Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Rename attacks to initial access #117

Open
kkneomis opened this issue May 10, 2023 · 0 comments
Open

Rename attacks to initial access #117

kkneomis opened this issue May 10, 2023 · 0 comments

Comments

@kkneomis
Copy link
Collaborator

In the configs, we define several "attack types" that are used in the game
These "attacks" define the first actions taken by adversaries that kick off a long chain of events
In realities - "attacks" simply represent initial access vectors".
We should rename them as such and strike to map the yaml definitions as closely as we can the MITRE ATT&CK framework categories.

actor.yaml

attacks:
  - recon:browsing
  - email:malware_delivery

Should be

initial_access:
  - recon:browsing
  - email:malware_delivery

app > server > utils.py

class AttackTypes(Enum):
    """
    An enum to describe types of attacks that cna be conducted by an actor
    """
    PHISHING_VIA_EMAIL              = "email:phishing"
    MALWARE_VIA_EMAIL               = "email:malware_delivery"
    SUPPLY_CHAIN_VIA_EMAIL          = "delivery:supply_chain"
    PASSWORD_SPRAY                  = "identity:password_spray"
    RECONNAISSANCE_VIA_BROWSING     = "recon:browsing"
    MALWARE_VIA_WATERING_HOLE       = "watering_hole:malware_delivery"
    PHISHING_VIA_WATERING_HOLE      = "watering_hole:phishing"

should be

class InitialAccess(Enum):
    """
    An enum to describe initial access vectors that can be conducted by an actor
    """

`app > server > game_functions.py`
```python
        # Send emails
        if AttackTypes.PHISHING_VIA_EMAIL.value in actor.get_attacks()\
        or AttackTypes.MALWARE_VIA_EMAIL.value in actor.get_attacks():
            gen_actor_email(employees,
                      actor, 
                      start_date=current_date
            )

should be

        # Send emails
        if InitialAccess.PHISHING_VIA_EMAIL.value in actor.get_attacks()\
        or InitialAccess.MALWARE_VIA_EMAIL.value in actor.get_attacks():
            gen_actor_email(employees,
                      actor, 
                      start_date=current_date
            )
@kkneomis kkneomis changed the title Rename attack type to initial access Rename attacks to initial access May 10, 2023
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant