- a/monkey/monkey_island/cc/ui/src/styles/components/Collapse.scss
+++ b/monkey/monkey_island/cc/ui/src/styles/components/Collapse.scss
@@ -1,9 +1,9 @@
 $transition: 300ms cubic-bezier(0.6, 0.3, 0.3, 0.6);
 
 $danger-color: #ebbcba;
-$disabled-color: #b7c2ff;
+$disabled-color: #f4f4f4;
 $info-color: #ade3eb;
-$default-color: #e0ddde;
+$default-color: #cbcbcb;
 $warning-color: #ffe28d;
 
 .collapse-item button {
diff --git a/monkey/monkey_island/cc/ui/src/styles/pages/report/ReportAttackMatrix.scss b/monkey/monkey_island/cc/ui/src/styles/pages/report/ReportAttackMatrix.scss
index 4f42f49d9..30c4a70e4 100644
--- a/monkey/monkey_island/cc/ui/src/styles/pages/report/ReportAttackMatrix.scss
+++ b/monkey/monkey_island/cc/ui/src/styles/pages/report/ReportAttackMatrix.scss
@@ -1,6 +1,6 @@
 // colors
-$disabled: #b7c2ff;
-$not-attempted: #e0ddde;
+$disabled: #f4f4f4;
+$not-attempted: #cbcbcb;
 $attempted: #ffe28d;
 $used: #ebbcba;
 $black: #3a3a3a;
@@ -22,7 +22,7 @@ $black: #3a3a3a;
 
 .attack-matrix .status-3 {
   background-color: $disabled !important;
-  color: $black;
+  color: #929090;
 }
 
 .attack-matrix div.rt-td:hover {

From 98ef46b4ec7c1557337ba30a0ad402c77b68dc44 Mon Sep 17 00:00:00 2001
From: Shreya <shreya.malviya@gmail.com>
Date: Tue, 28 Jul 2020 14:58:39 +0530
Subject: [PATCH 37/40] Change logic for checking technique status

---
 .../attack/technique_reports/T1003.py         | 11 +++++--
 .../attack/technique_reports/T1016.py         | 10 ++++--
 .../attack/technique_reports/T1018.py         | 14 +++++---
 .../attack/technique_reports/T1021.py         | 27 +++++++++-------
 .../attack/technique_reports/T1041.py         | 20 ++++++++----
 .../attack/technique_reports/T1059.py         | 14 +++++---
 .../attack/technique_reports/T1075.py         | 19 +++++++----
 .../attack/technique_reports/T1082.py         | 15 ++++++---
 .../attack/technique_reports/T1086.py         | 13 +++++---
 .../attack/technique_reports/T1090.py         | 12 +++++--
 .../attack/technique_reports/T1110.py         | 32 +++++++++++--------
 .../attack/technique_reports/T1145.py         | 13 +++++---
 .../attack/technique_reports/T1188.py         | 30 ++++++++++-------
 .../attack/technique_reports/T1210.py         | 21 ++++++++----
 .../attack/technique_reports/__init__.py      | 16 ++--------
 .../attack/technique_reports/pba_technique.py | 21 ++++++------
 16 files changed, 178 insertions(+), 110 deletions(-)

diff --git a/monkey/monkey_island/cc/services/attack/technique_reports/T1003.py b/monkey/monkey_island/cc/services/attack/technique_reports/T1003.py
index f5844e2c0..f792a2082 100644
--- a/monkey/monkey_island/cc/services/attack/technique_reports/T1003.py
+++ b/monkey/monkey_island/cc/services/attack/technique_reports/T1003.py
@@ -19,10 +19,15 @@ class T1003(AttackTechnique):
     @staticmethod
     def get_report_data():
         data = {'title': T1003.technique_title()}
-        if mongo.db.telemetry.count_documents(T1003.query):
-            status = ScanStatus.USED.value
+
+        if not T1003.is_enabled_in_config():
+            status = ScanStatus.DISABLED.value
         else:
-            status = ScanStatus.UNSCANNED.value
+            if mongo.db.telemetry.count_documents(T1003.query):
+                status = ScanStatus.USED.value
+            else:
+                status = ScanStatus.UNSCANNED.value
+
         data.update(T1003.get_message_and_status(status))
         data.update(T1003.get_mitigation_by_status(status))
         data['stolen_creds'] = ReportService.get_stolen_creds()
diff --git a/monkey/monkey_island/cc/services/attack/technique_reports/T1016.py b/monkey/monkey_island/cc/services/attack/technique_reports/T1016.py
index cfda065f1..332393b15 100644
--- a/monkey/monkey_island/cc/services/attack/technique_reports/T1016.py
+++ b/monkey/monkey_island/cc/services/attack/technique_reports/T1016.py
@@ -27,8 +27,14 @@ class T1016(AttackTechnique):
 
     @staticmethod
     def get_report_data():
-        network_info = list(mongo.db.telemetry.aggregate(T1016.query))
-        status = ScanStatus.USED.value if network_info else ScanStatus.UNSCANNED.value
+        network_info = []
+
+        if not T1016.is_enabled_in_config():
+            status = ScanStatus.DISABLED.value
+        else:
+            network_info = list(mongo.db.telemetry.aggregate(T1016.query))
+            status = ScanStatus.USED.value if network_info else ScanStatus.UNSCANNED.value
+
         data = T1016.get_base_data_by_status(status)
         data.update({'network_info': network_info})
         return data
diff --git a/monkey/monkey_island/cc/services/attack/technique_reports/T1018.py b/monkey/monkey_island/cc/services/attack/technique_reports/T1018.py
index 65972265d..93c546573 100644
--- a/monkey/monkey_island/cc/services/attack/technique_reports/T1018.py
+++ b/monkey/monkey_island/cc/services/attack/technique_reports/T1018.py
@@ -28,11 +28,17 @@ class T1018(AttackTechnique):
 
     @staticmethod
     def get_report_data():
-        scan_info = list(mongo.db.telemetry.aggregate(T1018.query))
-        if scan_info:
-            status = ScanStatus.USED.value
+        scan_info = []
+
+        if not T1018.is_enabled_in_config():
+            status = ScanStatus.DISABLED.value
         else:
-            status = ScanStatus.UNSCANNED.value
+            scan_info = list(mongo.db.telemetry.aggregate(T1018.query))
+            if scan_info:
+                status = ScanStatus.USED.value
+            else:
+                status = ScanStatus.UNSCANNED.value
+
         data = T1018.get_base_data_by_status(status)
         data.update({'scan_info': scan_info})
         return data
diff --git a/monkey/monkey_island/cc/services/attack/technique_reports/T1021.py b/monkey/monkey_island/cc/services/attack/technique_reports/T1021.py
index f197724dd..ac6a7ac0b 100644
--- a/monkey/monkey_island/cc/services/attack/technique_reports/T1021.py
+++ b/monkey/monkey_island/cc/services/attack/technique_reports/T1021.py
@@ -34,18 +34,23 @@ class T1021(AttackTechnique):
     @staticmethod
     def get_report_data():
         attempts = []
-        if mongo.db.telemetry.count_documents(T1021.scanned_query):
-            attempts = list(mongo.db.telemetry.aggregate(T1021.query))
-            if attempts:
-                status = ScanStatus.USED.value
-                for result in attempts:
-                    result['successful_creds'] = []
-                    for attempt in result['attempts']:
-                        result['successful_creds'].append(parse_creds(attempt))
-            else:
-                status = ScanStatus.SCANNED.value
+
+        if not T1021.is_enabled_in_config():
+            status = ScanStatus.DISABLED.value
         else:
-            status = ScanStatus.UNSCANNED.value
+            if mongo.db.telemetry.count_documents(T1021.scanned_query):
+                attempts = list(mongo.db.telemetry.aggregate(T1021.query))
+                if attempts:
+                    status = ScanStatus.USED.value
+                    for result in attempts:
+                        result['successful_creds'] = []
+                        for attempt in result['attempts']:
+                            result['successful_creds'].append(parse_creds(attempt))
+                else:
+                    status = ScanStatus.SCANNED.value
+            else:
+                status = ScanStatus.UNSCANNED.value
+
         data = T1021.get_base_data_by_status(status)
         data.update({'services': attempts})
         return data
diff --git a/monkey/monkey_island/cc/services/attack/technique_reports/T1041.py b/monkey/monkey_island/cc/services/attack/technique_reports/T1041.py
index 737004111..46738a799 100644
--- a/monkey/monkey_island/cc/services/attack/technique_reports/T1041.py
+++ b/monkey/monkey_island/cc/services/attack/technique_reports/T1041.py
@@ -13,14 +13,20 @@ class T1041(AttackTechnique):
 
     @staticmethod
     def get_report_data():
-        monkeys = list(Monkey.objects())
-        info = [{'src': monkey['command_control_channel']['src'],
-                 'dst': monkey['command_control_channel']['dst']}
-                for monkey in monkeys if monkey['command_control_channel']]
-        if info:
-            status = ScanStatus.USED.value
+        info = []
+
+        if not T1041.is_enabled_in_config():
+            status = ScanStatus.DISABLED.value
         else:
-            status = ScanStatus.UNSCANNED.value
+            monkeys = list(Monkey.objects())
+            info = [{'src': monkey['command_control_channel']['src'],
+                    'dst': monkey['command_control_channel']['dst']}
+                    for monkey in monkeys if monkey['command_control_channel']]
+            if info:
+                status = ScanStatus.USED.value
+            else:
+                status = ScanStatus.UNSCANNED.value
+
         data = T1041.get_base_data_by_status(status)
         data.update({'command_control_channel': info})
         return data
diff --git a/monkey/monkey_island/cc/services/attack/technique_reports/T1059.py b/monkey/monkey_island/cc/services/attack/technique_reports/T1059.py
index 987c24d09..38d7bb1c3 100644
--- a/monkey/monkey_island/cc/services/attack/technique_reports/T1059.py
+++ b/monkey/monkey_island/cc/services/attack/technique_reports/T1059.py
@@ -23,12 +23,16 @@ class T1059(AttackTechnique):
 
     @staticmethod
     def get_report_data():
-        cmd_data = list(mongo.db.telemetry.aggregate(T1059.query))
-        data = {'title': T1059.technique_title(), 'cmds': cmd_data}
-        if cmd_data:
-            status = ScanStatus.USED.value
+        if not T1059.is_enabled_in_config():
+            status = ScanStatus.DISABLED.value
         else:
-            status = ScanStatus.UNSCANNED.value
+            cmd_data = list(mongo.db.telemetry.aggregate(T1059.query))
+            data = {'title': T1059.technique_title(), 'cmds': cmd_data}
+            if cmd_data:
+                status = ScanStatus.USED.value
+            else:
+                status = ScanStatus.UNSCANNED.value
+
         data.update(T1059.get_message_and_status(status))
         data.update(T1059.get_mitigation_by_status(status))
         return data
diff --git a/monkey/monkey_island/cc/services/attack/technique_reports/T1075.py b/monkey/monkey_island/cc/services/attack/technique_reports/T1075.py
index 56e5f1e82..82d297234 100644
--- a/monkey/monkey_island/cc/services/attack/technique_reports/T1075.py
+++ b/monkey/monkey_island/cc/services/attack/technique_reports/T1075.py
@@ -31,14 +31,19 @@ class T1075(AttackTechnique):
     @staticmethod
     def get_report_data():
         data = {'title': T1075.technique_title()}
-        successful_logins = list(mongo.db.telemetry.aggregate(T1075.query))
-        data.update({'successful_logins': successful_logins})
-        if successful_logins:
-            status = ScanStatus.USED.value
-        elif mongo.db.telemetry.count_documents(T1075.login_attempt_query):
-            status = ScanStatus.SCANNED.value
+
+        if not T1075.is_enabled_in_config():
+            status = ScanStatus.DISABLED.value
         else:
-            status = ScanStatus.UNSCANNED.value
+            successful_logins = list(mongo.db.telemetry.aggregate(T1075.query))
+            data.update({'successful_logins': successful_logins})
+            if successful_logins:
+                status = ScanStatus.USED.value
+            elif mongo.db.telemetry.count_documents(T1075.login_attempt_query):
+                status = ScanStatus.SCANNED.value
+            else:
+                status = ScanStatus.UNSCANNED.value
+
         data.update(T1075.get_message_and_status(status))
         data.update(T1075.get_mitigation_by_status(status))
         return data
diff --git a/monkey/monkey_island/cc/services/attack/technique_reports/T1082.py b/monkey/monkey_island/cc/services/attack/technique_reports/T1082.py
index 7e8801000..3b75dc10e 100644
--- a/monkey/monkey_island/cc/services/attack/technique_reports/T1082.py
+++ b/monkey/monkey_island/cc/services/attack/technique_reports/T1082.py
@@ -39,12 +39,17 @@ class T1082(AttackTechnique):
     @staticmethod
     def get_report_data():
         data = {'title': T1082.technique_title()}
-        system_info = list(mongo.db.telemetry.aggregate(T1082.query))
-        data.update({'system_info': system_info})
-        if system_info:
-            status = ScanStatus.USED.value
+
+        if not T1082.is_enabled_in_config():
+            status = ScanStatus.DISABLED.value
         else:
-            status = ScanStatus.UNSCANNED.value
+            system_info = list(mongo.db.telemetry.aggregate(T1082.query))
+            data.update({'system_info': system_info})
+            if system_info:
+                status = ScanStatus.USED.value
+            else:
+                status = ScanStatus.UNSCANNED.value
+
         data.update(T1082.get_mitigation_by_status(status))
         data.update(T1082.get_message_and_status(status))
         return data
diff --git a/monkey/monkey_island/cc/services/attack/technique_reports/T1086.py b/monkey/monkey_island/cc/services/attack/technique_reports/T1086.py
index c40f2e0ca..8ad104cf9 100644
--- a/monkey/monkey_island/cc/services/attack/technique_reports/T1086.py
+++ b/monkey/monkey_island/cc/services/attack/technique_reports/T1086.py
@@ -25,12 +25,15 @@ class T1086(AttackTechnique):
 
     @staticmethod
     def get_report_data():
-        cmd_data = list(mongo.db.telemetry.aggregate(T1086.query))
-        data = {'title': T1086.technique_title(), 'cmds': cmd_data}
-        if cmd_data:
-            status = ScanStatus.USED.value
+        if not T1086.is_enabled_in_config():
+            status = ScanStatus.DISABLED.value
         else:
-            status = ScanStatus.UNSCANNED.value
+            cmd_data = list(mongo.db.telemetry.aggregate(T1086.query))
+            data = {'title': T1086.technique_title(), 'cmds': cmd_data}
+            if cmd_data:
+                status = ScanStatus.USED.value
+            else:
+                status = ScanStatus.UNSCANNED.value
 
         data.update(T1086.get_mitigation_by_status(status))
         data.update(T1086.get_message_and_status(status))
diff --git a/monkey/monkey_island/cc/services/attack/technique_reports/T1090.py b/monkey/monkey_island/cc/services/attack/technique_reports/T1090.py
index f0980637f..f2490e72e 100644
--- a/monkey/monkey_island/cc/services/attack/technique_reports/T1090.py
+++ b/monkey/monkey_island/cc/services/attack/technique_reports/T1090.py
@@ -13,9 +13,15 @@ class T1090(AttackTechnique):
 
     @staticmethod
     def get_report_data():
-        monkeys = Monkey.get_tunneled_monkeys()
-        monkeys = [monkey.get_network_info() for monkey in monkeys]
-        status = ScanStatus.USED.value if monkeys else ScanStatus.UNSCANNED.value
+        monkeys = []
+
+        if not T1090.is_enabled_in_config():
+            status = ScanStatus.DISABLED.value
+        else:
+            monkeys = Monkey.get_tunneled_monkeys()
+            monkeys = [monkey.get_network_info() for monkey in monkeys]
+            status = ScanStatus.USED.value if monkeys else ScanStatus.UNSCANNED.value
+
         data = T1090.get_base_data_by_status(status)
         data.update({'proxies': monkeys})
         return data
diff --git a/monkey/monkey_island/cc/services/attack/technique_reports/T1110.py b/monkey/monkey_island/cc/services/attack/technique_reports/T1110.py
index 63ba68d6f..39eab28e6 100644
--- a/monkey/monkey_island/cc/services/attack/technique_reports/T1110.py
+++ b/monkey/monkey_island/cc/services/attack/technique_reports/T1110.py
@@ -26,21 +26,27 @@ class T1110(AttackTechnique):
 
     @staticmethod
     def get_report_data():
-        attempts = list(mongo.db.telemetry.aggregate(T1110.query))
-        succeeded = False
+        attempts = []
 
-        for result in attempts:
-            result['successful_creds'] = []
-            for attempt in result['attempts']:
-                succeeded = True
-                result['successful_creds'].append(parse_creds(attempt))
-
-        if succeeded:
-            status = ScanStatus.USED.value
-        elif attempts:
-            status = ScanStatus.SCANNED.value
+        if not T1110.is_enabled_in_config():
+            status = ScanStatus.DISABLED.value
         else:
-            status = ScanStatus.UNSCANNED.value
+            attempts = list(mongo.db.telemetry.aggregate(T1110.query))
+            succeeded = False
+
+            for result in attempts:
+                result['successful_creds'] = []
+                for attempt in result['attempts']:
+                    succeeded = True
+                    result['successful_creds'].append(parse_creds(attempt))
+
+            if succeeded:
+                status = ScanStatus.USED.value
+            elif attempts:
+                status = ScanStatus.SCANNED.value
+            else:
+                status = ScanStatus.UNSCANNED.value
+
         data = T1110.get_base_data_by_status(status)
         # Remove data with no successful brute force attempts
         attempts = [attempt for attempt in attempts if attempt['attempts']]
diff --git a/monkey/monkey_island/cc/services/attack/technique_reports/T1145.py b/monkey/monkey_island/cc/services/attack/technique_reports/T1145.py
index 736192b1f..1089e1027 100644
--- a/monkey/monkey_island/cc/services/attack/technique_reports/T1145.py
+++ b/monkey/monkey_island/cc/services/attack/technique_reports/T1145.py
@@ -20,12 +20,17 @@ class T1145(AttackTechnique):
 
     @staticmethod
     def get_report_data():
-        ssh_info = list(mongo.db.telemetry.aggregate(T1145.query))
+        ssh_info = []
 
-        if ssh_info:
-            status = ScanStatus.USED.value
+        if not T1145.is_enabled_in_config():
+            status = ScanStatus.DISABLED.value
         else:
-            status = ScanStatus.UNSCANNED.value
+            ssh_info = list(mongo.db.telemetry.aggregate(T1145.query))
+            if ssh_info:
+                status = ScanStatus.USED.value
+            else:
+                status = ScanStatus.UNSCANNED.value
+
         data = T1145.get_base_data_by_status(status)
         data.update({'ssh_info': ssh_info})
         return data
diff --git a/monkey/monkey_island/cc/services/attack/technique_reports/T1188.py b/monkey/monkey_island/cc/services/attack/technique_reports/T1188.py
index 09e0edcdf..269fa4148 100644
--- a/monkey/monkey_island/cc/services/attack/technique_reports/T1188.py
+++ b/monkey/monkey_island/cc/services/attack/technique_reports/T1188.py
@@ -13,19 +13,25 @@ class T1188(AttackTechnique):
 
     @staticmethod
     def get_report_data():
-        monkeys = Monkey.get_tunneled_monkeys()
         hops = []
-        for monkey in monkeys:
-            proxy_count = 0
-            proxy = initial = monkey
-            while proxy.tunnel:
-                proxy_count += 1
-                proxy = proxy.tunnel
-            if proxy_count > 1:
-                hops.append({'from': initial.get_network_info(),
-                             'to': proxy.get_network_info(),
-                             'count': proxy_count})
-        status = ScanStatus.USED.value if hops else ScanStatus.UNSCANNED.value
+
+        if not T1188.is_enabled_in_config():
+            status = ScanStatus.DISABLED.value
+        else:
+            monkeys = Monkey.get_tunneled_monkeys()
+            hops = []
+            for monkey in monkeys:
+                proxy_count = 0
+                proxy = initial = monkey
+                while proxy.tunnel:
+                    proxy_count += 1
+                    proxy = proxy.tunnel
+                if proxy_count > 1:
+                    hops.append({'from': initial.get_network_info(),
+                                 'to': proxy.get_network_info(),
+                                 'count': proxy_count})
+            status = ScanStatus.USED.value if hops else ScanStatus.UNSCANNED.value
+
         data = T1188.get_base_data_by_status(status)
         data.update({'hops': hops})
         return data
diff --git a/monkey/monkey_island/cc/services/attack/technique_reports/T1210.py b/monkey/monkey_island/cc/services/attack/technique_reports/T1210.py
index 8fe86ed61..2df22c8ef 100644
--- a/monkey/monkey_island/cc/services/attack/technique_reports/T1210.py
+++ b/monkey/monkey_island/cc/services/attack/technique_reports/T1210.py
@@ -13,15 +13,22 @@ class T1210(AttackTechnique):
 
     @staticmethod
     def get_report_data():
+        scanned_services = []
+        exploited_services = []
         data = {'title': T1210.technique_title()}
-        scanned_services = T1210.get_scanned_services()
-        exploited_services = T1210.get_exploited_services()
-        if exploited_services:
-            status = ScanStatus.USED.value
-        elif scanned_services:
-            status = ScanStatus.SCANNED.value
+
+        if not T1210.is_enabled_in_config():
+            status = ScanStatus.DISABLED.value
         else:
-            status = ScanStatus.UNSCANNED.value
+            scanned_services = T1210.get_scanned_services()
+            exploited_services = T1210.get_exploited_services()
+            if exploited_services:
+                status = ScanStatus.USED.value
+            elif scanned_services:
+                status = ScanStatus.SCANNED.value
+            else:
+                status = ScanStatus.UNSCANNED.value
+
         data.update(T1210.get_message_and_status(status))
         data.update(T1210.get_mitigation_by_status(status))
         data.update({'scanned_services': scanned_services, 'exploited_services': exploited_services})
diff --git a/monkey/monkey_island/cc/services/attack/technique_reports/__init__.py b/monkey/monkey_island/cc/services/attack/technique_reports/__init__.py
index 3cc79ae17..c380269f5 100644
--- a/monkey/monkey_island/cc/services/attack/technique_reports/__init__.py
+++ b/monkey/monkey_island/cc/services/attack/technique_reports/__init__.py
@@ -63,7 +63,7 @@ class AttackTechnique(object, metaclass=abc.ABCMeta):
         Gets the status of a certain attack technique.
         :return: ScanStatus numeric value
         """
-        if cls._is_disabled_in_config():
+        if not cls.is_enabled_in_config():
             return ScanStatus.DISABLED.value
         elif mongo.db.telemetry.find_one({'telem_category': 'attack',
                                           'data.status': ScanStatus.USED.value,
@@ -83,7 +83,6 @@ class AttackTechnique(object, metaclass=abc.ABCMeta):
         :param status: Enum from common/attack_utils.py integer value
         :return: Dict with message and status
         """
-        status = cls._check_status(status)
         return {'message': cls.get_message_by_status(status), 'status': status}
 
     @classmethod
@@ -93,7 +92,6 @@ class AttackTechnique(object, metaclass=abc.ABCMeta):
         :param status: Enum from common/attack_utils.py integer value
         :return: message string
         """
-        status = cls._check_status(status)
         if status == ScanStatus.DISABLED.value:
             return disabled_msg
         if status == ScanStatus.UNSCANNED.value:
@@ -127,7 +125,6 @@ class AttackTechnique(object, metaclass=abc.ABCMeta):
 
     @classmethod
     def get_base_data_by_status(cls, status):
-        status = cls._check_status(status)
         data = cls.get_message_and_status(status)
         data.update({'title': cls.technique_title()})
         data.update(cls.get_mitigation_by_status(status))
@@ -135,7 +132,6 @@ class AttackTechnique(object, metaclass=abc.ABCMeta):
 
     @classmethod
     def get_mitigation_by_status(cls, status: ScanStatus) -> dict:
-        status = cls._check_status(status)
         if status == ScanStatus.USED.value:
             mitigation_document = AttackMitigations.get_mitigation_by_technique_id(str(cls.tech_id))
             return {'mitigations': mitigation_document.to_mongo().to_dict()['mitigations']}
@@ -143,11 +139,5 @@ class AttackTechnique(object, metaclass=abc.ABCMeta):
             return {}
 
     @classmethod
-    def _check_status(cls, status):
-        if status == ScanStatus.UNSCANNED.value and not cls._is_enabled_in_config():
-            return ScanStatus.DISABLED.value
-        return status
-
-    @classmethod
-    def _is_disabled_in_config(cls):
-        return not AttackConfig.get_technique_values()[cls.tech_id]
+    def is_enabled_in_config(cls) -> bool:
+        return AttackConfig.get_technique_values()[cls.tech_id]
diff --git a/monkey/monkey_island/cc/services/attack/technique_reports/pba_technique.py b/monkey/monkey_island/cc/services/attack/technique_reports/pba_technique.py
index 393bbc9db..06c10a627 100644
--- a/monkey/monkey_island/cc/services/attack/technique_reports/pba_technique.py
+++ b/monkey/monkey_island/cc/services/attack/technique_reports/pba_technique.py
@@ -39,16 +39,19 @@ class PostBreachTechnique(AttackTechnique, metaclass=abc.ABCMeta):
         :return: Technique's report data aggregated from the database
         """
         data = {'title': cls.technique_title(), 'info': []}
+        info = []
 
-        info = list(mongo.db.telemetry.aggregate(cls.get_pba_query(cls.pba_names)))
-
-        status = ScanStatus.UNSCANNED.value
-        if info:
-            successful_PBAs = mongo.db.telemetry.count({
-                '$or': [{'data.name': pba_name} for pba_name in cls.pba_names],
-                'data.result.1': True
-            })
-            status = ScanStatus.USED.value if successful_PBAs else ScanStatus.SCANNED.value
+        if not cls.is_enabled_in_config():
+            status = ScanStatus.DISABLED.value
+        else:
+            info = list(mongo.db.telemetry.aggregate(cls.get_pba_query(cls.pba_names)))
+            status = ScanStatus.UNSCANNED.value
+            if info:
+                successful_PBAs = mongo.db.telemetry.count({
+                    '$or': [{'data.name': pba_name} for pba_name in cls.pba_names],
+                    'data.result.1': True
+                })
+                status = ScanStatus.USED.value if successful_PBAs else ScanStatus.SCANNED.value
 
         data.update(cls.get_base_data_by_status(status))
         data.update({'info': info})

From 16e2c94037420c6cb9f1f048c17624a78c273797 Mon Sep 17 00:00:00 2001
From: Shreya <shreya.malviya@gmail.com>
Date: Tue, 28 Jul 2020 21:06:22 +0530
Subject: [PATCH 38/40] Add decorator for checking if technique is disabled

---
 .../services/attack/technique_reports/T1003.py | 11 ++++++-----
 .../services/attack/technique_reports/T1016.py | 10 +++++-----
 .../services/attack/technique_reports/T1018.py | 10 +++++-----
 .../services/attack/technique_reports/T1021.py | 11 ++++++-----
 .../services/attack/technique_reports/T1041.py | 10 +++++-----
 .../services/attack/technique_reports/T1059.py | 10 ++++++----
 .../services/attack/technique_reports/T1075.py | 13 +++++++------
 .../services/attack/technique_reports/T1082.py | 13 +++++++------
 .../services/attack/technique_reports/T1086.py | 10 ++++++----
 .../services/attack/technique_reports/T1090.py | 10 +++++-----
 .../services/attack/technique_reports/T1110.py | 10 +++++-----
 .../services/attack/technique_reports/T1145.py | 10 +++++-----
 .../services/attack/technique_reports/T1188.py | 10 +++++-----
 .../services/attack/technique_reports/T1210.py | 18 +++++++++++-------
 .../attack/technique_reports/__init__.py       | 10 ++++++++--
 .../attack/technique_reports/pba_technique.py  | 12 ++++++------
 16 files changed, 98 insertions(+), 80 deletions(-)

diff --git a/monkey/monkey_island/cc/services/attack/technique_reports/T1003.py b/monkey/monkey_island/cc/services/attack/technique_reports/T1003.py
index f792a2082..d8ee9de26 100644
--- a/monkey/monkey_island/cc/services/attack/technique_reports/T1003.py
+++ b/monkey/monkey_island/cc/services/attack/technique_reports/T1003.py
@@ -18,15 +18,16 @@ class T1003(AttackTechnique):
 
     @staticmethod
     def get_report_data():
-        data = {'title': T1003.technique_title()}
-
-        if not T1003.is_enabled_in_config():
-            status = ScanStatus.DISABLED.value
-        else:
+        @T1003.is_status_disabled
+        def get_technique_status_and_data():
             if mongo.db.telemetry.count_documents(T1003.query):
                 status = ScanStatus.USED.value
             else:
                 status = ScanStatus.UNSCANNED.value
+            return (status, [])
+
+        data = {'title': T1003.technique_title()}
+        status, _ = get_technique_status_and_data()
 
         data.update(T1003.get_message_and_status(status))
         data.update(T1003.get_mitigation_by_status(status))
diff --git a/monkey/monkey_island/cc/services/attack/technique_reports/T1016.py b/monkey/monkey_island/cc/services/attack/technique_reports/T1016.py
index 332393b15..a1162b109 100644
--- a/monkey/monkey_island/cc/services/attack/technique_reports/T1016.py
+++ b/monkey/monkey_island/cc/services/attack/technique_reports/T1016.py
@@ -27,13 +27,13 @@ class T1016(AttackTechnique):
 
     @staticmethod
     def get_report_data():
-        network_info = []
-
-        if not T1016.is_enabled_in_config():
-            status = ScanStatus.DISABLED.value
-        else:
+        @T1016.is_status_disabled
+        def get_technique_status_and_data():
             network_info = list(mongo.db.telemetry.aggregate(T1016.query))
             status = ScanStatus.USED.value if network_info else ScanStatus.UNSCANNED.value
+            return (status, network_info)
+
+        status, network_info = get_technique_status_and_data()
 
         data = T1016.get_base_data_by_status(status)
         data.update({'network_info': network_info})
diff --git a/monkey/monkey_island/cc/services/attack/technique_reports/T1018.py b/monkey/monkey_island/cc/services/attack/technique_reports/T1018.py
index 93c546573..3ea49603c 100644
--- a/monkey/monkey_island/cc/services/attack/technique_reports/T1018.py
+++ b/monkey/monkey_island/cc/services/attack/technique_reports/T1018.py
@@ -28,16 +28,16 @@ class T1018(AttackTechnique):
 
     @staticmethod
     def get_report_data():
-        scan_info = []
-
-        if not T1018.is_enabled_in_config():
-            status = ScanStatus.DISABLED.value
-        else:
+        @T1018.is_status_disabled
+        def get_technique_status_and_data():
             scan_info = list(mongo.db.telemetry.aggregate(T1018.query))
             if scan_info:
                 status = ScanStatus.USED.value
             else:
                 status = ScanStatus.UNSCANNED.value
+            return (status, scan_info)
+
+        status, scan_info = get_technique_status_and_data()
 
         data = T1018.get_base_data_by_status(status)
         data.update({'scan_info': scan_info})
diff --git a/monkey/monkey_island/cc/services/attack/technique_reports/T1021.py b/monkey/monkey_island/cc/services/attack/technique_reports/T1021.py
index ac6a7ac0b..a43c76479 100644
--- a/monkey/monkey_island/cc/services/attack/technique_reports/T1021.py
+++ b/monkey/monkey_island/cc/services/attack/technique_reports/T1021.py
@@ -33,11 +33,9 @@ class T1021(AttackTechnique):
 
     @staticmethod
     def get_report_data():
-        attempts = []
-
-        if not T1021.is_enabled_in_config():
-            status = ScanStatus.DISABLED.value
-        else:
+        @T1021.is_status_disabled
+        def get_technique_status_and_data():
+            attempts = []
             if mongo.db.telemetry.count_documents(T1021.scanned_query):
                 attempts = list(mongo.db.telemetry.aggregate(T1021.query))
                 if attempts:
@@ -50,6 +48,9 @@ class T1021(AttackTechnique):
                     status = ScanStatus.SCANNED.value
             else:
                 status = ScanStatus.UNSCANNED.value
+            return (status, attempts)
+
+        status, attempts = get_technique_status_and_data()
 
         data = T1021.get_base_data_by_status(status)
         data.update({'services': attempts})
diff --git a/monkey/monkey_island/cc/services/attack/technique_reports/T1041.py b/monkey/monkey_island/cc/services/attack/technique_reports/T1041.py
index 46738a799..b4548dac8 100644
--- a/monkey/monkey_island/cc/services/attack/technique_reports/T1041.py
+++ b/monkey/monkey_island/cc/services/attack/technique_reports/T1041.py
@@ -13,11 +13,8 @@ class T1041(AttackTechnique):
 
     @staticmethod
     def get_report_data():
-        info = []
-
-        if not T1041.is_enabled_in_config():
-            status = ScanStatus.DISABLED.value
-        else:
+        @T1041.is_status_disabled
+        def get_technique_status_and_data():
             monkeys = list(Monkey.objects())
             info = [{'src': monkey['command_control_channel']['src'],
                     'dst': monkey['command_control_channel']['dst']}
@@ -26,6 +23,9 @@ class T1041(AttackTechnique):
                 status = ScanStatus.USED.value
             else:
                 status = ScanStatus.UNSCANNED.value
+            return (status, info)
+
+        status, info = get_technique_status_and_data()
 
         data = T1041.get_base_data_by_status(status)
         data.update({'command_control_channel': info})
diff --git a/monkey/monkey_island/cc/services/attack/technique_reports/T1059.py b/monkey/monkey_island/cc/services/attack/technique_reports/T1059.py
index 38d7bb1c3..b702ddd58 100644
--- a/monkey/monkey_island/cc/services/attack/technique_reports/T1059.py
+++ b/monkey/monkey_island/cc/services/attack/technique_reports/T1059.py
@@ -23,15 +23,17 @@ class T1059(AttackTechnique):
 
     @staticmethod
     def get_report_data():
-        if not T1059.is_enabled_in_config():
-            status = ScanStatus.DISABLED.value
-        else:
+        @T1059.is_status_disabled
+        def get_technique_status_and_data():
             cmd_data = list(mongo.db.telemetry.aggregate(T1059.query))
-            data = {'title': T1059.technique_title(), 'cmds': cmd_data}
             if cmd_data:
                 status = ScanStatus.USED.value
             else:
                 status = ScanStatus.UNSCANNED.value
+            return (status, cmd_data)
+
+        status, cmd_data = get_technique_status_and_data()
+        data = {'title': T1059.technique_title(), 'cmds': cmd_data}
 
         data.update(T1059.get_message_and_status(status))
         data.update(T1059.get_mitigation_by_status(status))
diff --git a/monkey/monkey_island/cc/services/attack/technique_reports/T1075.py b/monkey/monkey_island/cc/services/attack/technique_reports/T1075.py
index 82d297234..5d3f270e7 100644
--- a/monkey/monkey_island/cc/services/attack/technique_reports/T1075.py
+++ b/monkey/monkey_island/cc/services/attack/technique_reports/T1075.py
@@ -30,19 +30,20 @@ class T1075(AttackTechnique):
 
     @staticmethod
     def get_report_data():
-        data = {'title': T1075.technique_title()}
-
-        if not T1075.is_enabled_in_config():
-            status = ScanStatus.DISABLED.value
-        else:
+        @T1075.is_status_disabled
+        def get_technique_status_and_data():
             successful_logins = list(mongo.db.telemetry.aggregate(T1075.query))
-            data.update({'successful_logins': successful_logins})
             if successful_logins:
                 status = ScanStatus.USED.value
             elif mongo.db.telemetry.count_documents(T1075.login_attempt_query):
                 status = ScanStatus.SCANNED.value
             else:
                 status = ScanStatus.UNSCANNED.value
+            return (status, successful_logins)
+
+        status, successful_logins = get_technique_status_and_data()
+        data = {'title': T1075.technique_title()}
+        data.update({'successful_logins': successful_logins})
 
         data.update(T1075.get_message_and_status(status))
         data.update(T1075.get_mitigation_by_status(status))
diff --git a/monkey/monkey_island/cc/services/attack/technique_reports/T1082.py b/monkey/monkey_island/cc/services/attack/technique_reports/T1082.py
index 3b75dc10e..1a9ff94f8 100644
--- a/monkey/monkey_island/cc/services/attack/technique_reports/T1082.py
+++ b/monkey/monkey_island/cc/services/attack/technique_reports/T1082.py
@@ -38,17 +38,18 @@ class T1082(AttackTechnique):
 
     @staticmethod
     def get_report_data():
-        data = {'title': T1082.technique_title()}
-
-        if not T1082.is_enabled_in_config():
-            status = ScanStatus.DISABLED.value
-        else:
+        @T1082.is_status_disabled
+        def get_technique_status_and_data():
             system_info = list(mongo.db.telemetry.aggregate(T1082.query))
-            data.update({'system_info': system_info})
             if system_info:
                 status = ScanStatus.USED.value
             else:
                 status = ScanStatus.UNSCANNED.value
+            return (status, system_info)
+
+        status, system_info = get_technique_status_and_data()
+        data = {'title': T1082.technique_title()}
+        data.update({'system_info': system_info})
 
         data.update(T1082.get_mitigation_by_status(status))
         data.update(T1082.get_message_and_status(status))
diff --git a/monkey/monkey_island/cc/services/attack/technique_reports/T1086.py b/monkey/monkey_island/cc/services/attack/technique_reports/T1086.py
index 8ad104cf9..d6237a3f7 100644
--- a/monkey/monkey_island/cc/services/attack/technique_reports/T1086.py
+++ b/monkey/monkey_island/cc/services/attack/technique_reports/T1086.py
@@ -25,15 +25,17 @@ class T1086(AttackTechnique):
 
     @staticmethod
     def get_report_data():
-        if not T1086.is_enabled_in_config():
-            status = ScanStatus.DISABLED.value
-        else:
+        @T1086.is_status_disabled
+        def get_technique_status_and_data():
             cmd_data = list(mongo.db.telemetry.aggregate(T1086.query))
-            data = {'title': T1086.technique_title(), 'cmds': cmd_data}
             if cmd_data:
                 status = ScanStatus.USED.value
             else:
                 status = ScanStatus.UNSCANNED.value
+            return (status, cmd_data)
+
+        status, cmd_data = get_technique_status_and_data()
+        data = {'title': T1086.technique_title(), 'cmds': cmd_data}
 
         data.update(T1086.get_mitigation_by_status(status))
         data.update(T1086.get_message_and_status(status))
diff --git a/monkey/monkey_island/cc/services/attack/technique_reports/T1090.py b/monkey/monkey_island/cc/services/attack/technique_reports/T1090.py
index f2490e72e..f68ab1166 100644
--- a/monkey/monkey_island/cc/services/attack/technique_reports/T1090.py
+++ b/monkey/monkey_island/cc/services/attack/technique_reports/T1090.py
@@ -13,14 +13,14 @@ class T1090(AttackTechnique):
 
     @staticmethod
     def get_report_data():
-        monkeys = []
-
-        if not T1090.is_enabled_in_config():
-            status = ScanStatus.DISABLED.value
-        else:
+        @T1090.is_status_disabled
+        def get_technique_status_and_data():
             monkeys = Monkey.get_tunneled_monkeys()
             monkeys = [monkey.get_network_info() for monkey in monkeys]
             status = ScanStatus.USED.value if monkeys else ScanStatus.UNSCANNED.value
+            return (status, monkeys)
+
+        status, monkeys = get_technique_status_and_data()
 
         data = T1090.get_base_data_by_status(status)
         data.update({'proxies': monkeys})
diff --git a/monkey/monkey_island/cc/services/attack/technique_reports/T1110.py b/monkey/monkey_island/cc/services/attack/technique_reports/T1110.py
index 39eab28e6..c2d6fc8d5 100644
--- a/monkey/monkey_island/cc/services/attack/technique_reports/T1110.py
+++ b/monkey/monkey_island/cc/services/attack/technique_reports/T1110.py
@@ -26,11 +26,8 @@ class T1110(AttackTechnique):
 
     @staticmethod
     def get_report_data():
-        attempts = []
-
-        if not T1110.is_enabled_in_config():
-            status = ScanStatus.DISABLED.value
-        else:
+        @T1110.is_status_disabled
+        def get_technique_status_and_data():
             attempts = list(mongo.db.telemetry.aggregate(T1110.query))
             succeeded = False
 
@@ -46,6 +43,9 @@ class T1110(AttackTechnique):
                 status = ScanStatus.SCANNED.value
             else:
                 status = ScanStatus.UNSCANNED.value
+            return (status, attempts)
+
+        status, attempts = get_technique_status_and_data()
 
         data = T1110.get_base_data_by_status(status)
         # Remove data with no successful brute force attempts
diff --git a/monkey/monkey_island/cc/services/attack/technique_reports/T1145.py b/monkey/monkey_island/cc/services/attack/technique_reports/T1145.py
index 1089e1027..5d96d863e 100644
--- a/monkey/monkey_island/cc/services/attack/technique_reports/T1145.py
+++ b/monkey/monkey_island/cc/services/attack/technique_reports/T1145.py
@@ -20,16 +20,16 @@ class T1145(AttackTechnique):
 
     @staticmethod
     def get_report_data():
-        ssh_info = []
-
-        if not T1145.is_enabled_in_config():
-            status = ScanStatus.DISABLED.value
-        else:
+        @T1145.is_status_disabled
+        def get_technique_status_and_data():
             ssh_info = list(mongo.db.telemetry.aggregate(T1145.query))
             if ssh_info:
                 status = ScanStatus.USED.value
             else:
                 status = ScanStatus.UNSCANNED.value
+            return (status, ssh_info)
+
+        status, ssh_info = get_technique_status_and_data()
 
         data = T1145.get_base_data_by_status(status)
         data.update({'ssh_info': ssh_info})
diff --git a/monkey/monkey_island/cc/services/attack/technique_reports/T1188.py b/monkey/monkey_island/cc/services/attack/technique_reports/T1188.py
index 269fa4148..2dbf87638 100644
--- a/monkey/monkey_island/cc/services/attack/technique_reports/T1188.py
+++ b/monkey/monkey_island/cc/services/attack/technique_reports/T1188.py
@@ -13,11 +13,8 @@ class T1188(AttackTechnique):
 
     @staticmethod
     def get_report_data():
-        hops = []
-
-        if not T1188.is_enabled_in_config():
-            status = ScanStatus.DISABLED.value
-        else:
+        @T1188.is_status_disabled
+        def get_technique_status_and_data():
             monkeys = Monkey.get_tunneled_monkeys()
             hops = []
             for monkey in monkeys:
@@ -31,6 +28,9 @@ class T1188(AttackTechnique):
                                  'to': proxy.get_network_info(),
                                  'count': proxy_count})
             status = ScanStatus.USED.value if hops else ScanStatus.UNSCANNED.value
+            return (status, hops)
+
+        status, hops = get_technique_status_and_data()
 
         data = T1188.get_base_data_by_status(status)
         data.update({'hops': hops})
diff --git a/monkey/monkey_island/cc/services/attack/technique_reports/T1210.py b/monkey/monkey_island/cc/services/attack/technique_reports/T1210.py
index 2df22c8ef..baefcba8e 100644
--- a/monkey/monkey_island/cc/services/attack/technique_reports/T1210.py
+++ b/monkey/monkey_island/cc/services/attack/technique_reports/T1210.py
@@ -13,13 +13,8 @@ class T1210(AttackTechnique):
 
     @staticmethod
     def get_report_data():
-        scanned_services = []
-        exploited_services = []
-        data = {'title': T1210.technique_title()}
-
-        if not T1210.is_enabled_in_config():
-            status = ScanStatus.DISABLED.value
-        else:
+        @T1210.is_status_disabled
+        def get_technique_status_and_data():
             scanned_services = T1210.get_scanned_services()
             exploited_services = T1210.get_exploited_services()
             if exploited_services:
@@ -28,6 +23,15 @@ class T1210(AttackTechnique):
                 status = ScanStatus.SCANNED.value
             else:
                 status = ScanStatus.UNSCANNED.value
+            return (status, scanned_services, exploited_services)
+
+        status_and_data = get_technique_status_and_data()
+        status = status_and_data[0]
+        if status == ScanStatus.DISABLED.value:
+            scanned_services, exploited_services = [], []
+        else:
+            scanned_services, exploited_services = status_and_data[1], status_and_data[2]
+        data = {'title': T1210.technique_title()}
 
         data.update(T1210.get_message_and_status(status))
         data.update(T1210.get_mitigation_by_status(status))
diff --git a/monkey/monkey_island/cc/services/attack/technique_reports/__init__.py b/monkey/monkey_island/cc/services/attack/technique_reports/__init__.py
index c380269f5..61c1f89bd 100644
--- a/monkey/monkey_island/cc/services/attack/technique_reports/__init__.py
+++ b/monkey/monkey_island/cc/services/attack/technique_reports/__init__.py
@@ -63,7 +63,7 @@ class AttackTechnique(object, metaclass=abc.ABCMeta):
         Gets the status of a certain attack technique.
         :return: ScanStatus numeric value
         """
-        if not cls.is_enabled_in_config():
+        if not cls._is_enabled_in_config():
             return ScanStatus.DISABLED.value
         elif mongo.db.telemetry.find_one({'telem_category': 'attack',
                                           'data.status': ScanStatus.USED.value,
@@ -139,5 +139,11 @@ class AttackTechnique(object, metaclass=abc.ABCMeta):
             return {}
 
     @classmethod
-    def is_enabled_in_config(cls) -> bool:
+    def is_status_disabled(cls, get_technique_status_and_data) -> bool:
+        def check_if_disabled_in_config():
+            return (ScanStatus.DISABLED.value, []) if not cls._is_enabled_in_config() else get_technique_status_and_data()
+        return check_if_disabled_in_config
+
+    @classmethod
+    def _is_enabled_in_config(cls) -> bool:
         return AttackConfig.get_technique_values()[cls.tech_id]
diff --git a/monkey/monkey_island/cc/services/attack/technique_reports/pba_technique.py b/monkey/monkey_island/cc/services/attack/technique_reports/pba_technique.py
index 06c10a627..72188eb4e 100644
--- a/monkey/monkey_island/cc/services/attack/technique_reports/pba_technique.py
+++ b/monkey/monkey_island/cc/services/attack/technique_reports/pba_technique.py
@@ -38,12 +38,8 @@ class PostBreachTechnique(AttackTechnique, metaclass=abc.ABCMeta):
         """
         :return: Technique's report data aggregated from the database
         """
-        data = {'title': cls.technique_title(), 'info': []}
-        info = []
-
-        if not cls.is_enabled_in_config():
-            status = ScanStatus.DISABLED.value
-        else:
+        @cls.is_status_disabled
+        def get_technique_status_and_data():
             info = list(mongo.db.telemetry.aggregate(cls.get_pba_query(cls.pba_names)))
             status = ScanStatus.UNSCANNED.value
             if info:
@@ -52,6 +48,10 @@ class PostBreachTechnique(AttackTechnique, metaclass=abc.ABCMeta):
                     'data.result.1': True
                 })
                 status = ScanStatus.USED.value if successful_PBAs else ScanStatus.SCANNED.value
+            return (status, info)
+
+        data = {'title': cls.technique_title()}
+        status, info = get_technique_status_and_data()
 
         data.update(cls.get_base_data_by_status(status))
         data.update({'info': info})

From b0dde1eb04bc18287daba8bd501205f1e14d0260 Mon Sep 17 00:00:00 2001
From: Shreya <shreya.malviya@gmail.com>
Date: Tue, 28 Jul 2020 21:07:11 +0530
Subject: [PATCH 39/40] Change font color for disabled technique in report
 matrix

---
 .../cc/ui/src/styles/pages/report/ReportAttackMatrix.scss       | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/monkey/monkey_island/cc/ui/src/styles/pages/report/ReportAttackMatrix.scss b/monkey/monkey_island/cc/ui/src/styles/pages/report/ReportAttackMatrix.scss
index 30c4a70e4..7cfa62157 100644
--- a/monkey/monkey_island/cc/ui/src/styles/pages/report/ReportAttackMatrix.scss
+++ b/monkey/monkey_island/cc/ui/src/styles/pages/report/ReportAttackMatrix.scss
@@ -22,7 +22,7 @@ $black: #3a3a3a;
 
 .attack-matrix .status-3 {
   background-color: $disabled !important;
-  color: #929090;
+  color: $black;
 }
 
 .attack-matrix div.rt-td:hover {

From a30ce663c0a659f7ebd7a31ce4fc754694c7debd Mon Sep 17 00:00:00 2001
From: Shreya <shreya.malviya@gmail.com>
Date: Tue, 28 Jul 2020 21:07:56 +0530
Subject: [PATCH 40/40] Delete test file for AttackTechnique

---
 .../test_attack_technique.py                  | 98 -------------------
 1 file changed, 98 deletions(-)
 delete mode 100644 monkey/monkey_island/cc/services/attack/technique_reports/test_attack_technique.py

diff --git a/monkey/monkey_island/cc/services/attack/technique_reports/test_attack_technique.py b/monkey/monkey_island/cc/services/attack/technique_reports/test_attack_technique.py
deleted file mode 100644
index d5b61c760..000000000
--- a/monkey/monkey_island/cc/services/attack/technique_reports/test_attack_technique.py
+++ /dev/null
@@ -1,98 +0,0 @@
-import copy
-from unittest import TestCase
-from unittest.mock import patch
-
-from common.utils.attack_utils import ScanStatus
-from monkey_island.cc.services.attack.attack_config import AttackConfig
-
-from .pba_technique import PostBreachTechnique
-
-
-class T9999(PostBreachTechnique):
-    tech_id = "T9999"
-    unscanned_msg = "Unscanned"
-    scanned_msg = "Scanned"
-    used_msg = "Used"
-    pba_names = ["PBA Name"]
-
-
-config =\
-    {
-        'category': {
-            'link': '',
-            'properties': {
-                'T9999': {
-                    'description': '',
-                    'link': '',
-                    'necessary': False,
-                    'title': '',
-                    'type': 'bool',
-                    'value': None  # denotes whether technique is enabled/disabled in config (set below in param_list)
-                }
-            }
-        }
-    }
-
-
-def set_config(value: bool):
-    config['category']['properties']['T9999']['value'] = value
-    return config
-
-
-param_list = [
-    # unscanned
-    (
-        {  # telemetry data
-            'info': [],
-            'message': 'Unscanned',
-            'status': ScanStatus.UNSCANNED.value,
-            'title': 'Unscanned technique'
-        },
-        copy.deepcopy(set_config(True)),  # configuration
-        ScanStatus.UNSCANNED.value  # expected status
-    ),
-
-    # scanned
-    (
-        {  # telemetry data
-            'info': [],
-            'message': 'Scanned',
-            'status': ScanStatus.SCANNED.value,
-            'title': 'Scanned technique'
-        },
-        copy.deepcopy(set_config(True)),  # configuration
-        ScanStatus.SCANNED.value  # expected status
-    ),
-
-    # used
-    (
-        {  # telemetry data
-            'info': [],
-            'message': 'Used',
-            'status': ScanStatus.USED.value,
-            'title': 'Used technique'
-        },
-        copy.deepcopy(set_config(True)),  # configuration
-        ScanStatus.USED.value  # expected status
-    ),
-
-    # disabled
-    (
-        {  # telemetry data
-            'info': [],
-            'message': 'Disabled',
-            'status': ScanStatus.UNSCANNED.value,
-            'title': 'Disabled technique'
-        },
-        copy.deepcopy(set_config(False)),  # configuration
-        ScanStatus.DISABLED.value  # expected status
-    )
-]
-
-
-class TestAttackTechnique(TestCase):
-    def test__check_status(self):
-        for telem_data, config, expected_status in param_list:
-            with self.subTest(msg=f"Checking if correct status is returned (status: {telem_data['message']})"):
-                with patch.object(AttackConfig, 'get_config', return_value=config):
-                    self.assertEqual(T9999._check_status(telem_data['status']), expected_status)