Merge pull request #383 from VakarisZ/attack_system_discovery

T1018 Remote System Discovery

monkey/monkey_island/cc/services/attack/attack_report.py

@@ -3,7 +3,7 @@ import logging
 from monkey_island.cc.models import Monkey
 from monkey_island.cc.services.attack.technique_reports import T1210, T1197, T1110, T1075, T1003, T1059, T1086, T1082
 from monkey_island.cc.services.attack.technique_reports import T1145, T1105, T1065, T1035, T1129, T1106, T1107, T1188
-from monkey_island.cc.services.attack.technique_reports import T1090, T1041, T1222, T1005
+from monkey_island.cc.services.attack.technique_reports import T1090, T1041, T1222, T1005, T1018
 from monkey_island.cc.services.attack.attack_config import AttackConfig
 from monkey_island.cc.database import mongo
 
@@ -31,7 +31,8 @@ TECHNIQUES = {'T1210': T1210.T1210,
               'T1090': T1090.T1090,
               'T1041': T1041.T1041,
               'T1222': T1222.T1222,
-              'T1005': T1005.T1005}
+              'T1005': T1005.T1005,
+              'T1018': T1018.T1018}
 
 REPORT_NAME = 'new_report'
 

monkey/monkey_island/cc/services/attack/attack_schema.py

@@ -179,6 +179,14 @@ SCHEMA = {
                     "description": "An adversary may attempt to get detailed information about the "
                                    "operating system and hardware, including version, patches, hotfixes, "
                                    "service packs, and architecture."
+                },
+                "T1018": {
+                    "title": "T1018 Remote System Discovery",
+                    "type": "bool",
+                    "value": True,
+                    "necessary": True,
+                    "description": "Adversaries will likely attempt to get a listing of other systems by IP address, "
+                                   "hostname, or other logical identifier on a network for lateral movement."
                 }
             }
         },

monkey/monkey_island/cc/services/attack/technique_reports/T1018.py

@@ -0,0 +1,39 @@
+from common.utils.attack_utils import ScanStatus
+from monkey_island.cc.services.attack.technique_reports import AttackTechnique
+from monkey_island.cc.database import mongo
+
+__author__ = "VakarisZ"
+
+
+class T1018(AttackTechnique):
+
+    tech_id = "T1018"
+    unscanned_msg = "Monkey didn't find any machines on the network."
+    scanned_msg = ""
+    used_msg = "Monkey found machines on the network."
+
+    query = [{'$match': {'telem_category': 'scan'}},
+             {'$sort': {'timestamp': 1}},
+             {'$group': {'_id': {'monkey_guid': '$monkey_guid'},
+                         'machines': {'$addToSet': '$data.machine'},
+                         'started': {'$first': '$timestamp'},
+                         'finished': {'$last': '$timestamp'}}},
+             {'$lookup': {'from': 'monkey',
+                          'localField': '_id.monkey_guid',
+                          'foreignField': 'guid',
+                          'as': 'monkey_tmp'}},
+             {'$addFields': {'_id': 0, 'monkey_tmp': {'$arrayElemAt': ['$monkey_tmp', 0]}}},
+             {'$addFields': {'monkey': {'hostname': '$monkey_tmp.hostname',
+                                        'ips': '$monkey_tmp.ip_addresses'},
+                             'monkey_tmp': 0}}]
+
+    @staticmethod
+    def get_report_data():
+        scan_info = list(mongo.db.telemetry.aggregate(T1018.query))
+        if scan_info:
+            status = ScanStatus.USED.value
+        else:
+            status = ScanStatus.UNSCANNED.value
+        data = T1018.get_base_data_by_status(status)
+        data.update({'scan_info': scan_info})
+        return data

monkey/monkey_island/cc/ui/src/components/attack/techniques/T1018.js

@@ -0,0 +1,48 @@
+import React from 'react';
+import '../../../styles/Collapse.scss'
+import ReactTable from "react-table";
+import { renderMachineFromSystemData, renderMachine, ScanStatus } from "./Helpers"
+
+
+class T1018 extends React.Component {
+
+  constructor(props) {
+    super(props);
+  }
+
+  static renderMachines(machines){
+    let output = [];
+    machines.forEach(function(machine){
+      output.push(renderMachine(machine))
+    });
+    return (<div>{output}</div>);
+  }
+
+  static getScanInfoColumns() {
+    return ([{
+      columns: [
+        {Header: 'Machine', id: 'machine', accessor: x => renderMachineFromSystemData(x.monkey), style: { 'whiteSpace': 'unset' }},
+        {Header: 'First scan', id: 'started', accessor: x => x.started, style: { 'whiteSpace': 'unset' }},
+        {Header: 'Last scan', id: 'finished', accessor: x => x.finished, style: { 'whiteSpace': 'unset' }},
+        {Header: 'Systems found', id: 'systems', accessor: x => T1018.renderMachines(x.machines), style: { 'whiteSpace': 'unset' }},
+        ]
+    }])};
+
+  render() {
+    return (
+      <div>
+        <div>{this.props.data.message}</div>
+        <br/>
+        {this.props.data.status === ScanStatus.USED ?
+          <ReactTable
+              columns={T1018.getScanInfoColumns()}
+              data={this.props.data.scan_info}
+              showPagination={false}
+              defaultPageSize={this.props.data.scan_info.length}
+          /> : ""}
+      </div>
+    );
+  }
+}
+
+export default T1018;

monkey/monkey_island/cc/ui/src/components/report-components/AttackReport.js

@@ -26,6 +26,7 @@ import T1090 from "../attack/techniques/T1090";
 import T1041 from "../attack/techniques/T1041";
 import T1222 from "../attack/techniques/T1222";
 import T1005 from "../attack/techniques/T1005";
+import T1018 from "../attack/techniques/T1018";
 
 const tech_components = {
   'T1210': T1210,
@@ -47,7 +48,8 @@ const tech_components = {
   'T1090': T1090,
   'T1041': T1041,
   'T1222': T1222,
-  'T1005': T1005
+  'T1005': T1005,
+  'T1018': T1018
 };
 
 const classNames = require('classnames');