diff --git a/.swm/JFXftJml8DpmuCPBA9rL.swm b/.swm/JFXftJml8DpmuCPBA9rL.swm deleted file mode 100644 index b3f3bd080..000000000 --- a/.swm/JFXftJml8DpmuCPBA9rL.swm +++ /dev/null @@ -1,52 +0,0 @@ -{ - "id": "JFXftJml8DpmuCPBA9rL", - "name": "Add details about your new PBA", - "task": { - "dod": "You should add your new PBA's details to the configuration.", - "tests": [], - "hints": [ - "Have a look at the details of the other techniques." - ] - }, - "content": [ - { - "type": "text", - "text": "In order to make sure that the new `ScheduleJobs` PBA is shown in the configuration on the Monkey Island, you need to add its details to the configuration file(s).

\n\nSince this particular PBA is related to the MITRE techniques [T1168](https://attack.mitre.org/techniques/T1168) and [T1053](https://attack.mitre.org/techniques/T1053), make sure to link the PBA with these techniques in the configuration as well.

\n\nEach part of the configuration has an important role \n- *enum* — contains the relevant PBA's class name(s)\n- *title* — holds the name of the PBA which is displayed in the configuration on the Monkey Island\n- *info* — consists of an elaboration on the PBA's working which is displayed in the configuration on the Monkey Island\n- *attack_techniques* — has the IDs of the MITRE techniques associated with the PBA\n\n## Manual test \nOnce you think you're done...\n- Run the Monkey Island\n- You should be able to see your new PBA under the \"Monkey\" tab in the configuration, along with its information when you click on it\n\n" - }, - { - "type": "snippet", - "lines": [ - " \"Removes the file afterwards.\",", - " \"attack_techniques\": [\"T1166\"],", - " },", - "* {", - "+ # Swimmer: ADD DETAILS HERE!", - "* \"type\": \"string\",", - "* \"enum\": [\"ScheduleJobs\"],", - "* \"title\": \"Job Scheduling\",", - "* \"safe\": True,", - "* \"info\": \"Attempts to create a scheduled job on the system and remove it.\",", - "* \"attack_techniques\": [\"T1168\", \"T1053\"],", - "* },", - " {", - " \"type\": \"string\",", - " \"enum\": [\"Timestomping\"]," - ], - "firstLineNumber": 52, - "path": "monkey/monkey_island/cc/services/config_schema/definitions/post_breach_actions.py", - "comments": [] - }, - { - "type": "text", - "text": "- The PBA details in this file are reflected on the Monkey Island in the PBA configuration.\n- PBAs are also linked to the relevant MITRE techniques in this file, whose results can then be seen in the MITRE ATT&CK report on the Monkey Island." - } - ], - "symbols": {}, - "file_version": "2.0.3", - "meta": { - "app_version": "0.5.7-0", - "file_blobs": { - "monkey/monkey_island/cc/services/config_schema/definitions/post_breach_actions.py": "7d62ac36e875ca3c249d808250cb3268e4d3d68d" - } - } -} diff --git a/.swm/afMu3y3ny5lnrYFWl3EI.swm b/.swm/afMu3y3ny5lnrYFWl3EI.swm deleted file mode 100644 index 1da171e62..000000000 --- a/.swm/afMu3y3ny5lnrYFWl3EI.swm +++ /dev/null @@ -1,90 +0,0 @@ -{ - "id": "afMu3y3ny5lnrYFWl3EI", - "name": "Add a new Post Breach Action (PBA)", - "task": { - "dod": "You should add a new PBA to the Monkey which discovers all user accounts on the machine.", - "tests": [], - "hints": [ - "See `ScheduleJobs` PBA for an example of a PBA which only uses shell commands.", - "Make sure to add the PBA to the configuration as well.", - "MITRE ATT&CK technique T1087 articulates that adversaries may attempt to get a listing of accounts on a system or within an environment which can help them determine which accounts can aid in follow-on behavior. Therefore, the AccountDiscovery PBA is relevant to it which will enable the ATT&CK technique and show it in ATT&CK report." - ] - }, - "content": [ - { - "type": "text", - "text": "Read our [documentation](https://www.guardicore.com/infectionmonkey/docs/development/adding-post-breach-actions/) about adding a new PBA.\n\nAfter that we want you to add the AccountDiscovery PBA. The commands that add users for Windows and Linux can be retrieved from \\`get\\_commands\\_to\\_discover\\_accounts\\` — make sure you see how to use this function correctly.\n\nNote that the PBA should impact the T1087 MITRE technique as well.\n\n**Manual test to confirm**\n--------------------------\n\n1. Run the Monkey Island.\n \n2. Make sure your new PBA is enabled by default in the config. For this test, disable network scanning, exploiting, and all other PBAs.\n \n3. Run the Monkey Agent.\n \n4. See the PBA in the security report and in the MITRE report under the relevant technique." - }, - { - "type": "snippet", - "lines": [ - " POST_BREACH_JOB_SCHEDULING = \"Schedule jobs\"", - " POST_BREACH_TIMESTOMPING = \"Modify files' timestamps\"", - " POST_BREACH_SIGNED_SCRIPT_PROXY_EXEC = \"Signed script proxy execution\"", - "*POST_BREACH_ACCOUNT_DISCOVERY = \"Account discovery\"", - "+# SWIMMER: Put the new const here!", - " POST_BREACH_CLEAR_CMD_HISTORY = \"Clear command history\"" - ], - "firstLineNumber": 7, - "path": "monkey/common/common_consts/post_breach_consts.py", - "comments": [] - }, - { - "type": "snippet", - "lines": [ - " ", - " class AccountDiscovery(PBA):", - " def __init__(self, telemetry_messenger: ITelemetryMessenger):", - "* linux_cmds, windows_cmds = get_commands_to_discover_accounts()", - "+ # SWIMMER: Implement here!", - "* super().__init__(", - "+ pass", - "* telemetry_messenger,", - "* POST_BREACH_ACCOUNT_DISCOVERY,", - "* linux_cmd=\" \".join(linux_cmds),", - "* windows_cmd=windows_cmds,", - "* )" - ], - "firstLineNumber": 8, - "path": "monkey/infection_monkey/post_breach/actions/discover_accounts.py", - "comments": [] - }, - { - "type": "snippet", - "lines": [ - " \"with the help of a pre-existing signed script.\",", - " \"attack_techniques\": [\"T1216\"],", - " },", - "* {", - "+ # SWIMMER: Add details here!", - "* \"type\": \"string\",", - "* \"enum\": [\"AccountDiscovery\"],", - "* \"title\": \"Account Discovery\",", - "* \"safe\": True,", - "* \"info\": \"Attempts to get a listing of user accounts on the system.\",", - "* \"attack_techniques\": [\"T1087\"],", - "* },", - " {", - " \"type\": \"string\",", - " \"enum\": [\"ClearCommandHistory\"]," - ], - "firstLineNumber": 78, - "path": "monkey/monkey_island/cc/services/config_schema/definitions/post_breach_actions.py", - "comments": [] - }, - { - "type": "text", - "text": "Many PBAs use shell commands or scripts — see `Timestomping` and `AccountDiscovery`.\n\nOn the other hand, some are less straightforward. You can override functions and implement new classes depending on what is required, to implement complicated PBAs — see `SignedScriptProxyExecution` and `ModifyShellStartupFiles`. \n \n\nThis PBA, along with the others, will run on a system after it has been breached. The purpose of this code is to test whether target systems allow attackers to gather details about all the user accounts that are present on a system or in an environment." - } - ], - "symbols": {}, - "file_version": "2.0.3", - "meta": { - "app_version": "0.6.6-2", - "file_blobs": { - "monkey/common/common_consts/post_breach_consts.py": "19b6c4f19b7223f115976a0050ca04ab97e52f8e", - "monkey/infection_monkey/post_breach/actions/discover_accounts.py": "a153cf5b6185c9771414fc5ae49d441efc7294b6", - "monkey/monkey_island/cc/services/config_schema/definitions/post_breach_actions.py": "d6831ed63b17f327d719a05840d7e51202fa5ccb" - } - } -}