【ATTCK】开源项目-mitreattack-python

2023-11-08 18:52

本文主要是介绍【ATTCK】开源项目-mitreattack-python,希望对大家解决编程问题提供一定的参考价值,需要的开发者们随着小编来一起学习吧!

        mitreattack-python是用来处理ATT&CK数据的python开源工具。

        开源地址:GitHub - mitre-attack/mitreattack-python: A python module for working with ATT&CK

安装

pip3 install mitreattack-python #使用清华源pip3 install mitreattack-python  -i https://pypi.tuna.tsinghua.edu.cn/simple/

使用教程

1、下载attck json数据文件

https://raw.githubusercontent.com/mitre/cti/master/enterprise-attack/enterprise-attack.json

https://raw.githubusercontent.com/mitre/cti/master/mobile-attack/mobile-attack.json

https://raw.githubusercontent.com/mitre/cti/master/ics-attack/ics-attack.json

2、将下载的文件复制到当前工作目录

        不然会报文件不存在的错误,或指定文件目录。

>>> mitre_attack_data = MitreAttackData("enterprise-attack.json")Traceback (most recent call last):File "<stdin>", line 1, in <module>File "C:\Users\xxxxxx\.conda\envs\attck\lib\site-packages\mitreattack\stix20\MitreAttackData.py", line 85, in __init__self.src.load_from_file(stix_filepath)File "C:\Users\xxxxxx\.conda\envs\attck\lib\site-packages\stix2\datastore\memory.py", line 148, in load_from_filereturn self.source.load_from_file(*args, **kwargs)File "C:\Users\xxxxxx\.conda\envs\attck\lib\site-packages\stix2\datastore\memory.py", line 363, in load_from_filewith io.open(os.path.abspath(file_path), "r", encoding=encoding) as f:FileNotFoundError: [Errno 2] No such file or directory: 'D:\\opt\\attck\\enterprise-attack.json'

3、加载数据文件

(attck) D:\opt\attck>pythonPython 3.10.13 | packaged by conda-forge | (main, Oct 26 2023, 18:01:37) [MSC v.1935 64 bit (AMD64)] on win32Type "help", "copyright", "credits" or "license" for more information.>>> from mitreattack.stix20 import MitreAttackData>>> mitre_attack_data = MitreAttackData("enterprise-attack.json")4、常见用法

4、使用案例

get_object_by_stix_id

>>> G0075 = mitre_attack_data.get_object_by_stix_id("intrusion-set--f40eb8ce-2a74-4e56-89a1-227021410142")>>> print(G0075.serialize(pretty=True)){"type": "intrusion-set","id": "intrusion-set--f40eb8ce-2a74-4e56-89a1-227021410142","created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5","created": "2018-10-17T00:14:20.652Z","modified": "2020-03-30T19:15:49.217Z","name": "Rancor","description": "[Rancor](https://attack.mitre.org/groups/G0075) is a threat group that has led targeted campaigns against the South East Asia region. [Rancor](https://attack.mitre.org/groups/G0075) uses politically-motivated lures to entice victims to open malicious documents. (Citation: Rancor Unit42 June 2018)","aliases": ["Rancor"],"external_references": [{"source_name": "mitre-attack","url": "https://attack.mitre.org/groups/G0075","external_id": "G0075"},{"source_name": "Rancor","description": "(Citation: Rancor Unit42 June 2018)"},{"source_name": "Rancor Unit42 June 2018","description": "Ash, B., et al. (2018, June 26). RANCOR: Targeted Attacks in South East Asia Using PLAINTEE and DDKONG Malware Families. Retrieved July 2, 2018.","url": "https://researchcenter.paloaltonetworks.com/2018/06/unit42-rancor-targeted-attacks-south-east-asia-using-plaintee-ddkong-malware-families/"}],"object_marking_refs": ["marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"],"x_mitre_domains": ["enterprise-attack"],"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5","x_mitre_version": "1.2"}>>>

get_object_by_attack_id

>>> T1134 = mitre_attack_data.get_object_by_attack_id("T1134", "attack-pattern")>>> mitre_attack_data.print_stix_object(T1134, pretty=True){"type": "attack-pattern","id": "attack-pattern--dcaa092b-7de9-4a21-977f-7fcb77e89c48","created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5","created": "2017-12-14T16:46:06.044Z","modified": "2023-03-30T21:01:47.762Z","name": "Access Token Manipulation","description": "Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.\n\nAn adversary can use built-in Windows API functions to copy access tokens from existing processes; this is known as token stealing. These token can then be applied to an existing process (i.e. [Token Impersonation/Theft](https://attack.mitre.org/techniques/T1134/001)) or used to spawn a new process (i.e. [Create Process with Token](https://attack.mitre.org/techniques/T1134/002)). An adversary must already be in a privileged user context (i.e. administrator) to steal a token. However, adversaries commonly use token stealing to elevate their security context from the administrator level to the SYSTEM level. An adversary can then use a token to authenticate to a remote system as the account for that token if the account has appropriate permissions on the remote system.(Citation: Pentestlab Token Manipulation)\n\nAny standard user can use the <code>runas</code> command, and the Windows API functions, to create impersonation tokens; it does not require access to an administrator account. There are also other mechanisms, such as Active Directory fields, that can be used to modify access tokens.","kill_chain_phases": [{"kill_chain_name": "mitre-attack","phase_name": "defense-evasion"},{"kill_chain_name": "mitre-attack","phase_name": "privilege-escalation"}],"external_references": [{"source_name": "mitre-attack","url": "https://attack.mitre.org/techniques/T1134","external_id": "T1134"},{"source_name": "BlackHat Atkinson Winchester Token Manipulation","description": "Atkinson, J., Winchester, R. (2017, December 7). A Process is No One: Hunting for Token Manipulation. Retrieved December 21, 2017.","url": "https://www.blackhat.com/docs/eu-17/materials/eu-17-Atkinson-A-Process-Is-No-One-Hunting-For-Token-Manipulation.pdf"},{"source_name": "Microsoft Command-line Logging","description": "Mathers, B. (2017, March 7). Command line process auditing. Retrieved April 21, 2017.","url": "https://technet.microsoft.com/en-us/windows-server-docs/identity/ad-ds/manage/component-updates/command-line-process-auditing"},{"source_name": "Microsoft LogonUser","description": "Microsoft TechNet. (n.d.). Retrieved April 25, 2017.","url": "https://msdn.microsoft.com/en-us/library/windows/desktop/aa378184(v=vs.85).aspx"},{"source_name": "Microsoft DuplicateTokenEx","description": "Microsoft TechNet. (n.d.). Retrieved April 25, 2017.","url": "https://msdn.microsoft.com/en-us/library/windows/desktop/aa446617(v=vs.85).aspx"},{"source_name": "Microsoft ImpersonateLoggedOnUser","description": "Microsoft TechNet. (n.d.). Retrieved April 25, 2017.","url": "https://msdn.microsoft.com/en-us/library/windows/desktop/aa378612(v=vs.85).aspx"},{"source_name": "Pentestlab Token Manipulation","description": "netbiosX. (2017, April 3). Token Manipulation. Retrieved April 21, 2017.","url": "https://pentestlab.blog/2017/04/03/token-manipulation/"}],"object_marking_refs": ["marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"],"x_mitre_attack_spec_version": "2.1.0","x_mitre_contributors": ["Tom Ueltschi @c_APT_ure","Travis Smith, Tripwire","Robby Winchester, @robwinchester3","Jared Atkinson, @jaredcatkinson"],"x_mitre_data_sources": ["Process: OS API Execution","Command: Command Execution","User Account: User Account Metadata","Process: Process Metadata","Process: Process Creation","Active Directory: Active Directory Object Modification"],"x_mitre_defense_bypassed": ["Windows User Account Control","Heuristic Detection","System Access Controls","Host Forensic Analysis"],"x_mitre_deprecated": false,"x_mitre_detection": "If an adversary is using a standard command-line shell, analysts can detect token manipulation by auditing command-line activity. Specifically, analysts should look for use of the <code>runas</code> command. Detailed command-line logging is not enabled by default in Windows.(Citation: Microsoft Command-line Logging)\n\nIf an adversary is using a payload that calls the Windows token APIs directly, analysts can detect token manipulation only through careful analysis of user network activity, examination of running processes, and correlation with other endpoint and network behavior. \n\nThere are many Windows API calls a payload can take advantage of to manipulate access tokens (e.g., <code>LogonUser</code> (Citation: Microsoft LogonUser), <code>DuplicateTokenEx</code>(Citation: Microsoft DuplicateTokenEx), and <code>ImpersonateLoggedOnUser</code>(Citation: Microsoft ImpersonateLoggedOnUser)). Please see the referenced Windows API pages for more information.\n\nQuery systems for process and thread token information and look for inconsistencies such as user owns processes impersonating the local SYSTEM account.(Citation: BlackHat Atkinson Winchester Token Manipulation)\n\nLook for inconsistencies between the various fields that store PPID information, such as the EventHeader ProcessId from data collected via Event Tracing for Windows (ETW), Creator Process ID/Name from Windows event logs, and the ProcessID and ParentProcessID (which are also produced from ETW and other utilities such as Task Manager and Process Explorer). The ETW provided EventHeader ProcessId identifies the actual parent process.","x_mitre_domains": ["enterprise-attack"],"x_mitre_effective_permissions": ["SYSTEM"],"x_mitre_is_subtechnique": false,"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5","x_mitre_permissions_required": ["User","Administrator"],"x_mitre_platforms": ["Windows"],"x_mitre_version": "2.0"}

get_software_used_by_group

 

 # get software used by G0019>>> group_stix_id = "intrusion-set--2a158b0a-7ef8-43cb-9985-bf34d1e12050">>> software_used_by_g0019 = mitre_attack_data.get_software_used_by_group(group_stix_id)>>> print(f"Software used by G0019 ({len(software_used_by_g0019)}):")Software used by G0019 (15):>>> for s in software_used_by_g0019:...         software = s["object"]...         print(f"* {software.name} ({mitre_attack_data.get_attack_id(software.id)})")...* ftp (S0095)* Net (S0039)* Ping (S0097)* netsh (S0108)* Systeminfo (S0096)* PsExec (S0029)* Tasklist (S0057)* WinMM (S0059)* RainyDay (S0629)* Nebulae (S0630)* RARSTONE (S0055)* HDoor (S0061)* Sys10 (S0060)* SslMM (S0058)* Aria-body (S0456)>>>

这篇关于【ATTCK】开源项目-mitreattack-python的文章就介绍到这儿,希望我们推荐的文章对编程师们有所帮助!



http://www.chinasem.cn/article/371830

相关文章

Python的Darts库实现时间序列预测

《Python的Darts库实现时间序列预测》Darts一个集统计、机器学习与深度学习模型于一体的Python时间序列预测库,本文主要介绍了Python的Darts库实现时间序列预测,感兴趣的可以了解... 目录目录一、什么是 Darts?二、安装与基本配置安装 Darts导入基础模块三、时间序列数据结构与

Python正则表达式匹配和替换的操作指南

《Python正则表达式匹配和替换的操作指南》正则表达式是处理文本的强大工具,Python通过re模块提供了完整的正则表达式功能,本文将通过代码示例详细介绍Python中的正则匹配和替换操作,需要的朋... 目录基础语法导入re模块基本元字符常用匹配方法1. re.match() - 从字符串开头匹配2.

基于 Cursor 开发 Spring Boot 项目详细攻略

《基于Cursor开发SpringBoot项目详细攻略》Cursor是集成GPT4、Claude3.5等LLM的VSCode类AI编程工具,支持SpringBoot项目开发全流程,涵盖环境配... 目录cursor是什么?基于 Cursor 开发 Spring Boot 项目完整指南1. 环境准备2. 创建

Python使用FastAPI实现大文件分片上传与断点续传功能

《Python使用FastAPI实现大文件分片上传与断点续传功能》大文件直传常遇到超时、网络抖动失败、失败后只能重传的问题,分片上传+断点续传可以把大文件拆成若干小块逐个上传,并在中断后从已完成分片继... 目录一、接口设计二、服务端实现(FastAPI)2.1 运行环境2.2 目录结构建议2.3 serv

通过Docker容器部署Python环境的全流程

《通过Docker容器部署Python环境的全流程》在现代化开发流程中,Docker因其轻量化、环境隔离和跨平台一致性的特性,已成为部署Python应用的标准工具,本文将详细演示如何通过Docker容... 目录引言一、docker与python的协同优势二、核心步骤详解三、进阶配置技巧四、生产环境最佳实践

Python一次性将指定版本所有包上传PyPI镜像解决方案

《Python一次性将指定版本所有包上传PyPI镜像解决方案》本文主要介绍了一个安全、完整、可离线部署的解决方案,用于一次性准备指定Python版本的所有包,然后导出到内网环境,感兴趣的小伙伴可以跟随... 目录为什么需要这个方案完整解决方案1. 项目目录结构2. 创建智能下载脚本3. 创建包清单生成脚本4

Python实现Excel批量样式修改器(附完整代码)

《Python实现Excel批量样式修改器(附完整代码)》这篇文章主要为大家详细介绍了如何使用Python实现一个Excel批量样式修改器,文中的示例代码讲解详细,感兴趣的小伙伴可以跟随小编一起学习一... 目录前言功能特性核心功能界面特性系统要求安装说明使用指南基本操作流程高级功能技术实现核心技术栈关键函

python获取指定名字的程序的文件路径的两种方法

《python获取指定名字的程序的文件路径的两种方法》本文主要介绍了python获取指定名字的程序的文件路径的两种方法,文中通过示例代码介绍的非常详细,对大家的学习或者工作具有一定的参考学习价值,需要... 最近在做项目,需要用到给定一个程序名字就可以自动获取到这个程序在Windows系统下的绝对路径,以下

使用Python批量将.ncm格式的音频文件转换为.mp3格式的实战详解

《使用Python批量将.ncm格式的音频文件转换为.mp3格式的实战详解》本文详细介绍了如何使用Python通过ncmdump工具批量将.ncm音频转换为.mp3的步骤,包括安装、配置ffmpeg环... 目录1. 前言2. 安装 ncmdump3. 实现 .ncm 转 .mp34. 执行过程5. 执行结

Python实现批量CSV转Excel的高性能处理方案

《Python实现批量CSV转Excel的高性能处理方案》在日常办公中,我们经常需要将CSV格式的数据转换为Excel文件,本文将介绍一个基于Python的高性能解决方案,感兴趣的小伙伴可以跟随小编一... 目录一、场景需求二、技术方案三、核心代码四、批量处理方案五、性能优化六、使用示例完整代码七、小结一、