Added mitigations to each attack technique report

.gitmodules

@@ -0,0 +1,3 @@
+[submodule "monkey/monkey_island/cc/services/attack/attack_data"]
+	path = monkey/monkey_island/cc/services/attack/attack_data
+	url = https://github.com/mitre/cti

deployment_scripts/deploy_linux.sh

@@ -85,7 +85,7 @@ fi
 log_message "Cloning files from git"
 branch=${2:-"develop"}
 if [[ ! -d "$monkey_home/monkey" ]]; then # If not already cloned
-  git clone --single-branch -b "$branch" "${MONKEY_GIT_URL}" "${monkey_home}" 2>&1 || handle_error
+  git clone --single-branch --recurse-submodules -b "$branch" "${MONKEY_GIT_URL}" "${monkey_home}" 2>&1 || handle_error
   chmod 774 -R "${monkey_home}"
 fi
 

deployment_scripts/deploy_windows.ps1

@@ -48,7 +48,7 @@ function Deploy-Windows([String] $monkey_home = (Get-Item -Path ".\").FullName,
     }
 
     # Download the monkey
-    $command = "git clone --single-branch -b $branch $MONKEY_GIT_URL $monkey_home 2>&1"
+    $command = "git clone --single-branch --recurse-submodules -b $branch $MONKEY_GIT_URL $monkey_home 2>&1"
     Write-Output $command
     $output = cmd.exe /c $command
     $binDir = (Join-Path -Path $monkey_home -ChildPath $MONKEY_ISLAND_DIR | Join-Path -ChildPath "\bin")

monkey/monkey_island/cc/services/attack/attack_data

@@ -0,0 +1 @@
+Subproject commit c139e37bdc51acbc7d0488a5be48553caffdbbd7

monkey/monkey_island/cc/services/attack/technique_reports/T1003.py

@@ -24,6 +24,7 @@ class T1003(AttackTechnique):
         else:
             status = ScanStatus.UNSCANNED.value
         data.update(T1003.get_message_and_status(status))
+        data.update(T1003.get_mitigations_by_status(status))
         data['stolen_creds'] = ReportService.get_stolen_creds()
         data['stolen_creds'].extend(ReportService.get_ssh_keys())
         return data

monkey/monkey_island/cc/services/attack/technique_reports/T1059.py

@@ -30,4 +30,5 @@ class T1059(AttackTechnique):
         else:
             status = ScanStatus.UNSCANNED.value
         data.update(T1059.get_message_and_status(status))
+        data.update(T1059.get_mitigations_by_status(status))
         return data

monkey/monkey_island/cc/services/attack/technique_reports/T1075.py

@@ -40,4 +40,5 @@ class T1075(AttackTechnique):
         else:
             status = ScanStatus.UNSCANNED.value
         data.update(T1075.get_message_and_status(status))
+        data.update(T1075.get_mitigations_by_status(status))
         return data

monkey/monkey_island/cc/services/attack/technique_reports/T1082.py

@@ -44,5 +44,6 @@ class T1082(AttackTechnique):
             status = ScanStatus.USED.value
         else:
             status = ScanStatus.UNSCANNED.value
+        data.update(T1082.get_mitigations_by_status(status))
         data.update(T1082.get_message_and_status(status))
         return data

monkey/monkey_island/cc/services/attack/technique_reports/T1086.py

@@ -31,5 +31,7 @@ class T1086(AttackTechnique):
             status = ScanStatus.USED.value
         else:
             status = ScanStatus.UNSCANNED.value
+
+        data.update(T1086.get_mitigations_by_status(status))
         data.update(T1086.get_message_and_status(status))
         return data

monkey/monkey_island/cc/services/attack/technique_reports/T1210.py

@@ -23,6 +23,7 @@ class T1210(AttackTechnique):
         else:
             status = ScanStatus.UNSCANNED.value
         data.update(T1210.get_message_and_status(status))
+        data.update(T1210.get_mitigations_by_status(status))
         data.update({'scanned_services': scanned_services, 'exploited_services': exploited_services})
         return data
 

monkey/monkey_island/cc/services/attack/technique_reports/__init__.py

@@ -5,6 +5,7 @@ from monkey_island.cc.database import mongo
 from common.utils.attack_utils import ScanStatus
 from monkey_island.cc.services.attack.attack_config import AttackConfig
 from common.utils.code_utils import abstractstatic
+from monkey_island.cc.services.attack.technique_reports.attack_mitigations import AttackMitigations
 
 logger = logging.getLogger(__name__)
 
@@ -40,7 +41,7 @@ class AttackTechnique(object, metaclass=abc.ABCMeta):
     @abc.abstractmethod
     def tech_id(self):
         """
-        :return: Message that will be displayed in case of attack technique not being scanned.
+        :return: Id of attack technique. E.g. T1003
         """
         pass
 
@@ -52,15 +53,6 @@ class AttackTechnique(object, metaclass=abc.ABCMeta):
         """
         pass
 
-    @classmethod
-    def technique_mitigation(cls):
-        """
-        Gets the mitigation of a certain attack technique.
-        :return: Mitigation string
-        """
-        pass
-        # TODO Get mitigation from ATT&CK DB https://github.com/mitre/cti/blob/master/USAGE.md
-
     @classmethod
     def technique_status(cls):
         """
@@ -120,10 +112,20 @@ class AttackTechnique(object, metaclass=abc.ABCMeta):
         data.update({'status': status,
                      'title': title,
                      'message': cls.get_message_by_status(status)})
+        data.update(cls.get_mitigations_by_status(status))
         return data
 
     @classmethod
     def get_base_data_by_status(cls, status):
         data = cls.get_message_and_status(status)
         data.update({'title': cls.technique_title()})
+        data.update(cls.get_mitigations_by_status(status))
         return data
+
+    @classmethod
+    def get_mitigations_by_status(cls, status: ScanStatus) -> dict:
+        if status == ScanStatus.USED.value:
+            return AttackMitigations.get_mitigations_by_id(cls.tech_id)
+        else:
+            return {}
+

monkey/monkey_island/cc/services/attack/technique_reports/attack_mitigations.py

@@ -0,0 +1,15 @@
+from stix2 import FileSystemSource, Filter, parse
+
+
+class AttackMitigations:
+
+    @staticmethod
+    def get_mitigations_by_id(technique_id: str) -> dict:
+        file_system = FileSystemSource('monkey_island/cc/services/attack/attack_data/enterprise-attack')
+        technique_filter = [
+            Filter('type', '=', 'course-of-action'),
+            Filter('external_references.external_id', '=', str(technique_id))
+        ]
+        mitigations = parse(file_system.query(technique_filter)[0], allow_custom=True)
+        mitigations = {'mitigations': {'description': mitigations['description'], 'name': mitigations['name']}}
+        return mitigations

monkey/monkey_island/cc/ui/src/components/attack/techniques/MitigationsComponent.js

@@ -0,0 +1,55 @@
+import React from 'react';
+import ReactTable from 'react-table';
+import marked from 'marked';
+
+
+class MitigationsComponent extends React.Component {
+
+  constructor(props) {
+    super(props);
+    if (typeof this.props.mitigations !== 'undefined'){
+      let descriptions = MitigationsComponent.parseDescription(this.props.mitigations.description);
+      this.state = {name: this.props.mitigations.name, descriptions: descriptions};
+    } else {
+      this.state = {name: '', descriptions: []}
+    }
+  }
+
+  static parseDescription(description){
+    const citationRegex = /\(Citation:.*\)/gi;
+    const emptyLineRegex = /^\s*[\r\n]/gm;
+    description = description.replace(citationRegex, '');
+    description = description.replace(emptyLineRegex, '');
+    let descriptions = description.split('\n');
+    descriptions = descriptions.map(function(paragraph){ return marked(paragraph); });
+    return descriptions;
+  }
+
+  static getMitigationDescriptions(name) {
+    return ([{
+      Header: name,
+      columns: [
+        { id: 'description',
+          accessor: x => (<div dangerouslySetInnerHTML={{__html: x}} />),
+          style: {'whiteSpace': 'unset'}}
+      ]
+    }])
+  }
+
+  render() {
+    return (
+      <div>
+        <br/>
+        {this.state.descriptions.length !== 0 ?
+          <ReactTable
+            columns={MitigationsComponent.getMitigationDescriptions(this.state.name)}
+            data={this.state.descriptions}
+            showPagination={false}
+            defaultPageSize={this.state.descriptions.length}
+          /> : ''}
+      </div>
+    );
+  }
+}
+
+export default MitigationsComponent;

monkey/monkey_island/cc/ui/src/components/attack/techniques/T1003.js

@@ -2,6 +2,7 @@ import React from 'react';
 import '../../report-components/security/StolenPasswords'
 import StolenPasswordsComponent from '../../report-components/security/StolenPasswords';
 import {ScanStatus} from './Helpers'
+import MitigationsComponent from "./MitigationsComponent";
 
 
 class T1003 extends React.Component {
@@ -19,6 +20,7 @@ class T1003 extends React.Component {
           <StolenPasswordsComponent
             data={this.props.data.stolen_creds}/>
           : ''}
+        <MitigationsComponent mitigations={this.props.data.mitigations}/>
       </div>
     );
   }

monkey/monkey_island/cc/ui/src/components/attack/techniques/T1005.js

@@ -1,6 +1,7 @@
 import React from 'react';
 import ReactTable from 'react-table';
 import {renderMachineFromSystemData, ScanStatus} from './Helpers';
+import MitigationsComponent from "./MitigationsComponent";
 
 class T1005 extends React.Component {
 
@@ -36,6 +37,7 @@ class T1005 extends React.Component {
             showPagination={false}
             defaultPageSize={this.props.data.collected_data.length}
           /> : ''}
+        <MitigationsComponent mitigations={this.props.data.mitigations}/>
       </div>
     );
   }

monkey/monkey_island/cc/ui/src/components/attack/techniques/T1016.js

@@ -1,6 +1,7 @@
 import React from 'react';
 import ReactTable from 'react-table';
 import {renderMachineFromSystemData, renderUsageFields, ScanStatus} from './Helpers'
+import MitigationsComponent from "./MitigationsComponent";
 
 
 class T1016 extends React.Component {
@@ -36,6 +37,7 @@ class T1016 extends React.Component {
             showPagination={false}
             defaultPageSize={this.props.data.network_info.length}
           /> : ''}
+        <MitigationsComponent mitigations={this.props.data.mitigations}/>
       </div>
     );
   }

monkey/monkey_island/cc/ui/src/components/attack/techniques/T1018.js

@@ -1,6 +1,7 @@
 import React from 'react';
 import ReactTable from 'react-table';
 import {renderMachineFromSystemData, renderMachine, ScanStatus} from './Helpers'
+import MitigationsComponent from "./MitigationsComponent";
 
 
 class T1018 extends React.Component {
@@ -50,6 +51,7 @@ class T1018 extends React.Component {
             showPagination={false}
             defaultPageSize={this.props.data.scan_info.length}
           /> : ''}
+        <MitigationsComponent mitigations={this.props.data.mitigations}/>
       </div>
     );
   }

monkey/monkey_island/cc/ui/src/components/attack/techniques/T1021.js

@@ -1,6 +1,7 @@
 import React from 'react';
 import ReactTable from 'react-table';
 import {renderMachine, ScanStatus} from './Helpers'
+import MitigationsComponent from "./MitigationsComponent";
 
 
 class T1021 extends React.Component {
@@ -16,7 +17,13 @@ class T1021 extends React.Component {
           Header: 'Machine', id: 'machine', accessor: x => renderMachine(x.machine),
           style: {'whiteSpace': 'unset'}, width: 160
         },
-        {Header: 'Service', id: 'service', accessor: x => x.info.display_name, style: {'whiteSpace': 'unset'}, width: 100},
+        {
+          Header: 'Service',
+          id: 'service',
+          accessor: x => x.info.display_name,
+          style: {'whiteSpace': 'unset'},
+          width: 100
+        },
         {
           Header: 'Valid account used',
           id: 'credentials',
@@ -43,6 +50,7 @@ class T1021 extends React.Component {
             showPagination={false}
             defaultPageSize={this.props.data.services.length}
           /> : ''}
+        <MitigationsComponent mitigations={this.props.data.mitigations}/>
       </div>
     );
   }

monkey/monkey_island/cc/ui/src/components/attack/techniques/T1035.js

@@ -1,6 +1,7 @@
 import React from 'react';
 import ReactTable from 'react-table';
 import {getUsageColumns} from './Helpers'
+import MitigationsComponent from "./MitigationsComponent";
 
 
 class T1035 extends React.Component {
@@ -21,6 +22,7 @@ class T1035 extends React.Component {
             showPagination={false}
             defaultPageSize={this.props.data.services.length}
           /> : ''}
+        <MitigationsComponent mitigations={this.props.data.mitigations}/>
       </div>
     );
   }

monkey/monkey_island/cc/ui/src/components/attack/techniques/T1041.js

@@ -1,6 +1,7 @@
 import React from 'react';
 import ReactTable from 'react-table';
 import {ScanStatus} from './Helpers';
+import MitigationsComponent from "./MitigationsComponent";
 
 class T1041 extends React.Component {
 
@@ -30,6 +31,7 @@ class T1041 extends React.Component {
             showPagination={false}
             defaultPageSize={this.props.data.command_control_channel.length}
           /> : ''}
+        <MitigationsComponent mitigations={this.props.data.mitigations}/>
       </div>
     );
   }

monkey/monkey_island/cc/ui/src/components/attack/techniques/T1059.js

@@ -1,6 +1,7 @@
 import React from 'react';
 import ReactTable from 'react-table';
 import {renderMachine, ScanStatus} from './Helpers'
+import MitigationsComponent from "./MitigationsComponent";
 
 
 class T1059 extends React.Component {
@@ -38,6 +39,7 @@ class T1059 extends React.Component {
             showPagination={false}
             defaultPageSize={this.props.data.cmds.length}
           /> : ''}
+        <MitigationsComponent mitigations={this.props.data.mitigations}/>
       </div>
     );
   }

monkey/monkey_island/cc/ui/src/components/attack/techniques/T1064.js

@@ -1,6 +1,7 @@
 import React from 'react';
 import ReactTable from 'react-table';
 import {getUsageColumns} from './Helpers'
+import MitigationsComponent from "./MitigationsComponent";
 
 
 class T1064 extends React.Component {
@@ -21,6 +22,7 @@ class T1064 extends React.Component {
             showPagination={false}
             defaultPageSize={this.props.data.scripts.length}
           /> : ''}
+        <MitigationsComponent mitigations={this.props.data.mitigations}/>
       </div>
     );
   }

monkey/monkey_island/cc/ui/src/components/attack/techniques/T1065.js

@@ -1,4 +1,5 @@
 import React from 'react';
+import MitigationsComponent from "./MitigationsComponent";
 
 
 class T1065 extends React.Component {
@@ -7,6 +8,7 @@ class T1065 extends React.Component {
     return (
       <div>
         <div>{this.props.data.message}</div>
+        <MitigationsComponent mitigations={this.props.data.mitigations}/>
       </div>
     );
   }

monkey/monkey_island/cc/ui/src/components/attack/techniques/T1075.js

@@ -1,6 +1,7 @@
 import React from 'react';
 import ReactTable from 'react-table';
 import {renderMachine, ScanStatus} from './Helpers'
+import MitigationsComponent from "./MitigationsComponent";
 
 
 class T1075 extends React.Component {
@@ -41,6 +42,7 @@ class T1075 extends React.Component {
             showPagination={false}
             defaultPageSize={this.props.data.successful_logins.length}
           /> : ''}
+        <MitigationsComponent mitigations={this.props.data.mitigations}/>
       </div>
     );
   }

monkey/monkey_island/cc/ui/src/components/attack/techniques/T1082.js

@@ -1,6 +1,7 @@
 import React from 'react';
 import ReactTable from 'react-table';
 import {renderMachineFromSystemData, renderUsageFields, ScanStatus} from './Helpers'
+import MitigationsComponent from "./MitigationsComponent";
 
 
 class T1082 extends React.Component {
@@ -12,14 +13,18 @@ class T1082 extends React.Component {
   static getSystemInfoColumns() {
     return ([{
       columns: [
-        { Header: 'Machine',
+        {
+          Header: 'Machine',
           id: 'machine',
           accessor: x => renderMachineFromSystemData(x.machine),
-          style: {'whiteSpace': 'unset'}},
-        { Header: 'Gathered info',
+          style: {'whiteSpace': 'unset'}
+        },
+        {
+          Header: 'Gathered info',
           id: 'info',
           accessor: x => renderUsageFields(x.collections),
-          style: {'whiteSpace': 'unset'}}
+          style: {'whiteSpace': 'unset'}
+        }
       ]
     }])
   }
@@ -36,6 +41,7 @@ class T1082 extends React.Component {
             showPagination={false}
             defaultPageSize={this.props.data.system_info.length}
           /> : ''}
+        <MitigationsComponent mitigations={this.props.data.mitigations}/>
       </div>
     );
   }

monkey/monkey_island/cc/ui/src/components/attack/techniques/T1086.js

@@ -1,6 +1,7 @@
 import React from 'react';
 import ReactTable from 'react-table';
 import {renderMachine, ScanStatus} from './Helpers'
+import MitigationsComponent from "./MitigationsComponent";
 
 
 class T1086 extends React.Component {
@@ -21,7 +22,12 @@ class T1086 extends React.Component {
           width: 160
         },
         {Header: 'Approx. Time', id: 'time', accessor: x => x.data[0].info.finished, style: {'whiteSpace': 'unset'}},
-        {Header: 'Command', id: 'command', accessor: x => x.data[0].info.executed_cmds[0].cmd, style: {'whiteSpace': 'unset'}}
+        {
+          Header: 'Command',
+          id: 'command',
+          accessor: x => x.data[0].info.executed_cmds[0].cmd,
+          style: {'whiteSpace': 'unset'}
+        }
       ]
     }])
   }
@@ -38,6 +44,7 @@ class T1086 extends React.Component {
             showPagination={false}
             defaultPageSize={this.props.data.cmds.length}
           /> : ''}
+        <MitigationsComponent mitigations={this.props.data.mitigations}/>
       </div>
     );
   }

monkey/monkey_island/cc/ui/src/components/attack/techniques/T1090.js

@@ -1,6 +1,7 @@
 import React from 'react';
 import ReactTable from 'react-table';
 import {renderMachineFromSystemData, ScanStatus} from './Helpers'
+import MitigationsComponent from "./MitigationsComponent";
 
 
 class T1090 extends React.Component {
@@ -33,6 +34,7 @@ class T1090 extends React.Component {
             showPagination={false}
             defaultPageSize={this.props.data.proxies.length}
           /> : ''}
+        <MitigationsComponent mitigations={this.props.data.mitigations}/>
       </div>
     );
   }

monkey/monkey_island/cc/ui/src/components/attack/techniques/T1105.js

@@ -1,6 +1,7 @@
 import React from 'react';
 import ReactTable from 'react-table';
 import {ScanStatus} from './Helpers'
+import MitigationsComponent from "./MitigationsComponent";
 
 
 class T1105 extends React.Component {
@@ -32,6 +33,7 @@ class T1105 extends React.Component {
             showPagination={false}
             defaultPageSize={this.props.data.files.length}
           /> : ''}
+        <MitigationsComponent mitigations={this.props.data.mitigations}/>
       </div>
     );
   }

monkey/monkey_island/cc/ui/src/components/attack/techniques/T1106.js

@@ -1,6 +1,7 @@
 import React from 'react';
 import ReactTable from 'react-table';
 import {getUsageColumns} from './Helpers'
+import MitigationsComponent from "./MitigationsComponent";
 
 
 class T1106 extends React.Component {
@@ -21,6 +22,7 @@ class T1106 extends React.Component {
             showPagination={false}
             defaultPageSize={this.props.data.api_uses.length}
           /> : ''}
+        <MitigationsComponent mitigations={this.props.data.mitigations}/>
       </div>
     );
   }

monkey/monkey_island/cc/ui/src/components/attack/techniques/T1107.js

@@ -1,6 +1,7 @@
 import React from 'react';
 import ReactTable from 'react-table';
 import {renderMachineFromSystemData, ScanStatus} from './Helpers'
+import MitigationsComponent from "./MitigationsComponent";
 
 
 class T1107 extends React.Component {
@@ -46,6 +47,7 @@ class T1107 extends React.Component {
             showPagination={false}
             defaultPageSize={this.props.data.deleted_files.length}
           /> : ''}
+        <MitigationsComponent mitigations={this.props.data.mitigations}/>
       </div>
     );
   }

monkey/monkey_island/cc/ui/src/components/attack/techniques/T1110.js

@@ -1,6 +1,7 @@
 import React from 'react';
 import ReactTable from 'react-table';
 import {renderMachine, ScanStatus} from './Helpers'
+import MitigationsComponent from './MitigationsComponent'
 
 
 class T1110 extends React.Component {
@@ -46,6 +47,7 @@ class T1110 extends React.Component {
             showPagination={false}
             defaultPageSize={this.props.data.services.length}
           /> : ''}
+        <MitigationsComponent mitigations={this.props.data.mitigations}/>
       </div>
     );
   }

monkey/monkey_island/cc/ui/src/components/attack/techniques/T1129.js

@@ -1,6 +1,7 @@
 import React from 'react';
 import ReactTable from 'react-table';
 import {getUsageColumns} from './Helpers';
+import MitigationsComponent from "./MitigationsComponent";
 
 class T1129 extends React.Component {
 
@@ -20,6 +21,7 @@ class T1129 extends React.Component {
             showPagination={false}
             defaultPageSize={this.props.data.dlls.length}
           /> : ''}
+        <MitigationsComponent mitigations={this.props.data.mitigations}/>
       </div>
     );
   }

monkey/monkey_island/cc/ui/src/components/attack/techniques/T1145.js

@@ -1,6 +1,7 @@
 import React from 'react';
 import ReactTable from 'react-table';
 import {renderMachineFromSystemData, ScanStatus} from './Helpers'
+import MitigationsComponent from "./MitigationsComponent";
 
 
 class T1145 extends React.Component {
@@ -49,6 +50,7 @@ class T1145 extends React.Component {
             showPagination={false}
             defaultPageSize={this.props.data.ssh_info.length}
           /> : ''}
+        <MitigationsComponent mitigations={this.props.data.mitigations}/>
       </div>
     );
   }

monkey/monkey_island/cc/ui/src/components/attack/techniques/T1188.js

@@ -1,6 +1,7 @@
 import React from 'react';
 import ReactTable from 'react-table';
 import {renderMachineFromSystemData, ScanStatus} from './Helpers'
+import MitigationsComponent from "./MitigationsComponent";
 
 
 class T1188 extends React.Component {
@@ -47,6 +48,7 @@ class T1188 extends React.Component {
             showPagination={false}
             defaultPageSize={this.props.data.hops.length}
           /> : ''}
+        <MitigationsComponent mitigations={this.props.data.mitigations}/>
       </div>
     );
   }

monkey/monkey_island/cc/ui/src/components/attack/techniques/T1197.js

@@ -1,6 +1,7 @@
 import React from 'react';
 import ReactTable from 'react-table';
 import {renderMachine} from './Helpers'
+import MitigationsComponent from "./MitigationsComponent";
 
 
 class T1210 extends React.Component {
@@ -49,6 +50,7 @@ class T1210 extends React.Component {
         </div>
         <br/>
         {this.renderExploitedMachines()}
+        <MitigationsComponent mitigations={this.props.data.mitigations}/>
       </div>
     );
   }

monkey/monkey_island/cc/ui/src/components/attack/techniques/T1210.js

@@ -1,6 +1,7 @@
 import React from 'react';
 import ReactTable from 'react-table';
 import {renderMachine} from './Helpers'
+import MitigationsComponent from "./MitigationsComponent";
 
 
 class T1210 extends React.Component {
@@ -99,6 +100,7 @@ class T1210 extends React.Component {
           this.renderScannedServices(scanned_services) : ''}
         {this.props.data.exploited_services.length > 0 ?
           this.renderExploitedServices(this.props.data.exploited_services) : ''}
+        <MitigationsComponent mitigations={this.props.data.mitigations}/>
       </div>
     );
   }

monkey/monkey_island/cc/ui/src/components/attack/techniques/T1222.js

@@ -1,6 +1,7 @@
 import React from 'react';
 import ReactTable from 'react-table';
 import {renderMachine, ScanStatus} from './Helpers'
+import MitigationsComponent from "./MitigationsComponent";
 
 
 class T1222 extends React.Component {
@@ -31,6 +32,7 @@ class T1222 extends React.Component {
             showPagination={false}
             defaultPageSize={this.props.data.commands.length}
           /> : ''}
+        <MitigationsComponent mitigations={this.props.data.mitigations}/>
       </div>
     );
   }

monkey/monkey_island/requirements.txt

@@ -23,3 +23,4 @@ mongomock
 requests
 dpath
 ring
+stix2