Package: pyattck-dev
Welcome to pyattck's Documentation.______   ____    ____  ___   .___________.___________.  ______  __  ___
    |   _  \  \   \  /   / /   \  |           |           | /      ||  |/  /
    |  |_)  |  \   \/   / /  ^  \ `---|  |----`---|  |----`|  ,----'|  '  /
    |   ___/    \_    _/ /  /_\  \    |  |        |  |     |  |     |    <
    |  |          |  |  /  _____  \   |  |        |  |     |  `----.|  .  \
    | _|          |__| /__/     \__\  |__|        |__|      \______||__|\__\A Python package to interact with MITRE ATT&CK FrameworksCurrent Version is 4.0.0pyattckis a light-weight framework for MITRE ATT&CK Frameworks. This package extracts details from the MITRE Enterprise, PRE-ATT&CK, and Mobile Frameworks.FeaturesThepyattckpackage retrieves all Tactics, Techniques, Actors, Malware, Tools, and Mitigations from the MITRE ATT&CK Frameworks as well as any defined relationships within the MITRE ATT&CK dataset.In addition, Techniques, Actors, and Tools (if applicable) now have collected data from third-party resources that are accessible via properties on a technique. For more detailed information about these features, seeExternal Datasets.Thepyattckpackage allows you to:Specify a URL or local file path for the MITRE ATT&CK Enterprise Framework json, generated dataset, and/or a config.yml file.Retrieve an image_logo of an actor (when available). If an image_logo isn't available, it generates an ascii_logo.Search the external dataset for external commands that are similar usingsearch_commands.Access data from the MITRE PRE-ATT&CK FrameworkAccess data from the MITRE Mobile ATT&CK FrameworkAccess subtechniques as nested objects or you can turn it off and access as normal techniqueAccess compliance controls (currently NIST 800-53) related to a MITRE ATT&CK TechniqueTable of ContentsInstallationUsage ExampleConfigurationNotesInstallationYou can installpyattackon OS X, Linux, or Windows. You can also install it directly from the source. To install, see the commands under the relevant operating system heading, below.PrerequisitesThe following libraries are required and installed by pyattck:requests
pendulum>=1.2.3,<1.3
pyfiglet==0.8.post1
PyYaml>=5.4.1
Pillow==8.2.0
fire==0.3.1macOS, Linux and Windows:pipinstallpyattckInstalling from sourcegitclonehttps://github.com/swimlane/pyattck.gitcdpyattck
pythonsetup.pyinstallUsage exampleTo usepyattckyou must instantiate anAttckobject. Although you can interact directly with each class, the intended use is through aAttckobject:frompyattckimportAttckattack=Attck()By default,subtechniquesare accessible under each technique object. You can turn this behavior off by passingnested_subtechniques=Falsewhen creating yourAttckobject.As an example, the default behavior looks like the following example:frompyattckimportAttckattack=Attck()fortechniqueinattack.enterprise.techniques:print(technique.id)print(technique.name)forsubtechniqueintechnique.subtechniques:print(subtechnique.id)print(subtechnique.name)You can access the followingmainproperties on yourAttckobject:enterprisepreattackmobileOnce you specify the MITRE ATT&CK Framework, you can access additional properties.Here are the accessible objects under theEnterpriseproperty:actorscontrolsmalwaresmitigationstacticstechniquestoolsFor more information on object types under theenterpriseproperty, seeEnterprise.Here are the accessible objects under thePreAttckproperty:actorstacticstechniquesFor more information on object types under thepreattckproperty, seePreAttck.Here are the accessible objects under theMobileproperty:actorsmalwaresmitigationstacticstechniquestoolsFor more information on object types under themobileproperty, seeMobile.Configurationpyattckallows you to configure if you store external data and where it is stored.frompyattckimportAttckattck=Attck(nested_subtechniques=True,use_config=False,save_config=False,config_file_path='~/pyattck/config.yml',data_path='~/pyattck/data',enterprise_attck_json="https://raw.githubusercontent.com/mitre/cti/master/enterprise-attack/enterprise-attack.json",pre_attck_json="https://raw.githubusercontent.com/mitre/cti/master/pre-attack/pre-attack.json",mobile_attck_json="https://raw.githubusercontent.com/mitre/cti/master/mobile-attack/mobile-attack.json",nist_controls_json="https://raw.githubusercontent.com/center-for-threat-informed-defense/attack-control-framework-mappings/master/frameworks/nist800-53-r4/stix/nist800-53-r4-controls.json",generated_attck_json="https://github.com/swimlane/pyattck/blob/master/generated_attck_data.json?raw=True",generated_nist_json="https://github.com/swimlane/pyattck/blob/master/attck_to_nist_controls.json?raw=True",**kwargs)By default,pyattckwill (now) pull the latest external data from their respective locations using HTTP GET requests.pyattckcurrently pulls from the following locations:enterprise_attck_json="https://raw.githubusercontent.com/mitre/cti/master/enterprise-attack/enterprise-attack.json"pre_attck_json="https://raw.githubusercontent.com/mitre/cti/master/pre-attack/pre-attack.json"mobile_attck_json="https://raw.githubusercontent.com/mitre/cti/master/mobile-attack/mobile-attack.json"nist_controls_json="https://raw.githubusercontent.com/center-for-threat-informed-defense/attack-control-framework-mappings/master/frameworks/nist800-53-r4/stix/nist800-53-r4-controls.json"generated_attck_json="https://github.com/swimlane/pyattck/blob/master/generated_attck_data.json?raw=True"generated_nist_json="https://github.com/swimlane/pyattck/blob/master/attck_to_nist_controls.json?raw=True"You have several options when instantiating theAttckobject. As of4.0.0you can now specify any of the following options:use_config - When you specify this argument asTruepyattck will attempt to retrieve the configuration specified in theconfig_file_pathlocation. If this file is corrupted or cannot be found, we will default to retrieving data from the specified*_attck_jsonlocations.save_config - When you specify this argument asTruepyattck will save the configuration file to the specified location set byconfig_file_path. Additionally, we will save all downloaded files to thedata_pathlocation specified. If you have specified a local path location instead of a download URL for any of the*_attck_jsonparameters we will save this location in our configuration and reference this location going forward.config_file_path - The path to store a configuration file. Default is~/pyattck/config.ymldata_path - The path to store any data files downloaded to the local system. Default is~/pyattck/dataJSON LocationsAdditionally, you can specify the location for each individual*_attck_jsonfiles by passing in either a URI or a local file path. If you have passed in a local file path, we will simply read from this file.If you have used the default values or specified an alternative URI location to retrieve these JSON files from, you can additionally pass in**kwargsthat will be passed along to theRequestspython package when performing any HTTP requests.NoteWe understand that there are many different open-source projects being released, even on a daily basis, but we wanted to provide a straightforward Python package that allowed the user to identify known relationships between all verticals of the MITRE ATT&CK Framework.If you are unfamiliar with the MITRE ATT&CK Framework, there are a few key components to ensure you have a firm grasp around. The first is Tactics & Techniques. When looking at theMITRE ATT&CK Framework, the Tactics are the columns and represent the different phases of an attack.The MITRE ATT&CK Framework is NOT an all encompassing/defacto security coverage map - it is rather a FRAMEWORK and additional avenues should also be considered when assessing your security posture.Techniques are the rows of the framework and are categorized underneath specific Tactics (columns). They are data points within the framework that provides guidance when assessing your security gaps. Additionally, (most) Techniques contain mitigation guidance in addition to information about their relationship to tools, malware, and even actors/groups that have used this technique during recorded attacks.This means, if your organization is focused on TTPs (Tactics Techniques and Procedures) used by certain actors/groups then MITRE ATT&CK Framework is perfect for you. If you are not at this security maturing within your organization, no worries! The ATT&CK Framework still provides really good guidance in a simple and straightforward layout, but programmatically it is not straightforward--especially if you wanted to measure (or map) your security controls using the framework.Developing and TestingYou can add features or bugs or run the code in a development environment.To get a development and testing environment up and running, use thisDockerfile.To use theDockerfilerun, cd to this repository directory and run:docker build --force-rm -t pyattck .Next, run the docker container:docker run pyattckRunning this calls the test python file inbin/test.py.Modify the test python file for additional testing and development.Running the testsTests within this project should cover all available properties and methods. As this project grows the tests will become more robust but for now we are testing that they exist and return outputs.ContributingPlease readCONTRIBUTING.mdfor details on our code of conduct, and the process for submitting pull requests to us.VersioningWe useSemVerfor versioning.Change LogFor details on features for a specific version ofpyattck, see theCHANGELOG.md.AuthorsJosh Rickard -Initial work-MSAdministratorSee also the list ofcontributors.LicenseThis project is licensed under theMIT License.AcknowledgmentsFirst of all, I would like to thank everyone who contributes to open-source projects, especially the maintainers and creators of these projects. Without them, this capability would not be possible.This data set is generated from many different sources. As we continue to add more sources, we will continue to add them here. Again thank you to all of these projects. In no particular order,pyattckutilizes data from the following projects:Mitre ATT&CK APT3 Adversary Emulation Field ManualAtomic Red Team (by Red Canary)Atomic Threat Coverageattck_empire (by dstepanic)sentinel-attack (by BlueTeamLabs)Litmus_test (by Kirtar22)nsm-attack (by oxtf)osquery-attck (by teoseller)Mitre StockpileSysmonHunter (by baronpan)ThreatHunting-Book (by 12306Bro)threat_hunting_tables (by dwestgard)APT Groups & OperationsC2Matrix (by @jorgeorchilles, @brysonbort, @adam_mashinchi)ElementalMalwareArchaeology - ATTACKAttack-Technique-Dataset.. toctree::
   :titlesonly:

   configuration
   pyattck/attck
   dataset/dataset
   enterprise/enterprise
   preattck/preattck
   mobile/mobileattck