Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

feat(graph): embed MITRE Attck technique and tactic into edges #312

Merged

Conversation

Zenithar
Copy link
Contributor

@Zenithar Zenithar commented Jan 7, 2025

Context

  • Embed MITRE Att&ck technique and tactic into attack edges.
  • Review Att&ck assignations.
  • Synchronise doc and code concerning ATT&CK classification.
  • Fix gen-index.py to support the coverage attribute.

Reference(s)

@Zenithar Zenithar self-assigned this Jan 7, 2025
@Zenithar Zenithar marked this pull request as ready for review January 8, 2025 10:48
@Zenithar Zenithar requested a review from a team as a code owner January 8, 2025 10:48
Copy link
Contributor

@Minosity-VR Minosity-VR left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Nice! I think some changes were not reflected in some md files, but other than that it looks great!

Comment on lines +165 to +190
// Define properties for each edge
mgmt.addProperties(permissionDiscover, runID, attckTechniqueID, attckTacticID);
mgmt.addProperties(volumeDiscover, runID, attckTechniqueID, attckTacticID);
mgmt.addProperties(volumeAccess, runID, attckTechniqueID, attckTacticID);
mgmt.addProperties(hostWrite, runID, attckTechniqueID, attckTacticID);
mgmt.addProperties(hostRead, runID, attckTechniqueID, attckTacticID);
mgmt.addProperties(hostTraverse, runID, attckTechniqueID, attckTacticID);
mgmt.addProperties(sharedPsNamespace, runID, attckTechniqueID, attckTacticID);
mgmt.addProperties(containerAttach, runID, attckTechniqueID, attckTacticID);
mgmt.addProperties(idAssume, runID, attckTechniqueID, attckTacticID);
mgmt.addProperties(idImpersonate, runID, attckTechniqueID, attckTacticID);
mgmt.addProperties(roleBind, runID, attckTechniqueID, attckTacticID);
mgmt.addProperties(podAttach, runID, attckTechniqueID, attckTacticID);
mgmt.addProperties(podCreate, runID, attckTechniqueID, attckTacticID);
mgmt.addProperties(podPatch, runID, attckTechniqueID, attckTacticID);
mgmt.addProperties(podExec, runID, attckTechniqueID, attckTacticID);
mgmt.addProperties(tokenSteal, runID, attckTechniqueID, attckTacticID);
mgmt.addProperties(tokenBruteforce, runID, attckTechniqueID, attckTacticID);
mgmt.addProperties(tokenList, runID, attckTechniqueID, attckTacticID);
mgmt.addProperties(nsenter, runID, attckTechniqueID, attckTacticID);
mgmt.addProperties(moduleLoad, runID, attckTechniqueID, attckTacticID);
mgmt.addProperties(umhCorePattern, runID, attckTechniqueID, attckTacticID);
mgmt.addProperties(privMount, runID, attckTechniqueID, attckTacticID);
mgmt.addProperties(sysPtrace, runID, attckTechniqueID, attckTacticID);
mgmt.addProperties(varLogSymLink, runID, attckTechniqueID, attckTacticID);
mgmt.addProperties(endpointExploit, runID, attckTechniqueID, attckTacticID);
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This looks like something that can be easily forgotten when adding additional edges. Do you think there is a way to test that all defined edges do have a property attached? something like a unit test?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Technically, you should add entries in this file to declare your new edges and their associated properties. This file is the schema builder for JanusGraph.

I'm not aware of any existing graph schema unit tests, but I can have a look to.

docs/reference/attacks/POD_ATTACH.md Outdated Show resolved Hide resolved
docs/reference/attacks/POD_CREATE.md Outdated Show resolved Hide resolved
pkg/kubehound/graph/edge/share_ps_namespace.go Outdated Show resolved Hide resolved
pkg/kubehound/graph/edge/pod_patch_namespace.go Outdated Show resolved Hide resolved
docs/reference/graph/graph.yaml Outdated Show resolved Hide resolved
@jt-dd jt-dd self-requested a review January 8, 2025 20:55
@Zenithar Zenithar merged commit 4474f1f into DataDog:main Jan 9, 2025
3 checks passed
@Zenithar Zenithar deleted the zenithar/feat_graph_embed_mitre_attck branch January 9, 2025 07:10
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

Add TTPs directily on Edge details
3 participants