Fix incorrect ATT&CK report messages #1483

shreyamalviya · 2021-09-23T11:42:48Z

What does this PR do?

Fixes #919.
See commit messages for details.

PR Checklist

Have you added an explanation of what your changes do and why you'd like to include them?
Is the TravisCI build passing?
Was the CHANGELOG.md updated to reflect the changes?
~~Was the documentation framework updated to reflect the changes?~~

Testing Checklist

Added relevant unit tests?
Have you successfully tested your changes locally? Elaborate:

Tested by running the Island
If applicable, add screenshots or log transcripts of the feature working

mapped to its config fields

they make more sense

…t it's shown in the config instead of the ATT&CK report

specific systems And remove hardcoded "since it didn't run on any ... systems" from the unscanned message for those techniques

…nd declare it for all techniques left

cc/services/attack/technique_reports/ See https://stackoverflow.com/a/58321197/10629482.

1. not run on relevant system 2. relevant config options were disabled

mssalvatore

I think this provides a lot of good, useful information to the user. Good job!

We're missing some unit tests and I think a lot of the new logic can be simplified. Any time your checking if key in dict:, you can probably simplify by using dict.get() or dict.setdefault().

monkey/monkey_island/cc/services/attack/technique_reports/__init__.py

monkey/monkey_island/cc/services/config_schema/config_schema_per_attack_technique.py

ilija-lazoroski

Two of the swimm units are outdated. Needs to be changed.

Add details about your new PBA (JFXftJml8DpmuCPBA9rL) .
Add a new System Info Collector (OwcKMnALpn7tuBaJY1US) .

Otherwise, good job!!

mssalvatore · 2021-09-23T14:44:26Z

This should also get a changelog entry.

`get_config_schema_per_attack_technique()` in config_schema_per_attack_technique.py

`_add_config_field_to_reverse_schema()` in config_schema_per_attack_technique.py

config_schema_per_attack_technique.py

monkey_island\cc\services\attack\technique_reports\__init__.py

to read

test_technique_reports.py

code in test_technique_reports.py

…BA9rL

…aJY1US

…BA9rL

codecov · 2021-09-24T12:19:26Z

Codecov Report

Merging #1483 (cb4b845) into develop (4afeba6) will increase coverage by 1.24%.
The diff coverage is 93.45%.

@@             Coverage Diff             @@
##           develop    #1483      +/-   ##
===========================================
+ Coverage    41.59%   42.83%   +1.24%     
===========================================
  Files          461      471      +10     
  Lines        13953    14354     +401     
===========================================
+ Hits          5804     6149     +345     
- Misses        8149     8205      +56

Impacted Files	Coverage Δ
.../monkey_island/cc/services/attack/attack_schema.py	`100.00% <ø> (ø)`
...services/attack/technique_reports/pba_technique.py	`44.00% <0.00%> (ø)`
...ces/config_schema/definitions/exploiter_classes.py	`100.00% <ø> (ø)`
...rvices/config_schema/definitions/finger_classes.py	`100.00% <ø> (ø)`
...s/config_schema/definitions/post_breach_actions.py	`100.00% <ø> (ø)`
...chema/definitions/system_info_collector_classes.py	`100.00% <ø> (ø)`
...d/cc/services/attack/technique_reports/__init__.py	`66.32% <81.81%> (+21.25%)`	⬆️
...land/cc/services/attack/technique_reports/T1003.py	`50.00% <100.00%> (+2.17%)`	⬆️
...land/cc/services/attack/technique_reports/T1005.py	`76.92% <100.00%> (+1.92%)`	⬆️
...land/cc/services/attack/technique_reports/T1016.py	`57.89% <100.00%> (+2.33%)`	⬆️
... and 50 more

Continue to review full report at Codecov.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update 4afeba6...cb4b845. Read the comment docs.

monkey/monkey_island/cc/services/config_schema/config_schema_per_attack_technique.py

...nit_tests/monkey_island/cc/services/config_schema/test_config_schema_per_attack_technique.py

...ests/unit_tests/monkey_island/cc/services/attack/technique_reports/test_technique_reports.py

…of generating reverse schema at runtime

…le instead of generating it every time

Co-authored-by: Mike Salvatore <mike.s.salvatore@gmail.com>

monkey/monkey_island/cc/services/attack/technique_reports/__init__.py

top of its class `AttackTechnique`

shreyamalviya added 9 commits September 22, 2021 15:53

island: Add code to create reverse schema i.e. each attack technique

26b0793

mapped to its config fields

island: Change config schema definitions' titles to title case and so

836069a

they make more sense

island: Update doc link for PowerShell exploiter

f9e994d

island: Remove unneeded function to get reverse schema

ba2207b

island: Move T1216's details from T1216.py to attack_schema.py so tha…

9564fb1

…t it's shown in the config instead of the ATT&CK report

island: Add relevant_systems property to attack techniques that run on

8e733a8

specific systems And remove hardcoded "since it didn't run on any ... systems" from the unscanned message for those techniques

island: Add abstract property relevant_systems to AttackTechnique a…

b0b0f51

…nd declare it for all techniques left

island: Change pass to ... for abstract properties in

f730e75

cc/services/attack/technique_reports/ See https://stackoverflow.com/a/58321197/10629482.

island: Modify ATT&CK report messages to mention reasons

2cc0020

1. not run on relevant system 2. relevant config options were disabled

mssalvatore requested changes Sep 23, 2021

View reviewed changes

ilija-lazoroski reviewed Sep 23, 2021

View reviewed changes

shreyamalviya added 11 commits September 24, 2021 12:30

island: Use dict's get() method to shorten

4a65ac3

`get_config_schema_per_attack_technique()` in config_schema_per_attack_technique.py

island: Use dict's setdefault() to shorten

f3da34e

`_add_config_field_to_reverse_schema()` in config_schema_per_attack_technique.py

tests: Add unit test for get_config_schema_per_attack_technique() in

f2470bb

config_schema_per_attack_technique.py

tests: Add unit tests for get_message_by_status() in

90f3cff

monkey_island\cc\services\attack\technique_reports\__init__.py

tests: Move some code around in test_technique_reports.py so it's easier

aff2bad

to read

tests: Use enums for expected msgs for better readibility in

6f903bd

test_technique_reports.py

tests: Extract mocking to an autouse, function-scoped fixture to reduce

85e5441

code in test_technique_reports.py

CHANGELOG: Add entry for modifying ATT&CK report messages

a857d29

swimm: update exercise Add details about your new PBA JFXftJml8DpmuCP…

d6f91e4

…BA9rL

swimm: update exercise Add a new System Info Collector OwcKMnALpn7tuB…

1807bfc

…aJY1US

swimm: update exercise Add details about your new PBA JFXftJml8DpmuCP…

c2c5710

…BA9rL

shreyamalviya requested review from mssalvatore and ilija-lazoroski September 24, 2021 12:17

shreyamalviya assigned VakarisZ and unassigned VakarisZ Sep 24, 2021

shreyamalviya requested a review from VakarisZ September 24, 2021 12:18

mssalvatore requested changes Sep 27, 2021

View reviewed changes

shreyamalviya and others added 3 commits September 27, 2021 20:20

island, tests: Pass schema as arg to generate reverse schema instead …

afedde8

…of generating reverse schema at runtime

island, tests: Make config_schema_per_attack_technique a class variab…

0804cec

…le instead of generating it every time

island: Simplify logic when creating reverse schema

72caf5a

Co-authored-by: Mike Salvatore <mike.s.salvatore@gmail.com>

mssalvatore requested changes Sep 27, 2021

View reviewed changes

monkey/monkey_island/cc/services/attack/technique_reports/__init__.py Outdated Show resolved Hide resolved

shreyamalviya added 3 commits September 28, 2021 12:08

island: Move class variable config_schema_per_attack_technique to the

6def66c

top of its class `AttackTechnique`

island: Remove 'The' from text to be shown in report, for consistency

e5b9f96

tests: Fix unit test (remove 'The'; see previous commit)

cb4b845

shreyamalviya requested a review from mssalvatore September 28, 2021 06:39

ilija-lazoroski mentioned this pull request Sep 28, 2021

Local job scheduling and Scheduled task techniques fails on Windows #1498

Closed

mssalvatore approved these changes Sep 28, 2021

View reviewed changes

mssalvatore merged commit 0839f04 into develop Sep 28, 2021

mssalvatore deleted the incorrect-attack-report-msgs branch September 28, 2021 11:24

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Fix incorrect ATT&CK report messages #1483

Fix incorrect ATT&CK report messages #1483

Uh oh!

shreyamalviya commented Sep 23, 2021 •

edited

Loading

Uh oh!

mssalvatore left a comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

ilija-lazoroski left a comment

Uh oh!

mssalvatore commented Sep 23, 2021

Uh oh!

codecov bot commented Sep 24, 2021 •

edited

Loading

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Fix incorrect ATT&CK report messages #1483

Fix incorrect ATT&CK report messages #1483

Uh oh!

Conversation

shreyamalviya commented Sep 23, 2021 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

What does this PR do?

PR Checklist

Testing Checklist

Uh oh!

mssalvatore left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

ilija-lazoroski left a comment

Choose a reason for hiding this comment

Uh oh!

mssalvatore commented Sep 23, 2021

Uh oh!

codecov bot commented Sep 24, 2021 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

shreyamalviya commented Sep 23, 2021 •

edited

Loading

codecov bot commented Sep 24, 2021 •

edited

Loading