-
Notifications
You must be signed in to change notification settings - Fork 788
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
- Loading branch information
Showing
358 changed files
with
15,144 additions
and
21,285 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,6 +1,3 @@ | ||
| [submodule "monkey/monkey_island/cc/services/attack/attack_data"] | ||
| path = monkey/monkey_island/cc/services/attack/attack_data | ||
| url = https://github.com/guardicore/cti | ||
| [submodule "docs/themes/learn"] | ||
| path = docs/themes/learn | ||
| url = https://github.com/guardicode/hugo-theme-learn.git |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,87 @@ | ||
| { | ||
| "id": "afMu3y3ny5lnrYFWl3EI", | ||
| "name": "Add a new Post Breach Action (PBA)", | ||
| "task": { | ||
| "dod": "You should add a new PBA to the Monkey which discovers all user accounts on the machine.", | ||
| "tests": [], | ||
| "hints": [ | ||
| "See `ScheduleJobs` PBA for an example of a PBA which only uses shell commands.", | ||
| "Make sure to add the PBA to the configuration as well.", | ||
| "MITRE ATT&CK technique T1087 articulates that adversaries may attempt to get a listing of accounts on a system or within an environment which can help them determine which accounts can aid in follow-on behavior. Therefore, the AccountDiscovery PBA is relevant to it. Make sure to map this PBA to the MITRE ATT&CK configuration and report." | ||
| ] | ||
| }, | ||
| "content": [ | ||
| { | ||
| "type": "text", | ||
| "text": "Read our [documentation](https://www.guardicore.com/infectionmonkey/docs/development/adding-post-breach-actions/) about adding a new PBA.\n\nAfter that we want you to add the AccountDiscovery PBA. The commands that add users for Windows and Linux can be retrieved from \\`get\\_commands\\_to\\_discover\\_accounts\\` — make sure you see how to use this function correctly.\n\nNote that the PBA should impact the T1087 MITRE technique as well.\n\n**Manual test to confirm**\n--------------------------\n\n1. Run the Monkey Island.\n \n2. Make sure your new PBA is enabled by default in the config. For this test, disable network scanning, exploiting, and all other PBAs.\n \n3. Run the Monkey Agent.\n \n4. See the PBA in the security report and in the MITRE report under the relevant technique." | ||
| }, | ||
| { | ||
| "type": "snippet", | ||
| "lines": [ | ||
| " POST_BREACH_JOB_SCHEDULING = \"Schedule jobs\"", | ||
| " POST_BREACH_TIMESTOMPING = \"Modify files' timestamps\"", | ||
| " POST_BREACH_SIGNED_SCRIPT_PROXY_EXEC = \"Signed script proxy execution\"", | ||
| "*POST_BREACH_ACCOUNT_DISCOVERY = \"Account discovery\"", | ||
| "+# SWIMMER: Put the new const here!", | ||
| " POST_BREACH_CLEAR_CMD_HISTORY = \"Clear command history\"" | ||
| ], | ||
| "firstLineNumber": 7, | ||
| "path": "monkey/common/common_consts/post_breach_consts.py", | ||
| "comments": [] | ||
| }, | ||
| { | ||
| "type": "snippet", | ||
| "lines": [ | ||
| " ", | ||
| " class AccountDiscovery(PBA):", | ||
| " def __init__(self):", | ||
| "* linux_cmds, windows_cmds = get_commands_to_discover_accounts()", | ||
| "+ # SWIMMER: Implement here!", | ||
| "* super().__init__(", | ||
| "+ pass", | ||
| "* POST_BREACH_ACCOUNT_DISCOVERY, linux_cmd=\" \".join(linux_cmds), windows_cmd=windows_cmds", | ||
| "* )" | ||
| ], | ||
| "firstLineNumber": 7, | ||
| "path": "monkey/infection_monkey/post_breach/actions/discover_accounts.py", | ||
| "comments": [] | ||
| }, | ||
| { | ||
| "type": "snippet", | ||
| "lines": [ | ||
| " \"with the help of a pre-existing signed script.\",", | ||
| " \"attack_techniques\": [\"T1216\"],", | ||
| " },", | ||
| "* {", | ||
| "+ # SWIMMER: Add details here!", | ||
| "* \"type\": \"string\",", | ||
| "* \"enum\": [\"AccountDiscovery\"],", | ||
| "* \"title\": \"Account Discovery\",", | ||
| "* \"safe\": True,", | ||
| "* \"info\": \"Attempts to get a listing of user accounts on the system.\",", | ||
| "* \"attack_techniques\": [\"T1087\"],", | ||
| "* },", | ||
| " {", | ||
| " \"type\": \"string\",", | ||
| " \"enum\": [\"ClearCommandHistory\"]," | ||
| ], | ||
| "firstLineNumber": 80, | ||
| "path": "monkey/monkey_island/cc/services/config_schema/definitions/post_breach_actions.py", | ||
| "comments": [] | ||
| }, | ||
| { | ||
| "type": "text", | ||
| "text": "Many PBAs use shell commands or scripts — see `Timestomping` and `AccountDiscovery`.\n\nOn the other hand, some are less straightforward. You can override functions and implement new classes depending on what is required, to implement complicated PBAs — see `SignedScriptProxyExecution` and `ModifyShellStartupFiles`. \n \n\nThis PBA, along with the others, will run on a system after it has been breached. The purpose of this code is to test whether target systems allow attackers to gather details about all the user accounts that are present on a system or in an environment." | ||
| } | ||
| ], | ||
| "symbols": {}, | ||
| "file_version": "2.0.3", | ||
| "meta": { | ||
| "app_version": "0.5.7-0", | ||
| "file_blobs": { | ||
| "monkey/common/common_consts/post_breach_consts.py": "01d31448269e5581dbe0176c289f7dd36cc5854f", | ||
| "monkey/infection_monkey/post_breach/actions/discover_accounts.py": "8fdebd0df97655e4cba3aebcdcf3c5ed1d1b6cbd", | ||
| "monkey/monkey_island/cc/services/config_schema/definitions/post_breach_actions.py": "88a3e8cb59fb0d1c07c9487bcb4eaab7b8087d84" | ||
| } | ||
| } | ||
| } |
This file was deleted.
Oops, something went wrong.
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.