pyattck

https://pyattck.readthedocs.io/en/latest/
Admin
pyattck is a Python package that provides programmatic access to MITRE ATT&CK frameworks, enabling...
Tokens:36,056
Snippets:239
Trust Score:9.6
Update:1 month ago
Show doc for...
Tokens:
Raw
### Install pyattck from source

Source: https://pyattck.readthedocs.io/en/latest/_sources/index.md.txt

Clone the pyattck repository and install it from source using setup.py.

```bash
git clone https://github.com/swimlane/pyattck.git
cd pyattck
python setup.py install
```

--------------------------------

### Install pyattck via pip

Source: https://pyattck.readthedocs.io/en/latest/_sources/index.md.txt

Install pyattck on macOS, Linux, or Windows using pip.

```bash
pip install pyattck
```

--------------------------------

### Instantiate Attck object with all configuration parameters

Source: https://pyattck.readthedocs.io/en/latest/_sources/configuration.md.txt

Shows how to create an Attck object with all available configuration parameters, including nested_subtechniques, use_config, save_config, config_file_path, data_path, and various JSON source URLs. By default, pyattck fetches external data via HTTP GET requests from the specified locations. You can override these with local file paths or pass **kwargs to the Requests package.

```python
from pyattck import Attck

attck = Attck(
    nested_subtechniques=True,
    use_config=False,
    save_config=False,
    config_file_path='~/pyattck/config.yml',
    data_path='~/pyattck/data',
    enterprise_attck_json="https://raw.githubusercontent.com/mitre/cti/master/enterprise-attack/enterprise-attack.json",
    pre_attck_json="https://raw.githubusercontent.com/mitre/cti/master/pre-attack/pre-attack.json",
    mobile_attck_json="https://raw.githubusercontent.com/mitre/cti/master/mobile-attack/mobile-attack.json",
    ics_attck_json="https://raw.githubusercontent.com/mitre/cti/master/ics-attack/ics-attack.json",
    nist_controls_json="https://raw.githubusercontent.com/center-for-threat-informed-defense/attack-control-framework-mappings/master/frameworks/ATT%26CK-v9.0/nist800-53-r5/stix/nist800-53-r5-controls.json",
    generated_attck_json="https://swimlane-pyattck.s3.us-west-2.amazonaws.com/generated_attck_data.json",
    generated_nist_json="https://swimlane-pyattck.s3.us-west-2.amazonaws.com/attck_to_nist_controls.json",
    **kwargs
)
```

--------------------------------

### Example structure of generated_attck_data.json

Source: https://pyattck.readthedocs.io/en/latest/_sources/dataset/dataset.md.txt

Shows the base structure of the generated JSON file with a technique entry containing commands, command_list, and parsed_datasets. The data is modified/fake for example purposes.

```json
{
   "last_updated": "2019-12-06T15:21:02.175108", 
   "techniques": [
    {
        "technique_id": "T1082", 
        "commands": [
            {
                "source": "https://attack.mitre.org/docs/APT3_Adversary_Emulation_Field_Manual.xlsx", 
                "command": "whoami /all /fo list", 
                "name": "Built-in Windows Command"
            },
            {
                "source": "atomics/T1033/T1033.yaml", 
                "command": "cmd.exe /C whoami\nwmic useraccount get /ALL\nquser /SERVER:\"computer1\"\nquser\nqwinsta.exe\" /server:computer1\nqwinsta.exe\nfor /F \"tokens=1,2\" %i in ('qwinsta /server:computer1 ^| findstr \"Active Disc\"') do @echo %i | find /v \"#\" | find /v \"console\" || echo %j > usernames.txt\n@FOR /F %n in (computers.txt) DO @FOR /F \"tokens=1,2\" %i in ('qwinsta /server:%n ^| findstr \"Active Disc\"') do @echo %i | find /v \"#\" | find /v \"console\" || echo %j > usernames.txt\n", 
                "name": null
            }
        ],
        "command_list": [
                "ver", 
                "shell ver", 
                "set", 
                "shell set", 
                "get_env.rb", 
                "net config workstation",
                "net config server", 
                "shell net config workstation",
                "reg query HKLM\\SYSTEM\\CurrentControlSet\\Services\\Disk\\Enum"
        ], 
        "parsed_datasets": [
            {
                "Mitre APT3 Adversary Emulation Field Manual": {"Category": "T1033", "Built-in Windows Command": "whoami /all /fo list", "Cobalt Strike": "shell whoami /all /fo list", "Description": "Get current user information, SID, domain, groups the user belongs to, security privs of the user", "Metasploit": "getuid"}
            },

```

--------------------------------

### Accessing Mobile ATT&CK Techniques with pyattck

Source: https://pyattck.readthedocs.io/en/latest/_sources/mobile/mobileattck.md.txt

Shows how to instantiate the Attck class and iterate over mobile techniques, printing individual properties such as id, name, alias, description, stix, and platforms. Use this as a starting point for accessing other object types and their properties.

```python
from pyattck import Attck

attack = Attck()

# accessing techniques and their properties
for technique in attack.mobile.techniques:
	# if you want to return individual properties of this object you call them directly
	print(technique.id)
	print(technique.name)
	print(technique.alias)
	print(technique.description)
	print(technique.stix)
	print(technique.platforms)
	.....
```

--------------------------------

### Iterate enterprise techniques and mitigations

Source: https://pyattck.readthedocs.io/en/latest/pyattck/attck.html

Iterates over enterprise techniques and mitigations, printing their id, name, and description. This example assumes an existing `attck` object and is shown as a basic usage pattern.

```python
for technique in attck.enterprise.techniques:
    print(technique.id)
    print(technique.name)
    print(technique.description)
    # etc.
for mitigation in attck.enterprise.mitigations:
    print(mitigation.id)
    print(mitigation.name)
    print(mitigation.description)
    # etc.
```

--------------------------------

### Prerequisites: Required libraries for pyattck

Source: https://pyattck.readthedocs.io/en/latest/_sources/index.md.txt

Lists the Python libraries that are required and installed by pyattck. These dependencies are automatically installed when you install pyattck.

```text
requests
pendulum>=1.2.3,<1.3
pyfiglet==0.8.post1
PyYaml>=5.4.1
Pillow==8.2.0
fire==0.3.1
```

--------------------------------

### Accessing techniques and their properties

Source: https://pyattck.readthedocs.io/en/latest/_sources/preattck/preattck.md.txt

Shows how to iterate over preattack techniques and print individual properties such as id, name, alias, description, stix, platforms, permissions, and wiki.

```python
from pyattck import Attck

attack = Attck()

# accessing techniques and their properties
for technique in attack.preattack.techniques:
	# if you want to return individual properties of this object you call them directly
	print(technique.id)
	print(technique.name)
	print(technique.alias)
	print(technique.description)
	print(technique.stix)
	print(technique.platforms)
	print(technique.permissions)
	print(technique.wiki)
	.....
```

--------------------------------

### Access ICS techniques and their properties

Source: https://pyattck.readthedocs.io/en/latest/ics/icsattck.html

Shows how to instantiate the Attck class and iterate over ICS techniques, printing individual properties such as id, name, alias, description, stix, platforms, permissions, and wiki.

```python
from pyattck import Attck

attack = Attck()

# accessing techniques and their properties
for technique in attack.ics.techniques:
	# if you want to return individual properties of this object you call them directly
	print(technique.id)
	print(technique.name)
	print(technique.alias)
	print(technique.description)
	print(technique.stix)
	print(technique.platforms)
	print(technique.permissions)
	print(technique.wiki)
	.....

```

--------------------------------

### Attck.__init__()

Source: https://pyattck.readthedocs.io/en/latest/_modules/pyattck/attck.html

Initializes an Attck object, the main entry point for pyattck. It allows specifying nested subtechniques behavior, configuration options, data paths, and URLs for MITRE ATT&CK framework JSON data.

```APIDOC
## Attck.__init__()

### Description
Initializes an Attck object, the main entry point for the pyattck library. It loads MITRE ATT&CK framework data from specified sources and allows customization of subtechnique nesting and configuration.

### Method
Constructor

### Endpoint
Attck()

### Parameters
#### Constructor Parameters
- **nested_subtechniques** (bool, optional) - Whether to iterate over nested subtechniques. Defaults to True.
- **use_config** (bool, optional) - Specifies if a configuration file should be used. Defaults to False.
- **save_config** (bool, optional) - Specifies if pyattck should save a configuration file based on provided values. Defaults to False.
- **config_file_path** (str, optional) - Path to a yaml configuration file containing two key value pairs. Defaults to '~/pyattck/config.yml'.
- **data_path** (str, optional) - Path to store external data locally. Defaults to '~/pyattck/data'.
- **enterprise_attck_json** (str, optional) - URL or local file path to the MITRE ATT&CK JSON file. Defaults to https://raw.githubusercontent.com/mitre/cti/master/enterprise-attack/enterprise-attack.json.
- **pre_attck_json** (str, optional) - URL or local file path to the MITRE Pre-ATT&CK JSON file. Defaults to https://raw.githubusercontent.com/mitre/cti/master/pre-attack/pre-attack.json.
- **mobile_attck_json** (str, optional) - URL or local file path to the MITRE Mobile ATT&CK JSON file. Defaults to https://raw.githubusercontent.com/mitre/cti/master/mobile-attack/mobile-attack.json.
- **ics_attck_json** (str, optional) - URL or local file path to the MITRE ICS ATT&CK JSON file. Defaults to https://raw.githubusercontent.com/mitre/cti/master/ics-attack/ics-attack.json.
- **nist_controls_json** (str, optional) - URL or local file path to the NIST Controls JSON file. Defaults to https://raw.githubusercontent.com/center-for-threat-informed-defense/attack-control-framework-mappings/master/frameworks/ATT%26CK-v9.0/nist800-53-r5/stix/nist800-53-r5-controls.json.
- **generated_attck_json** (str, optional) - URL or local file path to the Generated MITRE ATT&CK JSON file. Defaults to https://swimlane-pyattck.s3.us-west-2.amazonaws.com/generated_attck_data.json.
- **generated_nist_json** (str, optional) - URL or local file path to the Generated NIST Controls Mapping JSON file. Defaults to https://swimlane-pyattck.s3.us-west-2.amazonaws.com/attck_to_nist_controls.json.
- **kwargs** (dict, optional) - Provided kwargs will be passed to any HTTP requests using the Requests library. Defaults to None.

### Returns
- **Attck** - Returns an Attck object that contains all data from MITRE ATT&CK Frameworks.

### Usage Example
```python
attck = Attck()
```

```

--------------------------------

### Build Docker image for pyattck

Source: https://pyattck.readthedocs.io/en/latest/_sources/index.md.txt

Builds the Docker image for the pyattck development environment. Run this command from the repository directory.

```bash
docker build --force-rm -t pyattck .
```

--------------------------------

### Access subtechniques under each technique (default behavior)

Source: https://pyattck.readthedocs.io/en/latest/_sources/pyattck/attck.md.txt

Shows the default behavior where subtechniques are accessible under each technique object. Iterates over enterprise techniques and prints their IDs and names, then iterates over each technique's subtechniques.

```python
from pyattck import Attck

attack = Attck()

for technique in attack.enterprise.techniques:
    print(technique.id)
    print(technique.name)
    for subtechnique in technique.subtechniques:
        print(subtechnique.id)
        print(subtechnique.name)
```

--------------------------------

### Build and run pyattck Docker container

Source: https://pyattck.readthedocs.io/en/latest/index.html

Builds a Docker image named pyattck from the repository directory, then runs the container, which executes the test Python file in bin/test.py.

```bash
docker build --force-rm -t pyattck .
```

```bash
docker run pyattck
```

--------------------------------

### Accessing Enterprise Objects and Relationships

Source: https://pyattck.readthedocs.io/en/latest/enterprise/enterprise.html

Demonstrates how to initialize the Attck class and iterate through enterprise objects to access their properties and related entities such as actors, malware, tools, techniques, mitigations, and tactics.

```python
from pyattck import Attck

attack = Attck()

for actor in attack.enterprise.actors:
    print(actor.id)
    print(actor.name)

    # accessing malware used by an actor or group
    for malware in actor.malwares:
        print(malware.id)
        print(malware.name)

    # accessing tools used by an actor or group
    for tool in actor.tools:
        print(tool.id)
        print(tool.name)

    # accessing techniques used by an actor or group
    for technique in actor.techniques:
        print(technique.id)
        print(technique.name)
        # you can also access generated data sets on aa technique
        print(technique.command_list)
        print(technique.commands)
        print(technique.queries)
        print(technique.datasets)
        print(technique.possible_detections)

# accessing malware
for malware in attack.enterprise.malwares:
    print(malware.id)
    print(malware.name)

    # accessing actor or groups using this malware
    for actor in malware.actors:
        print(actor.id)
        print(actor.name)

    # accessing techniques that this malware is used in
    for technique in malware.techniques:
        print(technique.id)
        print(technique.name)

# accessing mitigation
for mitigation in attack.enterprise.mitigations:
    print(mitigation.id)
    print(mitigation.name)

    # accessing techniques related to mitigation recommendations
    for technique in mitigation.techniques:
        print(technique.id)
        print(technique.name)
        # you can also access generated data sets on aa technique
        print(technique.command_list)
        print(technique.commands)
        print(technique.queries)
        print(technique.datasets)
        print(technique.possible_detections)

# accessing tactics
for tactic in attack.enterprise.tactics:
    print(tactic.id)
    print(tactic.name)

    # accessing techniques related to this tactic
    for technique in tactic.techniques:
        print(technique.id)
        print(technique.name)
        # you can also access generated data sets on aa technique
        print(technique.command_list)
        print(technique.commands)
        print(technique.queries)
        print(technique.datasets)
        print(technique.possible_detections)

# accessing techniques
for technique in attack.enterprise.techniques:
    print(technique.id)
    print(technique.name)
    # you can also access generated data sets on aa technique
    print(technique.command_list)
    print(technique.commands)
    print(technique.queries)
    print(technique.datasets)
    print(technique.possible_detections)

    # accessing tactics that this technique belongs to
    for tactic in technique.tactics:
        print(tactic.id)
        print(tactic.name)

    # accessing mitigation recommendations for this technique
    for mitigation in technique.mitigations:
        print(mitigation.id)
        print(mitigation.name)

    # accessing actors using this technique
    for actor in technique.actors:
        print(actor.id)
        print(actor.name)

# accessing tools
for tool in attack.enterprise.tools:
    print(tool.id)
    print(tool.name)

    # accessing techniques this tool is used in
    for technique in tool.techniques:
        print(technique.id)
        print(technique.name)
        # you can also access generated data sets on aa technique
        print(technique.command_list)
        print(technique.commands)
        print(technique.queries)
        print(technique.datasets)
        print(technique.possible_detections)

    # accessing actor or groups using this tool
    for actor in tool.actors:
        print(actor.id)
        print(actor.name)
```

--------------------------------

### Attck.__init__

Source: https://pyattck.readthedocs.io/en/latest/_modules/pyattck/attck.html

Constructor for the Attck class. Initializes configuration options for data paths, JSON sources, and request kwargs.

```APIDOC
## Attck.__init__

### Description
Initializes the Attck object with configuration options for nested subtechniques, configuration file usage, data paths, and URLs to MITRE ATT&CK JSON files.

### Method
Constructor

### Parameters
- **nested_subtechniques** (bool, optional) - Whether to iterate over nested subtechniques. Defaults to True.
- **use_config** (bool, optional) - Specifies if a configuration file should be used. Defaults to False.
- **save_config** (bool, optional) - Specifies if pyattck should save a configuration file based on provided values. Defaults to False.
- **config_file_path** (str, optional) - Path to a yaml configuration file. Defaults to '~/pyattck/config.yml'.
- **data_path** (str, optional) - Path to store external data locally. Defaults to '~/pyattck/data'.
- **enterprise_attck_json** (str, optional) - URL or local file path to the MITRE ATT&CK JSON file. Defaults to https://raw.githubusercontent.com/mitre/cti/master/enterprise-attack/enterprise-attack.json.
- **pre_attck_json** (str, optional) - URL or local file path to the MITRE Pre-ATT&CK JSON file. Defaults to https://raw.githubusercontent.com/mitre/cti/master/pre-attack/pre-attack.json.
- **mobile_attck_json** (str, optional) - URL or local file path to the MITRE Mobile ATT&CK JSON file. Defaults to https://raw.githubusercontent.com/mitre/cti/master/mobile-attack/mobile-attack.json.
- **ics_attck_json** (str, optional) - URL or local file path to the MITRE ICS ATT&CK JSON file. Defaults to https://raw.githubusercontent.com/mitre/cti/master/ics-attack/ics-attack.json.
- **nist_controls_json** (str, optional) - URL or local file path to the NIST Controls JSON file. Defaults to https://raw.githubusercontent.com/center-for-threat-informed-defense/attack-control-framework-mappings/master/frameworks/ATT%26CK-v9.0/nist800-53-r5/stix/nist800-53-r5-controls.json.
- **generated_attck_json** (str, optional) - URL or local file path to the Generated MITRE ATT&CK JSON file. Defaults to https://swimlane-pyattck.s3.us-west-2.amazonaws.com/generated_attck_data.json.
- **generated_nist_json** (str, optional) - URL or local file path to the Generated NIST Controls Mapping JSON file. Defaults to https://swimlane-pyattck.s3.us-west-2.amazonaws.com/attck_to_nist_controls.json.
- **kwargs** (dict, optional) - Provided kwargs will be passed to any HTTP requests using the Requests library. Defaults to None.

### Returns
None
```

--------------------------------

### Attck()

Source: https://pyattck.readthedocs.io/en/latest/pyattck/attck.html

Initializes the Attck object with optional configuration parameters. This is the main entry point to access MITRE ATT&CK data.

```APIDOC
## Attck()

### Description
Initializes the Attck object with optional configuration parameters. This is the main entry point to access MITRE ATT&CK data.

### Method
Constructor

### Parameters
- **nested_subtechniques** (bool, optional) - Whether not to iterate over nested subtechniques. Defaults to True.
- **use_config** (bool, optional) - Specifies if a configuration file should be used or not. Defaults to False.
- **save_config** (bool, optional) - Specifies if pyattck should save a configuration file based on the provided values. Defaults to False.
- **config_file_path** (str, optional) - Path to a yaml configuration file which contains two key value pairs. Defaults to '~/pyattck/config.yml'.
- **data_path** (str, optional) - Path to store the external data locally on your system. Defaults to '~/pyattck/data'.
- **enterprise_attck_json** (str, optional) - A URL or local file path to the MITRE ATT&CK Json file. Defaults to https://raw.githubusercontent.com/mitre/cti/master/enterprise-attack/enterprise-attack.json.
- **pre_attck_json** (str, optional) - A URL or local file path to the MITRE Pre-ATT&CK Json file. Defaults to https://raw.githubusercontent.com/mitre/cti/master/pre-attack/pre-attack.json.
- **mobile_attck_json** (str, optional) - A URL or local file path to the MITRE Mobile ATT&CK Json file. Defaults to https://raw.githubusercontent.com/mitre/cti/master/mobile-attack/mobile-attack.json.
- **ics_attck_json** (str, optional) - A URL or local file path to the MITRE ICS ATT&CK JSON file. Defaults to https://raw.githubusercontent.com/mitre/cti/master/ics-attack/ics-attack.json.
- **nist_controls_json** (str, optional) - A URL or local file path to the NIST Controls Json file. Defaults to https://raw.githubusercontent.com/center-for-threat-informed-defense/attack-control-framework-mappings/master/frameworks/ATT%26CK-v9.0/nist800-53-r5/stix/nist800-53-r5-controls.json.
- **generated_attck_json** (str, optional) - A URL or local file path to the Generated MITRE ATT&CK Json file. Defaults to https://swimlane-pyattck.s3.us-west-2.amazonaws.com/generated_attck_data.json.
- **generated_nist_json** (str, optional) - A URL or local file path to the Generated NIST Controls Mapping Json file. Defaults to https://swimlane-pyattck.s3.us-west-2.amazonaws.com/attck_to_nist_controls.json.
- **kwargs** (dict, optional) - Provided kwargs will be passed to any HTTP requests using the Requests library. Defaults to None.

### Returns
- **Attck** - Returns an Attck object that contains all data from MITRE ATT&CK Frameworks.

### Example
```python
from pyattck import Attck

attck = Attck()
```
```

--------------------------------

### Instantiate Attck object

Source: https://pyattck.readthedocs.io/en/latest/_sources/index.md.txt

Instantiate an Attck object to access MITRE ATT&CK data. This is the required first step for using pyattck.

```python
from pyattck import Attck

attack = Attck()
```

--------------------------------

### Accessing ICS techniques and their properties

Source: https://pyattck.readthedocs.io/en/latest/_sources/ics/icsattck.md.txt

Shows how to iterate over techniques in the ICS framework and access individual properties like id, name, alias, description, stix, platforms, permissions, and wiki.

```python
from pyattck import Attck

attack = Attck()

# accessing techniques and their properties
for technique in attack.ics.techniques:
	# if you want to return individual properties of this object you call them directly
	print(technique.id)
	print(technique.name)
	print(technique.alias)
	print(technique.description)
	print(technique.stix)
	print(technique.platforms)
	print(technique.permissions)
	print(technique.wiki)
	.....
```

--------------------------------

### Run pyattck Docker container

Source: https://pyattck.readthedocs.io/en/latest/_sources/index.md.txt

Runs the Docker container, which executes the test Python file in bin/test.py.

```bash
docker run pyattck
```

--------------------------------

### Accessing actors, tactics, and techniques with relationships

Source: https://pyattck.readthedocs.io/en/latest/_sources/preattck/preattck.md.txt

Shows how to iterate over actors, tactics, and techniques, and access related objects such as techniques used by actors, techniques in tactics, and tactics/actors for techniques.

```python
from pyattck import Attck

attack = Attck()

for actor in attack.preattack.actors:
    print(actor.id)
    print(actor.name)

    # accessing techniques used by an actor or group
    for technique in actor.techniques:
        print(technique.id)
        print(technique.name)

# accessing tactics
for tactic in attack.preattack.tactics:
    print(tactic.id)
    print(tactic.name)

    # accessing techniques related to this tactic
    for technique in tactic.techniques:
        print(technique.id)
        print(technique.name)

# accessing techniques
for technique in attack.preattack.techniques:
    print(technique.id)
    print(technique.name)

    # accessing tactics that this technique belongs to
    for tactic in technique.tactics:
        print(tactic.id)
        print(tactic.name)

    # accessing actors using this technique
    for actor in technique.actors:
        print(actor.id)
        print(actor.name)
```
Tokens:
Raw