p34709852
/
monkey
forked from p15670423/monkey
1
0
Fork 1
Code Issues Pull Requests Projects Releases Wiki Activity
7,283 Commits 30 Branches 0 Tags 47 MiB
Commit Graph

7283 Commits

Author SHA1 Message Date
Ilija Lazoroski b1b0840aed Agent: Rename SSH credentials collector to match class name 2022-02-16 17:28:11 +01:00
Ilija Lazoroski 3d64d0d2e4 Island: Refactor T1145 report according to the attack telemetry 2022-02-16 15:44:35 +01:00
Ilija Lazoroski 6b64b655ce Agent: Add T1145 attack telemetry 2022-02-16 15:44:35 +01:00
Ilija Lazoroski a03a5145a7 Agent: Remove known_hosts from SSH Credential Collector 
It is not used anywhere.
 2022-02-16 15:44:35 +01:00
Ilija Lazoroski e9e5e95f49 Agent, UT: Separate ssh_handler from SSH Credential Collector 
* Add different UTs based on what ssh_handler returns
* Fix logic in SSH Credential Collector
 2022-02-16 15:44:35 +01:00
Ilija Lazoroski 5aa5e33356 Agent, UT: Refactor SSH info collector to credential collector 2022-02-16 15:44:35 +01:00
Shreya Malviya 7787984f4a BB: Remove ProcessListCollector from BB config templates 2022-02-16 17:31:40 +05:30
Shreya Malviya 3017e6b250 UT: Remove references to process list collection system info collector in test data 2022-02-16 17:25:43 +05:30
Shreya Malviya 32cad45676 Island: Refactor post breach telemetry processing functions 2022-02-16 17:09:13 +05:30
Shreya Malviya 44a7b7e148 Island: Fix TODO comment in monkey_island/cc/services/telemetry/processing/post_breach.py 2022-02-16 17:09:13 +05:30
Shreya Malviya 123f0aab16 Changelog: Add entry for process list collection PBA 2022-02-16 17:09:13 +05:30
Shreya Malviya e674f9e0c0 Island: Move antivirus check for ZT report from system info processing to PBA processing 2022-02-16 17:09:10 +05:30
Shreya Malviya 9d3931c380 Island: Fix T1082's mongo query to get the right data 2022-02-16 17:06:17 +05:30
Shreya Malviya ff6fd52979 UI: Modify how process list collection PBA is shown in Security report 2022-02-16 17:06:17 +05:30
Shreya Malviya afa7d4fca4 Agent: Modify process list collection PBA to return dict of processes instead of string 2022-02-16 17:06:17 +05:30
Shreya Malviya 5ab7bc520e UI: Modify variable names in T1082.js as per changes to backend 2022-02-16 17:06:17 +05:30
Shreya Malviya 547d4fce54 Island: Modify T1082's reporting to get data from process collection PBA too 2022-02-16 17:06:17 +05:30
Shreya Malviya 417f40d62d Agent: Add TODOs in automated master and process collection list PBA 2022-02-16 17:06:17 +05:30
Shreya Malviya 7cee2e49a2 Agent: Improve exception catching logic in process list collection PBA 2022-02-16 17:06:17 +05:30
Shreya Malviya fcfa01223d Project: Remove ProcessListCollector from Vulture allowlist 2022-02-16 17:06:17 +05:30
Shreya Malviya 6ab62c6f56 Docs: Change adding system info collectors' documentation to refer to 
existing files
 2022-02-16 17:06:17 +05:30
Shreya Malviya a8059f021a Island: Change config schema for process list collection 2022-02-16 17:06:10 +05:30
Shreya Malviya 4839f099a4 Agent: Add process list collection PBA 
Instead of a system info collector, it is now a PBA.
 2022-02-16 17:02:06 +05:30
Shreya Malviya 5d01f12d45 Common: Add PBA const and remove system info collector const for process list collection 2022-02-16 17:02:01 +05:30
Mike Salvatore 976c46cf86
Merge pull request #1715 from guardicore/1695-credential-collectors 
Agent: define credential collector, credentials interfaces
 2022-02-15 14:34:47 -05:00
Mike Salvatore a9bb2dee70 Agent: Renumber the CredentialType Enum 2022-02-15 14:26:15 -05:00
Mike Salvatore 879abf3df0 Agent: Export MimikatzCredentialCollector from credential_collectors 2022-02-15 14:21:07 -05:00
Mike Salvatore 0583cab8e0 Agent: Rename mimikatz_cred_collector.py to match the class name 2022-02-15 14:17:28 -05:00
Mike Salvatore 569159b11a Agent: Move the definition of ICredentialCollector to i_puppet 
Low-level components plug into high-level components. i_puppet defines
all of the interfaces that puppets can use, while the concrete
implementations of these things rely on the definitions in i_puppet.
 2022-02-15 14:07:59 -05:00
Mike Salvatore c39fb6746d Agent: Rename ICredentialComponent.type -> credential_type 
"type" is built-in function in Python. To avoid confusion or a potential
name collision, this commit renames the ICredentialComponent.type field
to ICredentialComponent.credential_type
 2022-02-15 13:47:01 -05:00
Mike Salvatore 236b545816 UT: Extract function collect_credentials() to reduce code duplication 2022-02-15 13:30:13 -05:00
Mike Salvatore 86f2c7b08c UT: Parametrize test_mimikatz_collector.test_empty_results() 2022-02-15 13:28:38 -05:00
Mike Salvatore ebd5642b52 Agent: Refactor credentials and credential_components as dataclasses 
Using frozen dataclasses for Credentials and ICredentialComponents
automatically creates a useful __eq__() function that allows us to
easily compare credentials-related objects.
 2022-02-15 12:27:56 -05:00
vakarisz 811434ff22 Agent: improved type hints in mimikatz_cred_collector.py 2022-02-15 18:41:19 +02:00
vakarisz ac376a0014 Agent: change the interface of Credentials 
Refactor from dataclass to object with tuples. This enforces read only identities and secrets so users don't modify them
 2022-02-15 18:39:17 +02:00
vakarisz 8868fb9b0c Agent: change ICredentialComponent interface 
Interface changed from dataclass (dataclasses are not inheritable) to simple class with type abstract property
 2022-02-15 18:35:32 +02:00
vakarisz 26806392ec Agent: split up nt and lm hash credential types 2022-02-15 18:33:04 +02:00
vakarisz d392de4a02 Agent: remove ssh_keypair, as it's not used anywhere 2022-02-15 18:32:00 +02:00
vakarisz ae9fed3c2b Agent: fixup typehints in ICredentialCollector 2022-02-15 16:16:43 +02:00
vakarisz 01612c402a Agent: add options to ICredentialCollector interface 2022-02-15 15:25:42 +02:00
vakarisz 0fae933477 Agent: refactor content dict out of credential component 
Content dict serves no purpose, because dataclasses can be serialized without explicit conversion to dict
 2022-02-15 14:46:21 +02:00
vakarisz b7003bc231 Agent: split up nt and lm hashes into separate credential components 2022-02-15 14:19:53 +02:00
vakarisz 9037dfdf99 Agent: rename CredentialTypes enum to CredentialType 2022-02-15 12:42:36 +02:00
vakarisz 02cdebb88b Agent: fix ICredentialCollector return type-hint 2022-02-15 12:41:19 +02:00
vakarisz f5740b2a6e Agent: add mimikatz collector unit tests 2022-02-15 10:09:53 +01:00
vakarisz a6c2762823 Agent: change mimikatz collector to return a list of credentials 2022-02-15 10:09:53 +01:00
vakarisz 2f1b57a526 Agent: fix pypykatz import in mimikatz_cred_collector.py 2022-02-15 10:09:53 +01:00
vakarisz 2ba793e0cf Agent: move mimikatz collector to credential collectors 2022-02-15 10:09:53 +01:00
VakarisZ 144afc0fd3
Merge pull request #1712 from guardicore/1696-refactor-aws-collector 
Agent: Refactor AWS collector
 2022-02-14 17:12:28 +02:00
Ilija Lazoroski ae13953f52 Agent: Run AWS Environment check in a thread 
* Use Telemetry Messenger to send AWS telemetry
* Send only instance_id to AWS Instance Telemetry
* Rename AwsInstanceTelemetry to AWSInstanceTelemetry
 2022-02-14 16:00:38 +01:00