-
Notifications
You must be signed in to change notification settings - Fork 807
Closed
Labels
BugAn error, flaw, misbehavior or failure in the Monkey or Monkey Island.An error, flaw, misbehavior or failure in the Monkey or Monkey Island.Complexity: LowImpact: LowMITRE ATT&CKReported by user
Description
Describe the bug
In the ATT&CK report, technique T1075, i.e. Pass The Hash, reports that it wasn't attempted (exact message below) even though Monkey ran on Windows machines and the SMB Exploiter was enabled.
Monkey didn't try to use pass the hash attack due to one of the following reasons:
Monkey did not run on any Windows systems.
The following configuration options were disabled:
- Exploiters — SMB Exploiter
Expected behavior
It should display the correct message, that it was attempted and failed.
Findings
The technique was not used since no hashes were specified in the internal configuration. While generating the ATT&CK report, we should also go through the internal config and specify that no values for certain config options would cause the technique to be unscanned.
Tasks
-
Fix the mongo query for T1075 (and check others?).Go through the internal config as well when generating the reverse config schema inmonkey\monkey_island\cc\services\config_schema\config_schema_per_attack_technique.py
.
Metadata
Metadata
Assignees
Labels
BugAn error, flaw, misbehavior or failure in the Monkey or Monkey Island.An error, flaw, misbehavior or failure in the Monkey or Monkey Island.Complexity: LowImpact: LowMITRE ATT&CKReported by user