p59342861
/
monkey
forked from p15670423/monkey
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

Add check for "Communicate as new user" PBA in T1136

This commit is contained in:
Shreya 2020-04-25 00:32:40 +05:30
parent e164f53ed4
commit 749c37f647
1 changed files with 7 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

11
monkey/monkey_island/cc/services/attack/technique_reports/T1136.py
View File

@ -1,6 +1,7 @@
from monkey_island.cc.services.attack.technique_reports import AttackTechnique from monkey_island.cc.services.attack.technique_reports import AttackTechnique
from monkey_island.cc.services.reporting.report import ReportService from monkey_island.cc.services.reporting.report import ReportService
from common.utils.attack_utils import ScanStatus from common.utils.attack_utils import ScanStatus
from common.data.post_breach_consts import POST_BREACH_BACKDOOR_USER, POST_BREACH_COMMUNICATE_AS_NEW_USER
from monkey_island.cc.models import Monkey from monkey_island.cc.models import Monkey
__author__ = "shreyamalviya" __author__ = "shreyamalviya"
@ -9,7 +10,7 @@ __author__ = "shreyamalviya"
class T1136(AttackTechnique): class T1136(AttackTechnique):
tech_id = "T1136" tech_id = "T1136"
unscanned_msg = "Monkey didn't try creating a new user on the network's systems." unscanned_msg = "Monkey didn't try creating a new user on the network's systems."
scanned_msg = "" scanned_msg = "Monkey tried creating a new user on the network's systems, but failed."
used_msg = "Monkey created a new user on the network's systems." used_msg = "Monkey created a new user on the network's systems."
@staticmethod @staticmethod
@ -21,15 +22,17 @@ class T1136(AttackTechnique):
for node in scanned_nodes: for node in scanned_nodes:
if node['pba_results'] != 'None': if node['pba_results'] != 'None':
for pba in node['pba_results']: for pba in node['pba_results']:
if pba['name'] == 'Backdoor user': if pba['name'] in [POST_BREACH_BACKDOOR_USER,
status = ScanStatus.USED.value POST_BREACH_COMMUNICATE_AS_NEW_USER]:
status = ScanStatus.USED.value if pba['result'][1]\
else ScanStatus.SCANNED.value
data.update({ data.update({
'info': [{ 'info': [{
'machine': { 'machine': {
'hostname': pba['hostname'], 'hostname': pba['hostname'],
'ips': node['ip_addresses'], 'ips': node['ip_addresses'],
}, },
'result': pba['result'][0] 'result': ': '.join([pba['name'], pba['result'][0]])
}] }]
}) })
data.update(T1136.get_message_and_status(status)) data.update(T1136.get_message_and_status(status))