Package: aep
Adversary Emulation PlannerThis tool can be used to automatically build an ordered set of attack stages
withMITRE ATT&CKtechniques executed during each stage.The output is a set of attack stages that show all possible techniques that an
adversary might execute during each stage.To decide when the different techniques are to be found in such a set,promisesare used as access tokens for execution of techniques. Each technique defines the set of promises required to execute it (think pre-conditions) and the set of promises it provides upon execution (think post-conditions).InstallationInstall using pip:pipinstallaepYou will also need to clone theaep-datarepository, which contains a starting point witch example data:gitclonehttps://github.com/mnemonic-no/aep-dataUsage/ExamplesIf you have checked out theaep-datarepository you can run
these commands in that repository, since you need access to default dat files.aep-generateis where you should start and the other tools are more useful if you start making changes to the
data itself.Generate Adversary Emulation Plan$aep-generate--end-conditionobjective_exfiltration--include-techniquesT1021,T1046,T1583--technique-bundleincident/UNC2452-Solorigate.json--show-promises
Removed4NOPtechniques:['T1036','T1036.004','T1036.005','T1083']╒═════════╤══════════════════════════════════════════════════════════╤════════════════════════════════════════════╕
│stage│techniques│newpromises@end-of-stage│
╞═════════╪══════════════════════════════════════════════════════════╪════════════════════════════════════════════╡
│1│AcquireInfrastructure│exploit_available│
││DevelopCapabilities│info_domain_trust│
││DevelopCapabilities:Malware│infrastructure_botnet│
││DomainTrustDiscovery│infrastructure_certificate│
││ObtainCapabilities│infrastructure_domain│
││ObtainCapabilities:CodeSigningCertificates│infrastructure_server│
││SupplyChainCompromise│privileges_user_local│
││SupplyChainCompromise:CompromiseSoftwareSupplyChain│tool_available│
│││tool_delivery│
├─────────┼──────────────────────────────────────────────────────────┼────────────────────────────────────────────┤
│2│CommandandScriptingInterpreter│access_filesystem│
││CommandandScriptingInterpreter:PowerShell│code_executed│
││CommandandScriptingInterpreter:WindowsCommandShell│defense_evasion│
││ScheduledTask/Job│file_transfer│
│││persistence│
├─────────┼──────────────────────────────────────────────────────────┼────────────────────────────────────────────┤
│3│AccountDiscovery│access_network│
││ApplicationLayerProtocol│adversary_controlled_communication_channel│
││ApplicationLayerProtocol:WebProtocols│credentials_user_domain│
││ObfuscatedFilesorInformation[*]│credentials_user_local│
││PermissionGroupsDiscovery│credentials_user_thirdparty│
││ProcessDiscovery│info_groupname│
││SignedBinaryProxyExecution[*]│info_process_info│
││SignedBinaryProxyExecution:Rundll32[*]│info_target_employee│
││UnsecuredCredentials│info_username│
││UnsecuredCredentials:PrivateKeys││
├─────────┼──────────────────────────────────────────────────────────┼────────────────────────────────────────────┤
│4│AccountManipulation:AdditionalCloudCredentials[*]│info_cloud_services│
││CloudServiceDiscovery│info_email_address│
││DynamicResolution[*]│info_network_hosts│
││DynamicResolution:DomainGenerationAlgorithms[*]│info_network_services│
││EmailCollection│privileges_system_local│
││EmailCollection:RemoteEmailCollection││
││EventTriggeredExecution││
││IngressToolTransfer[*]││
││NetworkServiceScanning││
││ValidAccounts[*]││
╘═════════╧══════════════════════════════════════════════════════════╧════════════════════════════════════════════╛[*]Techniquedoesnotprovideanynewpromises
FAIL:incompleteattackchain,couldnotachieveendcondition:objective_exfiltrationShow Promise UsageShow little or unused promises.aep-promise-usage
╒══════════════════════════════════════╤════════════╤════════════╕
│promise│provides│requires│
╞══════════════════════════════════════╪════════════╪════════════╡
│info_cloud_hosts│8│0│
├──────────────────────────────────────┼────────────┼────────────┤
│objective_denial_of_service│11│0│
├──────────────────────────────────────┼────────────┼────────────┤
│privileges_users│1│0│
├──────────────────────────────────────┼────────────┼────────────┤
│staged_data│7│0│
├──────────────────────────────────────┼────────────┼────────────┤
│fast_flux│0│0│
├──────────────────────────────────────┼────────────┼────────────┤
│info_network_config│7│0│
├──────────────────────────────────────┼────────────┼────────────┤
│waterhole│0│2│
├──────────────────────────────────────┼────────────┼────────────┤
│info_password_policy│1│0│
├──────────────────────────────────────┼────────────┼────────────┤
│objective_integrity│8│0│
├──────────────────────────────────────┼────────────┼────────────┤
│info_domain_trust│1│0│
├──────────────────────────────────────┼────────────┼────────────┤
│infrastructure_trusted_social_media│6│0│
├──────────────────────────────────────┼────────────┼────────────┤
│info_system_time│1│0│
├──────────────────────────────────────┼────────────┼────────────┤
│credentials_2fa_token│1│0│
├──────────────────────────────────────┼────────────┼────────────┤
│infrastructure_domain│14│0│
├──────────────────────────────────────┼────────────┼────────────┤
│objective_exfiltration│15│0│
├──────────────────────────────────────┼────────────┼────────────┤
│info_cloud_services│8│0│
├──────────────────────────────────────┼────────────┼────────────┤
│objective_destruction│11│0│
├──────────────────────────────────────┼────────────┼────────────┤
│infrastructure_certificate│12│0│
├──────────────────────────────────────┼────────────┼────────────┤
│access_network_intercept│1│0│
├──────────────────────────────────────┼────────────┼────────────┤
│infrastructure_trusted_email_account│6│0│
├──────────────────────────────────────┼────────────┼────────────┤
│objective_resources_computational│1│0│
├──────────────────────────────────────┼────────────┼────────────┤
│objective_extortion│4│0│
├──────────────────────────────────────┼────────────┼────────────┤
│persistence│164│0│
├──────────────────────────────────────┼────────────┼────────────┤
│info_target_information│1│0│
├──────────────────────────────────────┼────────────┼────────────┤
│defense_evasion│97│0│
╘══════════════════════════════════════╧════════════╧════════════╛Show TechniquesShow summary based on MITRE ATT&CK technique ID.aep-technique-tT1001
+++DataObfuscation
╒═════════════════╤════════════════╤═════════════════════╤══════════════════════════════╤════════════════╤════════════════════════╕
│Provides│Requires│Tactic(s)│Relevant│Conditionals│Subtechniques│
╞═════════════════╪════════════════╪═════════════════════╪══════════════════════════════╪════════════════╪════════════════════════╡
│defense_evasion│code_executed│CommandandControl│authentication_server││JunkData│
││tool_available││backup_server││Steganography│
││tool_delivery││client││ProtocolImpersonation│
││││content_management_server│││
││││database_server│││
││││directory_server│││
││││file_server│││
││││instant_messaging_server│││
││││log_server│││
││││login_server│││
││││mail_server│││
││││name_server│││
││││network_firewall│││
││││network_management_server│││
││││network_router│││
││││print_server│││
││││proxy_server│││
││││software_distribution_server│││
││││virtualization_server│││
││││web_server│││
╘═════════════════╧════════════════╧═════════════════════╧══════════════════════════════╧════════════════╧════════════════════════╛Technique bundle summaryaep-bundle-bincident/Ryuk-Bazar-Cobalt-Strike.json(...)Promise summaryaep-promise--promisetool_delivery(...)Search promisesSearch promises based on specified criterias.aep-promise-search--help
usage:aep-promise-search[-h][--config-dirCONFIG_DIR][--data-dirDATA_DIR][--promise-descriptionsPROMISE_DESCRIPTIONS][--conditionsCONDITIONS][--technique-promisesTECHNIQUE_PROMISES][-pPROVIDES][-npNOTPROVIDES][-rREQUIRES][-nrNOTREQUIRES][-nNAME]Searchtechniques

optionalarguments:-h,--helpshowthishelpmessageandexit--config-dirCONFIG_DIRDefaultconfigdirwithconfigurationsforscioandplugins--data-dirDATA_DIRRootdirectoryofdatafiles--promise-descriptionsPROMISE_DESCRIPTIONSPromisedescriptionfile(CSV)--conditionsCONDITIONSConditions(CSV)--technique-promisesTECHNIQUE_PROMISESPathfortechniques.json.Supportsdatarelativetorootdatadirectoryandabsolutepath-pPROVIDES,--providesPROVIDESSearchfortechniquesprovidingthesepromises-npNOTPROVIDES,--notprovidesNOTPROVIDESSearchfortechniquesthatdoes_not_providepromises-rREQUIRES,--requiresREQUIRESSearchfortechniquesrequiresthesepromises-nrNOTREQUIRES,--notrequiresNOTREQUIRESSearchfortechniquesthatdoes_not_requirepromises-nNAME,--nameNAMESearchfortechniqueswhosnamecontainsthisstringConfigurationThis step is not necessary, but can be used to change default settings on the tools. Run with:aep-configuserwhich will create default settings in ~/.config/aep/config.AboutThe Adversary Emulation Planner is developed in the SOCCRATES innovation project (https://soccrates.eu). SOCCRATES has received funding from the European Union’s Horizon 2020 Research and Innovation program under Grant Agreement No. 833481.