### Install pyattck from source Source: https://pyattck.readthedocs.io/en/latest/_sources/index.md.txt Clone the pyattck repository and install it from source using setup.py. ```bash git clone https://github.com/swimlane/pyattck.git cd pyattck python setup.py install ``` -------------------------------- ### Install pyattck via pip Source: https://pyattck.readthedocs.io/en/latest/_sources/index.md.txt Install pyattck on macOS, Linux, or Windows using pip. ```bash pip install pyattck ``` -------------------------------- ### Instantiate Attck object with all configuration parameters Source: https://pyattck.readthedocs.io/en/latest/_sources/configuration.md.txt Shows how to create an Attck object with all available configuration parameters, including nested_subtechniques, use_config, save_config, config_file_path, data_path, and various JSON source URLs. By default, pyattck fetches external data via HTTP GET requests from the specified locations. You can override these with local file paths or pass **kwargs to the Requests package. ```python from pyattck import Attck attck = Attck( nested_subtechniques=True, use_config=False, save_config=False, config_file_path='~/pyattck/config.yml', data_path='~/pyattck/data', enterprise_attck_json="https://raw.githubusercontent.com/mitre/cti/master/enterprise-attack/enterprise-attack.json", pre_attck_json="https://raw.githubusercontent.com/mitre/cti/master/pre-attack/pre-attack.json", mobile_attck_json="https://raw.githubusercontent.com/mitre/cti/master/mobile-attack/mobile-attack.json", ics_attck_json="https://raw.githubusercontent.com/mitre/cti/master/ics-attack/ics-attack.json", nist_controls_json="https://raw.githubusercontent.com/center-for-threat-informed-defense/attack-control-framework-mappings/master/frameworks/ATT%26CK-v9.0/nist800-53-r5/stix/nist800-53-r5-controls.json", generated_attck_json="https://swimlane-pyattck.s3.us-west-2.amazonaws.com/generated_attck_data.json", generated_nist_json="https://swimlane-pyattck.s3.us-west-2.amazonaws.com/attck_to_nist_controls.json", **kwargs ) ``` -------------------------------- ### Example structure of generated_attck_data.json Source: https://pyattck.readthedocs.io/en/latest/_sources/dataset/dataset.md.txt Shows the base structure of the generated JSON file with a technique entry containing commands, command_list, and parsed_datasets. The data is modified/fake for example purposes. ```json { "last_updated": "2019-12-06T15:21:02.175108", "techniques": [ { "technique_id": "T1082", "commands": [ { "source": "https://attack.mitre.org/docs/APT3_Adversary_Emulation_Field_Manual.xlsx", "command": "whoami /all /fo list", "name": "Built-in Windows Command" }, { "source": "atomics/T1033/T1033.yaml", "command": "cmd.exe /C whoami\nwmic useraccount get /ALL\nquser /SERVER:\"computer1\"\nquser\nqwinsta.exe\" /server:computer1\nqwinsta.exe\nfor /F \"tokens=1,2\" %i in ('qwinsta /server:computer1 ^| findstr \"Active Disc\"') do @echo %i | find /v \"#\" | find /v \"console\" || echo %j > usernames.txt\n@FOR /F %n in (computers.txt) DO @FOR /F \"tokens=1,2\" %i in ('qwinsta /server:%n ^| findstr \"Active Disc\"') do @echo %i | find /v \"#\" | find /v \"console\" || echo %j > usernames.txt\n", "name": null } ], "command_list": [ "ver", "shell ver", "set", "shell set", "get_env.rb", "net config workstation", "net config server", "shell net config workstation", "reg query HKLM\\SYSTEM\\CurrentControlSet\\Services\\Disk\\Enum" ], "parsed_datasets": [ { "Mitre APT3 Adversary Emulation Field Manual": {"Category": "T1033", "Built-in Windows Command": "whoami /all /fo list", "Cobalt Strike": "shell whoami /all /fo list", "Description": "Get current user information, SID, domain, groups the user belongs to, security privs of the user", "Metasploit": "getuid"} }, ``` -------------------------------- ### Accessing Mobile ATT&CK Techniques with pyattck Source: https://pyattck.readthedocs.io/en/latest/_sources/mobile/mobileattck.md.txt Shows how to instantiate the Attck class and iterate over mobile techniques, printing individual properties such as id, name, alias, description, stix, and platforms. Use this as a starting point for accessing other object types and their properties. ```python from pyattck import Attck attack = Attck() # accessing techniques and their properties for technique in attack.mobile.techniques: # if you want to return individual properties of this object you call them directly print(technique.id) print(technique.name) print(technique.alias) print(technique.description) print(technique.stix) print(technique.platforms) ..... ``` -------------------------------- ### Prerequisites: Required libraries for pyattck Source: https://pyattck.readthedocs.io/en/latest/_sources/index.md.txt Lists the Python libraries that are required and installed by pyattck. These dependencies are automatically installed when you install pyattck. ```text requests pendulum>=1.2.3,<1.3 pyfiglet==0.8.post1 PyYaml>=5.4.1 Pillow==8.2.0 fire==0.3.1 ``` -------------------------------- ### Iterate enterprise techniques and mitigations Source: https://pyattck.readthedocs.io/en/latest/pyattck/attck.html Iterates over enterprise techniques and mitigations, printing their id, name, and description. This example assumes an existing `attck` object and is shown as a basic usage pattern. ```python for technique in attck.enterprise.techniques: print(technique.id) print(technique.name) print(technique.description) # etc. for mitigation in attck.enterprise.mitigations: print(mitigation.id) print(mitigation.name) print(mitigation.description) # etc. ``` -------------------------------- ### Accessing techniques and their properties Source: https://pyattck.readthedocs.io/en/latest/_sources/preattck/preattck.md.txt Shows how to iterate over preattack techniques and print individual properties such as id, name, alias, description, stix, platforms, permissions, and wiki. ```python from pyattck import Attck attack = Attck() # accessing techniques and their properties for technique in attack.preattack.techniques: # if you want to return individual properties of this object you call them directly print(technique.id) print(technique.name) print(technique.alias) print(technique.description) print(technique.stix) print(technique.platforms) print(technique.permissions) print(technique.wiki) ..... ``` -------------------------------- ### Access ICS techniques and their properties Source: https://pyattck.readthedocs.io/en/latest/ics/icsattck.html Shows how to instantiate the Attck class and iterate over ICS techniques, printing individual properties such as id, name, alias, description, stix, platforms, permissions, and wiki. ```python from pyattck import Attck attack = Attck() # accessing techniques and their properties for technique in attack.ics.techniques: # if you want to return individual properties of this object you call them directly print(technique.id) print(technique.name) print(technique.alias) print(technique.description) print(technique.stix) print(technique.platforms) print(technique.permissions) print(technique.wiki) ..... ``` -------------------------------- ### Attck.__init__() Source: https://pyattck.readthedocs.io/en/latest/_modules/pyattck/attck.html Initializes an Attck object, the main entry point for pyattck. It allows specifying nested subtechniques behavior, configuration options, data paths, and URLs for MITRE ATT&CK framework JSON data. ```APIDOC ## Attck.__init__() ### Description Initializes an Attck object, the main entry point for the pyattck library. It loads MITRE ATT&CK framework data from specified sources and allows customization of subtechnique nesting and configuration. ### Method Constructor ### Endpoint Attck() ### Parameters #### Constructor Parameters - **nested_subtechniques** (bool, optional) - Whether to iterate over nested subtechniques. Defaults to True. - **use_config** (bool, optional) - Specifies if a configuration file should be used. Defaults to False. - **save_config** (bool, optional) - Specifies if pyattck should save a configuration file based on provided values. Defaults to False. - **config_file_path** (str, optional) - Path to a yaml configuration file containing two key value pairs. Defaults to '~/pyattck/config.yml'. - **data_path** (str, optional) - Path to store external data locally. Defaults to '~/pyattck/data'. - **enterprise_attck_json** (str, optional) - URL or local file path to the MITRE ATT&CK JSON file. Defaults to https://raw.githubusercontent.com/mitre/cti/master/enterprise-attack/enterprise-attack.json. - **pre_attck_json** (str, optional) - URL or local file path to the MITRE Pre-ATT&CK JSON file. Defaults to https://raw.githubusercontent.com/mitre/cti/master/pre-attack/pre-attack.json. - **mobile_attck_json** (str, optional) - URL or local file path to the MITRE Mobile ATT&CK JSON file. Defaults to https://raw.githubusercontent.com/mitre/cti/master/mobile-attack/mobile-attack.json. - **ics_attck_json** (str, optional) - URL or local file path to the MITRE ICS ATT&CK JSON file. Defaults to https://raw.githubusercontent.com/mitre/cti/master/ics-attack/ics-attack.json. - **nist_controls_json** (str, optional) - URL or local file path to the NIST Controls JSON file. Defaults to https://raw.githubusercontent.com/center-for-threat-informed-defense/attack-control-framework-mappings/master/frameworks/ATT%26CK-v9.0/nist800-53-r5/stix/nist800-53-r5-controls.json. - **generated_attck_json** (str, optional) - URL or local file path to the Generated MITRE ATT&CK JSON file. Defaults to https://swimlane-pyattck.s3.us-west-2.amazonaws.com/generated_attck_data.json. - **generated_nist_json** (str, optional) - URL or local file path to the Generated NIST Controls Mapping JSON file. Defaults to https://swimlane-pyattck.s3.us-west-2.amazonaws.com/attck_to_nist_controls.json. - **kwargs** (dict, optional) - Provided kwargs will be passed to any HTTP requests using the Requests library. Defaults to None. ### Returns - **Attck** - Returns an Attck object that contains all data from MITRE ATT&CK Frameworks. ### Usage Example ```python attck = Attck() ``` ``` -------------------------------- ### Build Docker image for pyattck Source: https://pyattck.readthedocs.io/en/latest/_sources/index.md.txt Builds the Docker image for the pyattck development environment. Run this command from the repository directory. ```bash docker build --force-rm -t pyattck . ``` -------------------------------- ### Access subtechniques under each technique (default behavior) Source: https://pyattck.readthedocs.io/en/latest/_sources/pyattck/attck.md.txt Shows the default behavior where subtechniques are accessible under each technique object. Iterates over enterprise techniques and prints their IDs and names, then iterates over each technique's subtechniques. ```python from pyattck import Attck attack = Attck() for technique in attack.enterprise.techniques: print(technique.id) print(technique.name) for subtechnique in technique.subtechniques: print(subtechnique.id) print(subtechnique.name) ``` -------------------------------- ### Build and run pyattck Docker container Source: https://pyattck.readthedocs.io/en/latest/index.html Builds a Docker image named pyattck from the repository directory, then runs the container, which executes the test Python file in bin/test.py. ```bash docker build --force-rm -t pyattck . ``` ```bash docker run pyattck ``` -------------------------------- ### Accessing Enterprise Objects and Relationships Source: https://pyattck.readthedocs.io/en/latest/enterprise/enterprise.html Demonstrates how to initialize the Attck class and iterate through enterprise objects to access their properties and related entities such as actors, malware, tools, techniques, mitigations, and tactics. ```python from pyattck import Attck attack = Attck() for actor in attack.enterprise.actors: print(actor.id) print(actor.name) # accessing malware used by an actor or group for malware in actor.malwares: print(malware.id) print(malware.name) # accessing tools used by an actor or group for tool in actor.tools: print(tool.id) print(tool.name) # accessing techniques used by an actor or group for technique in actor.techniques: print(technique.id) print(technique.name) # you can also access generated data sets on aa technique print(technique.command_list) print(technique.commands) print(technique.queries) print(technique.datasets) print(technique.possible_detections) # accessing malware for malware in attack.enterprise.malwares: print(malware.id) print(malware.name) # accessing actor or groups using this malware for actor in malware.actors: print(actor.id) print(actor.name) # accessing techniques that this malware is used in for technique in malware.techniques: print(technique.id) print(technique.name) # accessing mitigation for mitigation in attack.enterprise.mitigations: print(mitigation.id) print(mitigation.name) # accessing techniques related to mitigation recommendations for technique in mitigation.techniques: print(technique.id) print(technique.name) # you can also access generated data sets on aa technique print(technique.command_list) print(technique.commands) print(technique.queries) print(technique.datasets) print(technique.possible_detections) # accessing tactics for tactic in attack.enterprise.tactics: print(tactic.id) print(tactic.name) # accessing techniques related to this tactic for technique in tactic.techniques: print(technique.id) print(technique.name) # you can also access generated data sets on aa technique print(technique.command_list) print(technique.commands) print(technique.queries) print(technique.datasets) print(technique.possible_detections) # accessing techniques for technique in attack.enterprise.techniques: print(technique.id) print(technique.name) # you can also access generated data sets on aa technique print(technique.command_list) print(technique.commands) print(technique.queries) print(technique.datasets) print(technique.possible_detections) # accessing tactics that this technique belongs to for tactic in technique.tactics: print(tactic.id) print(tactic.name) # accessing mitigation recommendations for this technique for mitigation in technique.mitigations: print(mitigation.id) print(mitigation.name) # accessing actors using this technique for actor in technique.actors: print(actor.id) print(actor.name) # accessing tools for tool in attack.enterprise.tools: print(tool.id) print(tool.name) # accessing techniques this tool is used in for technique in tool.techniques: print(technique.id) print(technique.name) # you can also access generated data sets on aa technique print(technique.command_list) print(technique.commands) print(technique.queries) print(technique.datasets) print(technique.possible_detections) # accessing actor or groups using this tool for actor in tool.actors: print(actor.id) print(actor.name) ``` -------------------------------- ### Attck.__init__ Source: https://pyattck.readthedocs.io/en/latest/_modules/pyattck/attck.html Constructor for the Attck class. Initializes configuration options for data paths, JSON sources, and request kwargs. ```APIDOC ## Attck.__init__ ### Description Initializes the Attck object with configuration options for nested subtechniques, configuration file usage, data paths, and URLs to MITRE ATT&CK JSON files. ### Method Constructor ### Parameters - **nested_subtechniques** (bool, optional) - Whether to iterate over nested subtechniques. Defaults to True. - **use_config** (bool, optional) - Specifies if a configuration file should be used. Defaults to False. - **save_config** (bool, optional) - Specifies if pyattck should save a configuration file based on provided values. Defaults to False. - **config_file_path** (str, optional) - Path to a yaml configuration file. Defaults to '~/pyattck/config.yml'. - **data_path** (str, optional) - Path to store external data locally. Defaults to '~/pyattck/data'. - **enterprise_attck_json** (str, optional) - URL or local file path to the MITRE ATT&CK JSON file. Defaults to https://raw.githubusercontent.com/mitre/cti/master/enterprise-attack/enterprise-attack.json. - **pre_attck_json** (str, optional) - URL or local file path to the MITRE Pre-ATT&CK JSON file. Defaults to https://raw.githubusercontent.com/mitre/cti/master/pre-attack/pre-attack.json. - **mobile_attck_json** (str, optional) - URL or local file path to the MITRE Mobile ATT&CK JSON file. Defaults to https://raw.githubusercontent.com/mitre/cti/master/mobile-attack/mobile-attack.json. - **ics_attck_json** (str, optional) - URL or local file path to the MITRE ICS ATT&CK JSON file. Defaults to https://raw.githubusercontent.com/mitre/cti/master/ics-attack/ics-attack.json. - **nist_controls_json** (str, optional) - URL or local file path to the NIST Controls JSON file. Defaults to https://raw.githubusercontent.com/center-for-threat-informed-defense/attack-control-framework-mappings/master/frameworks/ATT%26CK-v9.0/nist800-53-r5/stix/nist800-53-r5-controls.json. - **generated_attck_json** (str, optional) - URL or local file path to the Generated MITRE ATT&CK JSON file. Defaults to https://swimlane-pyattck.s3.us-west-2.amazonaws.com/generated_attck_data.json. - **generated_nist_json** (str, optional) - URL or local file path to the Generated NIST Controls Mapping JSON file. Defaults to https://swimlane-pyattck.s3.us-west-2.amazonaws.com/attck_to_nist_controls.json. - **kwargs** (dict, optional) - Provided kwargs will be passed to any HTTP requests using the Requests library. Defaults to None. ### Returns None ``` -------------------------------- ### Attck() Source: https://pyattck.readthedocs.io/en/latest/pyattck/attck.html Initializes the Attck object with optional configuration parameters. This is the main entry point to access MITRE ATT&CK data. ```APIDOC ## Attck() ### Description Initializes the Attck object with optional configuration parameters. This is the main entry point to access MITRE ATT&CK data. ### Method Constructor ### Parameters - **nested_subtechniques** (bool, optional) - Whether not to iterate over nested subtechniques. Defaults to True. - **use_config** (bool, optional) - Specifies if a configuration file should be used or not. Defaults to False. - **save_config** (bool, optional) - Specifies if pyattck should save a configuration file based on the provided values. Defaults to False. - **config_file_path** (str, optional) - Path to a yaml configuration file which contains two key value pairs. Defaults to '~/pyattck/config.yml'. - **data_path** (str, optional) - Path to store the external data locally on your system. Defaults to '~/pyattck/data'. - **enterprise_attck_json** (str, optional) - A URL or local file path to the MITRE ATT&CK Json file. Defaults to https://raw.githubusercontent.com/mitre/cti/master/enterprise-attack/enterprise-attack.json. - **pre_attck_json** (str, optional) - A URL or local file path to the MITRE Pre-ATT&CK Json file. Defaults to https://raw.githubusercontent.com/mitre/cti/master/pre-attack/pre-attack.json. - **mobile_attck_json** (str, optional) - A URL or local file path to the MITRE Mobile ATT&CK Json file. Defaults to https://raw.githubusercontent.com/mitre/cti/master/mobile-attack/mobile-attack.json. - **ics_attck_json** (str, optional) - A URL or local file path to the MITRE ICS ATT&CK JSON file. Defaults to https://raw.githubusercontent.com/mitre/cti/master/ics-attack/ics-attack.json. - **nist_controls_json** (str, optional) - A URL or local file path to the NIST Controls Json file. Defaults to https://raw.githubusercontent.com/center-for-threat-informed-defense/attack-control-framework-mappings/master/frameworks/ATT%26CK-v9.0/nist800-53-r5/stix/nist800-53-r5-controls.json. - **generated_attck_json** (str, optional) - A URL or local file path to the Generated MITRE ATT&CK Json file. Defaults to https://swimlane-pyattck.s3.us-west-2.amazonaws.com/generated_attck_data.json. - **generated_nist_json** (str, optional) - A URL or local file path to the Generated NIST Controls Mapping Json file. Defaults to https://swimlane-pyattck.s3.us-west-2.amazonaws.com/attck_to_nist_controls.json. - **kwargs** (dict, optional) - Provided kwargs will be passed to any HTTP requests using the Requests library. Defaults to None. ### Returns - **Attck** - Returns an Attck object that contains all data from MITRE ATT&CK Frameworks. ### Example ```python from pyattck import Attck attck = Attck() ``` ``` -------------------------------- ### Instantiate Attck object Source: https://pyattck.readthedocs.io/en/latest/_sources/index.md.txt Instantiate an Attck object to access MITRE ATT&CK data. This is the required first step for using pyattck. ```python from pyattck import Attck attack = Attck() ``` -------------------------------- ### Accessing ICS techniques and their properties Source: https://pyattck.readthedocs.io/en/latest/_sources/ics/icsattck.md.txt Shows how to iterate over techniques in the ICS framework and access individual properties like id, name, alias, description, stix, platforms, permissions, and wiki. ```python from pyattck import Attck attack = Attck() # accessing techniques and their properties for technique in attack.ics.techniques: # if you want to return individual properties of this object you call them directly print(technique.id) print(technique.name) print(technique.alias) print(technique.description) print(technique.stix) print(technique.platforms) print(technique.permissions) print(technique.wiki) ..... ``` -------------------------------- ### Run pyattck Docker container Source: https://pyattck.readthedocs.io/en/latest/_sources/index.md.txt Runs the Docker container, which executes the test Python file in bin/test.py. ```bash docker run pyattck ``` -------------------------------- ### Accessing actors, tactics, and techniques with relationships Source: https://pyattck.readthedocs.io/en/latest/_sources/preattck/preattck.md.txt Shows how to iterate over actors, tactics, and techniques, and access related objects such as techniques used by actors, techniques in tactics, and tactics/actors for techniques. ```python from pyattck import Attck attack = Attck() for actor in attack.preattack.actors: print(actor.id) print(actor.name) # accessing techniques used by an actor or group for technique in actor.techniques: print(technique.id) print(technique.name) # accessing tactics for tactic in attack.preattack.tactics: print(tactic.id) print(tactic.name) # accessing techniques related to this tactic for technique in tactic.techniques: print(technique.id) print(technique.name) # accessing techniques for technique in attack.preattack.techniques: print(technique.id) print(technique.name) # accessing tactics that this technique belongs to for tactic in technique.tactics: print(tactic.id) print(tactic.name) # accessing actors using this technique for actor in technique.actors: print(actor.id) print(actor.name) ``` -------------------------------- ### Access technique properties Source: https://pyattck.readthedocs.io/en/latest/enterprise/enterprise.html Iterate through enterprise techniques to access individual properties such as ID, name, alias, description, and platform information. ```python from pyattck import Attck attack = Attck() # accessing techniques and their properties for technique in attack.enterprise.techniques: # if you want to return individual properties of this object you call them directly print(technique.id) print(technique.name) print(technique.alias) print(technique.description) print(technique.stix) print(technique.platforms) print(technique.permissions) print(technique.wiki) ..... ``` -------------------------------- ### Accessing ICS object types and related objects Source: https://pyattck.readthedocs.io/en/latest/_sources/ics/icsattck.md.txt Shows how to access malwares, mitigations, tactics, and techniques, and their related objects. Includes accessing generated data sets like command_list, commands, queries, datasets, and possible_detections on techniques. ```python from pyattck import Attck attack = Attck() # accessing malware for malware in attack.ics.malwares: print(malware.id) print(malware.name) # accessing techniques that this malware is used in for technique in malware.techniques: print(technique.id) print(technique.name) # accessing mitigation for mitigation in attack.ics.mitigations: print(mitigation.id) print(mitigation.name) # accessing techniques related to mitigation recommendations for technique in mitigation.techniques: print(technique.id) print(technique.name) # you can also access generated data sets on aa technique print(technique.command_list) print(technique.commands) print(technique.queries) print(technique.datasets) print(technique.possible_detections) # accessing tactics for tactic in attack.ics.tactics: print(tactic.id) print(tactic.name) # accessing techniques related to this tactic for technique in tactic.techniques: print(technique.id) print(technique.name) # you can also access generated data sets on aa technique print(technique.command_list) print(technique.commands) print(technique.queries) print(technique.datasets) print(technique.possible_detections) # accessing techniques for technique in attack.ics.techniques: print(technique.id) print(technique.name) # you can also access generated data sets on aa technique print(technique.command_list) print(technique.commands) print(technique.queries) print(technique.datasets) print(technique.possible_detections) # accessing tactics that this technique belongs to for tactic in technique.tactics: print(tactic.id) print(tactic.name) # accessing mitigation recommendations for this technique for mitigation in technique.mitigations: print(mitigation.id) print(mitigation.name) ``` -------------------------------- ### Iterate over mobile ATT&CK data with pyattck Source: https://pyattck.readthedocs.io/en/latest/_sources/mobile/mobileattck.md.txt Initializes the Attck object and iterates over mobile actors, malware, mitigations, tactics, techniques, and tools, printing IDs and names, and accessing related objects and generated datasets. ```python from pyattck import Attck attack = Attck() for actor in attack.mobile.actors: print(actor.id) print(actor.name) # accessing malware used by an actor or group for malware in actor.malwares: print(malware.id) print(malware.name) # accessing tools used by an actor or group for tool in actor.tools: print(tool.id) print(tool.name) # accessing techniques used by an actor or group for technique in actor.techniques: print(technique.id) print(technique.name) # you can also access generated data sets on aa technique print(technique.command_list) print(technique.commands) print(technique.queries) print(technique.datasets) print(technique.possible_detections) # accessing malware for malware in attack.mobile.malwares: print(malware.id) print(malware.name) # accessing actor or groups using this malware for actor in malware.actors: print(actor.id) print(actor.name) # accessing techniques that this malware is used in for technique in malware.techniques: print(technique.id) print(technique.name) # accessing mitigation for mitigation in attack.mobile.mitigations: print(mitigation.id) print(mitigation.name) # accessing techniques related to mitigation recommendations for technique in mitigation.techniques: print(technique.id) print(technique.name) # you can also access generated data sets on aa technique print(technique.command_list) print(technique.commands) print(technique.queries) print(technique.datasets) print(technique.possible_detections) # accessing tactics for tactic in attack.mobile.tactics: print(tactic.id) print(tactic.name) # accessing techniques related to this tactic for technique in tactic.techniques: print(technique.id) print(technique.name) # you can also access generated data sets on aa technique print(technique.command_list) print(technique.commands) print(technique.queries) print(technique.datasets) print(technique.possible_detections) # accessing techniques for technique in attack.mobile.techniques: print(technique.id) print(technique.name) # you can also access generated data sets on aa technique print(technique.command_list) print(technique.commands) print(technique.queries) print(technique.datasets) print(technique.possible_detections) # accessing tactics that this technique belongs to for tactic in technique.tactics: print(tactic.id) print(tactic.name) # accessing mitigation recommendations for this technique for mitigation in technique.mitigations: print(mitigation.id) print(mitigation.name) # accessing actors using this technique for actor in technique.actors: print(actor.id) print(actor.name) # accessing tools for tool in attack.mobile.tools: print(tool.id) print(tool.name) # accessing techniques this tool is used in for technique in tool.techniques: print(technique.id) print(technique.name) # you can also access generated data sets on aa technique print(technique.command_list) print(technique.commands) print(technique.queries) print(technique.datasets) print(technique.possible_detections) # accessing actor or groups using this tool for actor in tool.actors: print(actor.id) print(actor.name) ``` -------------------------------- ### Attck Class Constructor Source: https://pyattck.readthedocs.io/en/latest/pyattck/attck.html Instantiates the Attck object with configurable parameters for data sources and behavior. ```APIDOC ## Attck Class Constructor ### Description Creates an Attck object to access MITRE ATT&CK framework data. ### Method Constructor ### Signature `Attck(nested_subtechniques=True, use_config=False, save_config=False, config_file_path='~/pyattck/config.yml', data_path='~/pyattck/data', enterprise_attck_json='https://raw.githubusercontent.com/mitre/cti/master/enterprise-attack/enterprise-attack.json', pre_attck_json='https://raw.githubusercontent.com/mitre/cti/master/pre-attack/pre-attack.json', mobile_attck_json='https://raw.githubusercontent.com/mitre/cti/master/mobile-attack/mobile-attack.json', ics_attck_json='https://raw.githubusercontent.com/mitre/cti/master/ics-attack/ics-attack.json', nist_controls_json='https://raw.githubusercontent.com/center-for-threat-informed-defense/attack-control-framework-mappings/master/frameworks/ATT%26CK-v9.0/nist800-53-r5/stix/nist800-53-r5-controls.json', generated_attck_json='https://swimlane-pyattck.s3.us-west-2.amazonaws.com/generated_attck_data.json', generated_nist_json='https://swimlane-pyattck.s3.us-west-2.amazonaws.com/attck_to_nist_controls.json', **kwargs)` ### Parameters - **nested_subtechniques** (bool) - Optional - If True, subtechniques are accessible under each technique object; if False, subtechniques are on the same level as other techniques. - **use_config** (bool) - Optional - Whether to use a configuration file. - **save_config** (bool) - Optional - Whether to save configuration to a file. - **config_file_path** (str) - Optional - Path to the configuration file. - **data_path** (str) - Optional - Path to the data directory. - **enterprise_attck_json** (str) - Optional - URL to the Enterprise ATT&CK JSON data. - **pre_attck_json** (str) - Optional - URL to the PRE-ATT&CK JSON data. - **mobile_attck_json** (str) - Optional - URL to the Mobile ATT&CK JSON data. - **ics_attck_json** (str) - Optional - URL to the ICS ATT&CK JSON data. - **nist_controls_json** (str) - Optional - URL to the NIST controls JSON data. - **generated_attck_json** (str) - Optional - URL to the generated ATT&CK data. - **generated_nist_json** (str) - Optional - URL to the generated NIST controls data. - **kwargs** - Optional - Additional keyword arguments. ### Example ```python from pyattck import Attck attack = Attck() ``` ``` -------------------------------- ### Search for commands using Attck Source: https://pyattck.readthedocs.io/en/latest/_modules/pyattck/attck.html Use the search_commands method to find external commands related to a specific technique. ```python from pyattck import Attck attck = Attck() for search in attck.enterprise.search_commands('powershell'): print(search['technique']) print(search['reason_for_match']) ``` -------------------------------- ### Sysmon Event Query for System Info Source: https://pyattck.readthedocs.io/en/latest/_sources/dataset/dataset.md.txt Azure Sentinel query to detect execution of sysinfo.exe or reg.exe with a specific registry query, indicating system information discovery. ```kql Sysmon| where EventID == 1 and (process_path contains"sysinfo.exe"or process_path contains "reg.exe")and process_commandline contains "reg*query HKLM\\SYSTEM\\CurrentControlSet\\Services\\Disk\\Enum" ``` -------------------------------- ### Access subtechniques at same level (nested_subtechniques=False) Source: https://pyattck.readthedocs.io/en/latest/_sources/pyattck/attck.md.txt Shows how to disable nested subtechniques by passing `nested_subtechniques=False` when creating the `Attck` object. This allows accessing subtechniques on the same level as all other techniques. ```python from pyattck import Attck attack = Attck() for technique in attack.enterprise.techniques: print(technique.id) print(technique.name) print(f"checking if technique is subtechnique: {technique.subtechnique}") ``` -------------------------------- ### Attck.preattack Source: https://pyattck.readthedocs.io/en/latest/_modules/pyattck/attck.html Property that retrieves a PreAttack object from the MITRE PRE-ATT&CK Framework. ```APIDOC ## Attck.preattack ### Description Retrieve objects from the MITRE PRE-ATT&CK Framework. ### Method Property getter ### Returns - **PreAttack** - Returns a PreAttack object. ``` -------------------------------- ### Configuration class properties and setters Source: https://pyattck.readthedocs.io/en/latest/_modules/pyattck/configuration.html Defines the Configuration class with class-level attributes for configuration paths and JSON URLs, and property getters/setters for config_file_path, data_path, config_data, and various JSON data sources. The setters validate values and update the configuration. ```python @property def config_file_path(cls): return cls.__get_absolute_path(cls._config_file_path) @config_file_path.setter def config_file_path(cls, value): cls._config_file_path = cls.__get_absolute_path(value) cls.__update_config() @property def data_path(cls): return cls.__get_absolute_path(cls._data_path) @data_path.setter def data_path(cls, value): cls._data_path = cls.__get_absolute_path(value) cls.__update_config() @property def config_data(cls): if cls.use_config: cls.__config_data = cls.__read_from_disk(cls.config_file_path) if not cls.__config_data: cls.__update_config() else: cls.__update_config() if cls.save_config: cls.__update_config() cls.__write_to_disk(cls.config_file_path, cls.__config_data) cls._save_json_data() return cls.__config_data @property def enterprise_attck_json(cls): return cls._enterprise_attck_json @enterprise_attck_json.setter def enterprise_attck_json(cls, value): cls._enterprise_attck_json = cls.__validate_value_string(value) cls.__update_config() @property def pre_attck_json(cls): return cls._pre_attck_json @pre_attck_json.setter def pre_attck_json(cls, value): cls._pre_attck_json = cls.__validate_value_string(value) cls.__update_config() @property def mobile_attck_json(cls): return cls._mobile_attck_json @mobile_attck_json.setter def mobile_attck_json(cls, value): cls._mobile_attck_json = cls.__validate_value_string(value) cls.__update_config() @property def ics_attck_json(cls): return cls._ics_attck_json @ics_attck_json.setter def ics_attck_json(cls, value): cls._ics_attck_json = cls.__validate_value_string(value) cls.__update_config() @property def nist_controls_json(cls): return cls._nist_controls_json @nist_controls_json.setter def nist_controls_json(cls, value): cls._nist_controls_json = cls.__validate_value_string(value) cls.__update_config() @property def generated_attck_json(cls): return cls._generated_attck_json @generated_attck_json.setter def generated_attck_json(cls, value): cls._generated_attck_json = cls.__validate_value_string(value) cls.__update_config() @property def generated_nist_json(cls): return cls._generated_nist_json @generated_nist_json.setter def generated_nist_json(cls, value): cls._generated_nist_json = cls.__validate_value_string(value) cls.__update_config() [docs]class Configuration(object, metaclass=ConfigurationProperties): _use_config = False _save_config = False _config_file_path = '~/pyattck/config.yml' _data_path = '~/pyattck/data' _enterprise_attck_json = "https://raw.githubusercontent.com/mitre/cti/master/enterprise-attack/enterprise-attack.json" _pre_attck_json="https://raw.githubusercontent.com/mitre/cti/master/pre-attack/pre-attack.json" _mobile_attck_json="https://raw.githubusercontent.com/mitre/cti/master/mobile-attack/mobile-attack.json" _ics_attck_json="https://raw.githubusercontent.com/mitre/cti/master/ics-attack/ics-attack.json" _nist_controls_json="https://raw.githubusercontent.com/center-for-threat-informed-defense/attack-control-framework-mappings/master/frameworks/nist800-53-r4/stix/nist800-53-r4-controls.json" _generated_attck_json="https://github.com/swimlane/pyattck/blob/master/generated_attck_data.json?raw=True" _generated_nist_json="https://github.com/swimlane/pyattck/blob/master/attck_to_nist_controls.json?raw=True" _requests_kwargs = {} ``` -------------------------------- ### Attck.enterprise.search_commands Source: https://pyattck.readthedocs.io/en/latest/pyattck/attck.html Searches the external dataset for external commands similar to the given search term. ```APIDOC ## Attck.enterprise.search_commands ### Description Searches the external dataset for external commands that are similar to the provided search term. ### Method search_commands(search_term) ### Parameters - **search_term** (str) - Required - The term to search for. ### Returns A list of dictionaries, each containing 'technique' and 'reason_for_match' keys. ### Example ```python from pyattck import Attck attck = Attck() for search in attck.enterprise.search_commands('powershell'): print(search['technique']) print(search['reason_for_match']) ``` ``` -------------------------------- ### Search Enterprise commands Source: https://pyattck.readthedocs.io/en/latest/enterprise/enterprise.html Use the search_commands method to find external commands related to a specific term within the Enterprise framework. ```python from pyattck import Attck attack = Attck() for search in attack.enterprise.search_commands('powershell'): print(search['technique']) print(search['reason_for_match']) ``` -------------------------------- ### Command Prompt Windows Discovery Commands Source: https://pyattck.readthedocs.io/en/latest/_sources/dataset/dataset.md.txt Windows command prompt commands to identify system owner or users, as used in the Atomic Red Team test for T1033. ```cmd cmd.exe /C whoami wmic useraccount get /ALL quser /SERVER:"#{computer_name}" quser qwinsta.exe" /server:#{computer_name} qwinsta.exe for /F "tokens=1,2" %i in ('qwinsta /server:#{computer_name} ^| findstr "Active Disc"') do @echo %i | find /v "#" | find /v "console" || echo %j > usernames.txt @FOR /F %n in (computers.txt) DO @FOR /F "tokens=1,2" %i in ('qwinsta /server:%n ^| findstr "Active Disc"') do @echo %i | find /v "#" | find /v "console" || echo %j > usernames.txt ``` -------------------------------- ### Attck.enterprise Source: https://pyattck.readthedocs.io/en/latest/pyattck/attck.html Provides access to the MITRE Enterprise ATT&CK framework, including techniques, tactics, mitigations, actors, tools, and malwares. ```APIDOC ## Attck.enterprise ### Description Accesses the MITRE Enterprise ATT&CK framework data. ### Property `enterprise` ### Returns An object representing the Enterprise ATT&CK framework, with properties for techniques, tactics, mitigations, actors, tools, and malwares. ### Example ```python from pyattck import Attck attack = Attck() for technique in attack.enterprise.techniques: print(technique.id) print(technique.name) ``` ``` -------------------------------- ### Iterate over object lists in Attck Source: https://pyattck.readthedocs.io/en/latest/_modules/pyattck/attck.html Access and iterate over lists of objects like techniques and mitigations after instantiating the Attck object. ```python from pyattck import Attck attck = Attck() for technique in attck.enterprise.techniques: print(technique.id) print(technique.name) print(technique.description) # etc. for mitigation in attck.enterprise.mitigations: print(mitigation.id) print(mitigation.name) print(mitigation.description) # etc. ``` -------------------------------- ### Unix Shell Discovery Commands Source: https://pyattck.readthedocs.io/en/latest/_sources/dataset/dataset.md.txt Shell commands to identify system owner or users on Linux and macOS, as part of the same Atomic Red Team test. ```sh users w who ``` -------------------------------- ### Attck.mobile Source: https://pyattck.readthedocs.io/en/latest/pyattck/attck.html Retrieves objects from the MITRE Mobile ATT&CK Framework. ```APIDOC ## Attck.mobile ### Description Retrieves objects from the MITRE Mobile ATT&CK Framework. ### Returns - **MobileAttack** - Returns a MobileAttack object. ### Example ```python from pyattck import Attck attck = Attck() for technique in attck.mobile.techniques: print(technique.id) print(technique.name) ``` ``` -------------------------------- ### pyattck Tagline Source: https://pyattck.readthedocs.io/en/latest/index.html Tagline describing the pyattck package as a Python package to interact with MITRE ATT&CK Frameworks. ```text A Python package to interact with MITRE ATT&CK Frameworks ``` -------------------------------- ### Attck.update Source: https://pyattck.readthedocs.io/en/latest/_modules/pyattck/attck.html Method that forces a refresh of the local data by saving JSON data with force=True. ```APIDOC ## Attck.update ### Description Forces an update of the local data by saving JSON data with force=True. ### Method update ### Returns - **bool** - Returns True if the update was successful, otherwise False. ``` -------------------------------- ### Attck.mobile Source: https://pyattck.readthedocs.io/en/latest/_modules/pyattck/attck.html Property that retrieves a MobileAttack object from the MITRE Mobile ATT&CK Framework. ```APIDOC ## Attck.mobile ### Description Retrieve objects from the MITRE Mobile ATT&CK Framework. ### Method Property getter ### Returns - **MobileAttack** - Returns a MobileAttack object. ```