【ATT&CK】开源项目-mitreattack-python

mitreattack-python是用来处理ATT&CK数据的python开源工具。

开源地址:GitHub - mitre-attack/mitreattack-python: A python module for working with ATT&CK

安装

复制代码
pip3 install mitreattack-python 

#使用清华源

pip3 install mitreattack-python  -i https://pypi.tuna.tsinghua.edu.cn/simple/

使用教程

1、下载attck json数据文件

https://raw.githubusercontent.com/mitre/cti/master/enterprise-attack/enterprise-attack.json

https://raw.githubusercontent.com/mitre/cti/master/mobile-attack/mobile-attack.json

https://raw.githubusercontent.com/mitre/cti/master/ics-attack/ics-attack.json

2、将下载的文件复制到当前工作目录

不然会报文件不存在的错误,或指定文件目录。

复制代码
>>> mitre_attack_data = MitreAttackData("enterprise-attack.json")

Traceback (most recent call last):

  File "<stdin>", line 1, in <module>

  File "C:\Users\xxxxxx\.conda\envs\attck\lib\site-packages\mitreattack\stix20\MitreAttackData.py", line 85, in __init__

    self.src.load_from_file(stix_filepath)

  File "C:\Users\xxxxxx\.conda\envs\attck\lib\site-packages\stix2\datastore\memory.py", line 148, in load_from_file

    return self.source.load_from_file(*args, **kwargs)

  File "C:\Users\xxxxxx\.conda\envs\attck\lib\site-packages\stix2\datastore\memory.py", line 363, in load_from_file

    with io.open(os.path.abspath(file_path), "r", encoding=encoding) as f:

FileNotFoundError: [Errno 2] No such file or directory: 'D:\\opt\\attck\\enterprise-attack.json'

3、加载数据文件

复制代码
(attck) D:\opt\attck>python

Python 3.10.13 | packaged by conda-forge | (main, Oct 26 2023, 18:01:37) [MSC v.1935 64 bit (AMD64)] on win32

Type "help", "copyright", "credits" or "license" for more information.

>>> from mitreattack.stix20 import MitreAttackData

>>> mitre_attack_data = MitreAttackData("enterprise-attack.json")

4、常见用法

4、使用案例

get_object_by_stix_id

复制代码
>>> G0075 = mitre_attack_data.get_object_by_stix_id("intrusion-set--f40eb8ce-2a74-4e56-89a1-227021410142")

>>> print(G0075.serialize(pretty=True))

{

    "type": "intrusion-set",

    "id": "intrusion-set--f40eb8ce-2a74-4e56-89a1-227021410142",

    "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",

    "created": "2018-10-17T00:14:20.652Z",

    "modified": "2020-03-30T19:15:49.217Z",

    "name": "Rancor",

    "description": "[Rancor](https://attack.mitre.org/groups/G0075) is a threat group that has led targeted campaigns against the South East Asia region. [Rancor](https://attack.mitre.org/groups/G0075) uses politically-motivated lures to entice victims to open malicious documents. (Citation: Rancor Unit42 June 2018)",

    "aliases": [

        "Rancor"

    ],

    "external_references": [

        {

            "source_name": "mitre-attack",

            "url": "https://attack.mitre.org/groups/G0075",

            "external_id": "G0075"

        },

        {

            "source_name": "Rancor",

            "description": "(Citation: Rancor Unit42 June 2018)"

        },

        {

            "source_name": "Rancor Unit42 June 2018",

            "description": "Ash, B., et al. (2018, June 26). RANCOR: Targeted Attacks in South East Asia Using PLAINTEE and DDKONG Malware Families. Retrieved July 2, 2018.",

            "url": "https://researchcenter.paloaltonetworks.com/2018/06/unit42-rancor-targeted-attacks-south-east-asia-using-plaintee-ddkong-malware-families/"

        }

    ],

    "object_marking_refs": [

        "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"

    ],

    "x_mitre_domains": [

        "enterprise-attack"

    ],

    "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",

    "x_mitre_version": "1.2"

}

>>>

get_object_by_attack_id

复制代码
>>> T1134 = mitre_attack_data.get_object_by_attack_id("T1134", "attack-pattern")

>>> mitre_attack_data.print_stix_object(T1134, pretty=True)

{

    "type": "attack-pattern",

    "id": "attack-pattern--dcaa092b-7de9-4a21-977f-7fcb77e89c48",

    "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",

    "created": "2017-12-14T16:46:06.044Z",

    "modified": "2023-03-30T21:01:47.762Z",

    "name": "Access Token Manipulation",

    "description": "Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.\n\nAn adversary can use built-in Windows API functions to copy access tokens from existing processes; this is known as token stealing. These token can then be applied to an existing process (i.e. [Token Impersonation/Theft](https://attack.mitre.org/techniques/T1134/001)) or used to spawn a new process (i.e. [Create Process with Token](https://attack.mitre.org/techniques/T1134/002)). An adversary must already be in a privileged user context (i.e. administrator) to steal a token. However, adversaries commonly use token stealing to elevate their security context from the administrator level to the SYSTEM level. An adversary can then use a token to authenticate to a remote system as the account for that token if the account has appropriate permissions on the remote system.(Citation: Pentestlab Token Manipulation)\n\nAny standard user can use the <code>runas</code> command, and the Windows API functions, to create impersonation tokens; it does not require access to an administrator account. There are also other mechanisms, such as Active Directory fields, that can be used to modify access tokens.",

    "kill_chain_phases": [

        {

            "kill_chain_name": "mitre-attack",

            "phase_name": "defense-evasion"

        },

        {

            "kill_chain_name": "mitre-attack",

            "phase_name": "privilege-escalation"

        }

    ],

    "external_references": [

        {

            "source_name": "mitre-attack",

            "url": "https://attack.mitre.org/techniques/T1134",

            "external_id": "T1134"

        },

        {

            "source_name": "BlackHat Atkinson Winchester Token Manipulation",

            "description": "Atkinson, J., Winchester, R. (2017, December 7). A Process is No One: Hunting for Token Manipulation. Retrieved December 21, 2017.",

            "url": "https://www.blackhat.com/docs/eu-17/materials/eu-17-Atkinson-A-Process-Is-No-One-Hunting-For-Token-Manipulation.pdf"

        },

        {

            "source_name": "Microsoft Command-line Logging",

            "description": "Mathers, B. (2017, March 7). Command line process auditing. Retrieved April 21, 2017.",

            "url": "https://technet.microsoft.com/en-us/windows-server-docs/identity/ad-ds/manage/component-updates/command-line-process-auditing"

        },

        {

            "source_name": "Microsoft LogonUser",

            "description": "Microsoft TechNet. (n.d.). Retrieved April 25, 2017.",

            "url": "https://msdn.microsoft.com/en-us/library/windows/desktop/aa378184(v=vs.85).aspx"

        },

        {

            "source_name": "Microsoft DuplicateTokenEx",

            "description": "Microsoft TechNet. (n.d.). Retrieved April 25, 2017.",

            "url": "https://msdn.microsoft.com/en-us/library/windows/desktop/aa446617(v=vs.85).aspx"

        },

        {

            "source_name": "Microsoft ImpersonateLoggedOnUser",

            "description": "Microsoft TechNet. (n.d.). Retrieved April 25, 2017.",

            "url": "https://msdn.microsoft.com/en-us/library/windows/desktop/aa378612(v=vs.85).aspx"

        },

        {

            "source_name": "Pentestlab Token Manipulation",

            "description": "netbiosX. (2017, April 3). Token Manipulation. Retrieved April 21, 2017.",

            "url": "https://pentestlab.blog/2017/04/03/token-manipulation/"

        }

    ],

    "object_marking_refs": [

        "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"

    ],

    "x_mitre_attack_spec_version": "2.1.0",

    "x_mitre_contributors": [

        "Tom Ueltschi @c_APT_ure",

        "Travis Smith, Tripwire",

        "Robby Winchester, @robwinchester3",

        "Jared Atkinson, @jaredcatkinson"

    ],

    "x_mitre_data_sources": [

        "Process: OS API Execution",

        "Command: Command Execution",

        "User Account: User Account Metadata",

        "Process: Process Metadata",

        "Process: Process Creation",

        "Active Directory: Active Directory Object Modification"

    ],

    "x_mitre_defense_bypassed": [

        "Windows User Account Control",

        "Heuristic Detection",

        "System Access Controls",

        "Host Forensic Analysis"

    ],

    "x_mitre_deprecated": false,

    "x_mitre_detection": "If an adversary is using a standard command-line shell, analysts can detect token manipulation by auditing command-line activity. Specifically, analysts should look for use of the <code>runas</code> command. Detailed command-line logging is not enabled by default in Windows.(Citation: Microsoft Command-line Logging)\n\nIf an adversary is using a payload that calls the Windows token APIs directly, analysts can detect token manipulation only through careful analysis of user network activity, examination of running processes, and correlation with other endpoint and network behavior. \n\nThere are many Windows API calls a payload can take advantage of to manipulate access tokens (e.g., <code>LogonUser</code> (Citation: Microsoft LogonUser), <code>DuplicateTokenEx</code>(Citation: Microsoft DuplicateTokenEx), and <code>ImpersonateLoggedOnUser</code>(Citation: Microsoft ImpersonateLoggedOnUser)). Please see the referenced Windows API pages for more information.\n\nQuery systems for process and thread token information and look for inconsistencies such as user owns processes impersonating the local SYSTEM account.(Citation: BlackHat Atkinson Winchester Token Manipulation)\n\nLook for inconsistencies between the various fields that store PPID information, such as the EventHeader ProcessId from data collected via Event Tracing for Windows (ETW), Creator Process ID/Name from Windows event logs, and the ProcessID and ParentProcessID (which are also produced from ETW and other utilities such as Task Manager and Process Explorer). The ETW provided EventHeader ProcessId identifies the actual parent process.",

    "x_mitre_domains": [

        "enterprise-attack"

    ],

    "x_mitre_effective_permissions": [

        "SYSTEM"

    ],

    "x_mitre_is_subtechnique": false,

    "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",

    "x_mitre_permissions_required": [

        "User",

        "Administrator"

    ],

    "x_mitre_platforms": [

        "Windows"

    ],

    "x_mitre_version": "2.0"

}

get_software_used_by_group

复制代码
 # get software used by G0019

>>> group_stix_id = "intrusion-set--2a158b0a-7ef8-43cb-9985-bf34d1e12050"

>>> software_used_by_g0019 = mitre_attack_data.get_software_used_by_group(group_stix_id)

>>> print(f"Software used by G0019 ({len(software_used_by_g0019)}):")

Software used by G0019 (15):

>>> for s in software_used_by_g0019:

...         software = s["object"]

...         print(f"* {software.name} ({mitre_attack_data.get_attack_id(software.id)})")

...

* ftp (S0095)

* Net (S0039)

* Ping (S0097)

* netsh (S0108)

* Systeminfo (S0096)

* PsExec (S0029)

* Tasklist (S0057)

* WinMM (S0059)

* RainyDay (S0629)

* Nebulae (S0630)

* RARSTONE (S0055)

* HDoor (S0061)

* Sys10 (S0060)

* SslMM (S0058)

* Aria-body (S0456)

>>>
相关推荐
一眼青苔3 分钟前
python环境使用conda,conda如何升级默认的python版本
开发语言·python·conda
橘猫云计算机设计10 分钟前
net+MySQL中小民营企业安全生产管理系统(源码+lw+部署文档+讲解),源码可白嫖!
数据库·后端·爬虫·python·mysql·django·毕业设计
Y1nhl11 分钟前
力扣hot100_链表(3)_python版本
python·算法·leetcode·链表·职场和发展
sduwcgg38 分钟前
kaggle配置
人工智能·python·机器学习
浩浩测试一下1 小时前
SQL注入高级绕过手法汇总 重点
数据库·sql·安全·web安全·网络安全·oracle·安全架构
__lost1 小时前
Python图像变清晰与锐化,调整对比度,高斯滤波除躁,卷积锐化,中值滤波钝化,神经网络变清晰
python·opencv·计算机视觉
海绵波波1071 小时前
玉米产量遥感估产系统的开发实践(持续迭代与更新)
python·flask
谈不譚网安2 小时前
CSRF请求伪造
前端·网络安全·csrf
逢生博客2 小时前
使用 Python 项目管理工具 uv 快速创建 MCP 服务(Cherry Studio、Trae 添加 MCP 服务)
python·sqlite·uv·deepseek·trae·cherry studio·mcp服务
堕落似梦2 小时前
Pydantic增强SQLALchemy序列化(FastAPI直接输出SQLALchemy查询集)
python