Map create user PBA to ATT&CK matrix #582

shreyamalviya · 2020-03-26T05:55:05Z

Fixes #579

~~Implemented changes 1, 2, 4 from the following (mentioned in the issue):~~
Implemented all changes mentioned in the issue:

Let's add this PBA to the matrix as Create Account attack technique.

The "Create Account" technique should be present in attack matrix and user should be able to toggle it.

On hover a brief with information about this particular attack technique should appear.

This technique should be mapped with "Back door user" post breach action. This means that when "Create Account" is turned off, "Back door user" should turn off and vice versa.

After exploitation, "Create Account" technique should be present on the ATT&CK report page.

~~TODO: 3~~

codecov · 2020-03-26T05:58:47Z

Codecov Report

Merging #582 into develop will not change coverage.
The diff coverage is n/a.

@@           Coverage Diff            @@
##           develop     #582   +/-   ##
========================================
  Coverage    57.60%   57.60%           
========================================
  Files          116      116           
  Lines         3892     3892           
========================================
  Hits          2242     2242           
  Misses        1650     1650

Impacted Files	Coverage Δ
monkey/monkey_island/cc/services/config_schema.py	`100.00% <ø> (ø)`

Continue to review full report at Codecov.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update 67c8b48...3bfdcb9. Read the comment docs.

monkey/monkey_island/cc/services/attack/attack_report.py

monkey/monkey_island/cc/services/attack/technique_reports/T1136.py

monkey/monkey_island/cc/services/config_schema.py

monkey/monkey_island/cc/ui/src/components/pages/ConfigurePage.js

VakarisZ

Good job! Most of work you did is in the right direction, now you just need to finish/polish :) Post some screenshots once you get it working and feel free to ask for details on slack!

VakarisZ · 2020-04-27T09:46:44Z

Looks good. What you need to do before we merge is 1. Test if my bugfix works and remove redundant code that does the same (maps post breach actions to attack config) 2. Test your changes if you haven't already. 3. Make Travis CI build pass. If you want more info about it feel free to ask on slack.

T1136: Create account

"Create Account" turned off in the ATT&CK matrix config -> "Back door user" turns off in the PBA config section ... and vice-versa

VakarisZ

Good job!

Forgot to add it back on undoing previous changes

shreyamalviya force-pushed the map-create-user-pba-to-matrix branch 2 times, most recently from 1d456fb to 2394f41 Compare April 12, 2020 16:15

VakarisZ self-requested a review April 17, 2020 13:58