Merge pull request #384 from VakarisZ/attack_sys_network_config

T1016 System network configuration discovery

monkey/monkey_island/cc/services/attack/attack_report.py

@@ -3,7 +3,7 @@ import logging
 from monkey_island.cc.models import Monkey
 from monkey_island.cc.services.attack.technique_reports import T1210, T1197, T1110, T1075, T1003, T1059, T1086, T1082
 from monkey_island.cc.services.attack.technique_reports import T1145, T1105, T1065, T1035, T1129, T1106, T1107, T1188
-from monkey_island.cc.services.attack.technique_reports import T1090, T1041, T1222, T1005, T1018
+from monkey_island.cc.services.attack.technique_reports import T1090, T1041, T1222, T1005, T1018, T1016
 from monkey_island.cc.services.attack.attack_config import AttackConfig
 from monkey_island.cc.database import mongo
 
@@ -32,7 +32,8 @@ TECHNIQUES = {'T1210': T1210.T1210,
               'T1041': T1041.T1041,
               'T1222': T1222.T1222,
               'T1005': T1005.T1005,
-              'T1018': T1018.T1018}
+              'T1018': T1018.T1018,
+              'T1016': T1016.T1016}
 
 REPORT_NAME = 'new_report'
 

monkey/monkey_island/cc/services/attack/attack_schema.py

@@ -176,6 +176,7 @@ SCHEMA = {
                     "type": "bool",
                     "value": True,
                     "necessary": False,
+                    "depends_on": ["T1016", "T1005"],
                     "description": "An adversary may attempt to get detailed information about the "
                                    "operating system and hardware, including version, patches, hotfixes, "
                                    "service packs, and architecture."
@@ -187,6 +188,16 @@ SCHEMA = {
                     "necessary": True,
                     "description": "Adversaries will likely attempt to get a listing of other systems by IP address, "
                                    "hostname, or other logical identifier on a network for lateral movement."
+                },
+                "T1016": {
+                    "title": "T1016 System network configuration discovery",
+                    "type": "bool",
+                    "value": True,
+                    "necessary": False,
+                    "depends_on": ["T1005", "T1082"],
+                    "description": "Adversaries will likely look for details about the network configuration "
+                                   "and settings of systems they access or through information discovery"
+                                   " of remote systems."
                 }
             }
         },
@@ -199,6 +210,7 @@ SCHEMA = {
                     "type": "bool",
                     "value": True,
                     "necessary": False,
+                    "depends_on": ["T1016", "T1082"],
                     "description": "Sensitive data can be collected from local system sources, such as the file system "
                                    "or databases of information residing on the system prior to Exfiltration."
                 }

monkey/monkey_island/cc/services/attack/technique_reports/T1016.py

@@ -0,0 +1,35 @@
+from common.utils.attack_utils import ScanStatus
+from monkey_island.cc.services.attack.technique_reports import AttackTechnique
+from monkey_island.cc.database import mongo
+
+__author__ = "VakarisZ"
+
+
+class T1016(AttackTechnique):
+
+    tech_id = "T1016"
+    unscanned_msg = "Monkey didn't gather network configurations."
+    scanned_msg = ""
+    used_msg = "Monkey gathered network configurations on systems in the network."
+
+    query = [{'$match': {'telem_category': 'system_info'}},
+             {'$project': {'machine': {'hostname': '$data.hostname', 'ips': '$data.network_info.networks'},
+                           'networks': '$data.network_info.networks',
+                           'netstat': '$data.network_info.netstat'}},
+             {'$addFields': {'_id': 0,
+                             'netstat': 0,
+                             'networks': 0,
+                             'info': [
+                                 {'used': {'$and': [{'$ifNull': ['$netstat', False]}, {'$gt': ['$netstat', {}]}]},
+                                  'name': {'$literal': 'Network connections (netstat)'}},
+                                 {'used': {'$and': [{'$ifNull': ['$networks', False]}, {'$gt': ['$networks', {}]}]},
+                                  'name': {'$literal': 'Network interface info'}},
+                             ]}}]
+
+    @staticmethod
+    def get_report_data():
+        network_info = list(mongo.db.telemetry.aggregate(T1016.query))
+        status = ScanStatus.USED.value if network_info else ScanStatus.UNSCANNED.value
+        data = T1016.get_base_data_by_status(status)
+        data.update({'network_info': network_info})
+        return data

monkey/monkey_island/cc/services/config_schema.py

@@ -422,7 +422,7 @@ SCHEMA = {
                             "title": "Collect system info",
                             "type": "boolean",
                             "default": True,
-                            "attack_techniques": ["T1082", "T1005"],
+                            "attack_techniques": ["T1082", "T1005", "T1016"],
                             "description": "Determines whether to collect system info"
                         },
                         "should_use_mimikatz": {

monkey/monkey_island/cc/ui/src/components/attack/techniques/Helpers.js

@@ -37,6 +37,19 @@ export function getUsageColumns() {
           style: { 'whiteSpace': 'unset' }}]
     }])}
 
+/* Renders table fields that contains 'used' boolean value and 'name' string value.
+'Used' value determines if 'name' value will be shown.
+ */
+export function renderUsageFields(usages){
+    let output = [];
+    usages.forEach(function(usage){
+      if(usage['used']){
+        output.push(<div key={usage['name']}>{usage['name']}</div>)
+      }
+    });
+    return (<div>{output}</div>);
+  }
+
 export const ScanStatus = {
     UNSCANNED: 0,
     SCANNED: 1,

monkey/monkey_island/cc/ui/src/components/attack/techniques/T1016.js

@@ -0,0 +1,39 @@
+import React from 'react';
+import '../../../styles/Collapse.scss'
+import ReactTable from "react-table";
+import { renderMachineFromSystemData, renderUsageFields, ScanStatus } from "./Helpers"
+
+
+class T1016 extends React.Component {
+
+  constructor(props) {
+    super(props);
+  }
+
+  static getNetworkInfoColumns() {
+    return ([{
+      Header: "Network configuration info gathered",
+      columns: [
+        {Header: 'Machine', id: 'machine', accessor: x => renderMachineFromSystemData(x.machine), style: { 'whiteSpace': 'unset' }},
+        {Header: 'Network info', id: 'info', accessor: x => renderUsageFields(x.info), style: { 'whiteSpace': 'unset' }},
+        ]
+    }])};
+
+  render() {
+    return (
+      <div>
+        <div>{this.props.data.message}</div>
+        <br/>
+        {this.props.data.status === ScanStatus.USED ?
+          <ReactTable
+              columns={T1016.getNetworkInfoColumns()}
+              data={this.props.data.network_info}
+              showPagination={false}
+              defaultPageSize={this.props.data.network_info.length}
+          /> : ""}
+      </div>
+    );
+  }
+}
+
+export default T1016;

monkey/monkey_island/cc/ui/src/components/attack/techniques/T1082.js

@@ -1,7 +1,7 @@
 import React from 'react';
 import '../../../styles/Collapse.scss'
 import ReactTable from "react-table";
-import { renderMachineFromSystemData, ScanStatus } from "./Helpers"
+import { renderMachineFromSystemData, renderUsageFields, ScanStatus } from "./Helpers"
 
 
 class T1082 extends React.Component {
@@ -10,21 +10,11 @@ class T1082 extends React.Component {
     super(props);
   }
 
-  static renderCollections(collections){
-    let output = [];
-    collections.forEach(function(collection){
-      if(collection['used']){
-        output.push(<div key={collection['name']}>{collection['name']}</div>)
-      }
-    });
-    return (<div>{output}</div>);
-  }
-
   static getSystemInfoColumns() {
     return ([{
       columns: [
         {Header: 'Machine', id: 'machine', accessor: x => renderMachineFromSystemData(x.machine), style: { 'whiteSpace': 'unset' }},
-        {Header: 'Gathered info', id: 'info', accessor: x => T1082.renderCollections(x.collections), style: { 'whiteSpace': 'unset' }},
+        {Header: 'Gathered info', id: 'info', accessor: x => renderUsageFields(x.collections), style: { 'whiteSpace': 'unset' }},
         ]
     }])};
 

monkey/monkey_island/cc/ui/src/components/report-components/AttackReport.js

@@ -27,6 +27,7 @@ import T1041 from "../attack/techniques/T1041";
 import T1222 from "../attack/techniques/T1222";
 import T1005 from "../attack/techniques/T1005";
 import T1018 from "../attack/techniques/T1018";
+import T1016 from "../attack/techniques/T1016";
 
 const tech_components = {
   'T1210': T1210,
@@ -49,7 +50,8 @@ const tech_components = {
   'T1041': T1041,
   'T1222': T1222,
   'T1005': T1005,
-  'T1018': T1018
+  'T1018': T1018,
+  'T1016': T1016
 };
 
 const classNames = require('classnames');