Git-Mirrors/DISARMframeworks
1
0
Fork 0
mirror of https://github.com/DISARMFoundation/DISARMframeworks.git synced 2025-05-13 12:12:24 -04:00
Code Issues Projects Releases Packages Wiki Activity Actions

add subtechniques to stix2 generator

Browse source
This commit is contained in:
VVX7 2022-07-02 00:06:46 -04:00
parent 0549123900
commit 8937d50328
5 changed files with 85 additions and 24 deletions
Download patch file Download diff file Expand all files Collapse all files

54
CODE/DISARM-STIX2/objects/technique.py
View file

@ -19,7 +19,7 @@ def make_disarm_techniques(data):
for t in data["techniques"].values.tolist():
external_references = [
{
'external_id': f'{t[0]}',
'external_id': f'{t[0]}'.strip(),
'source_name': 'DISARM',
'url': f'https://github.com/DISARMFoundation/DISARM_framework/blob/master/techniques/{t[0]}.md'
}
@ -50,7 +50,7 @@ def make_disarm_techniques(data):
kill_chain_phases=kill_chain_phases,
custom_properties={
'x_mitre_platforms': x_mitre_platforms,
'x_mitre_version': "1,0",
'x_mitre_version': "1.0",
'x_mitre_is_subtechnique': x_mitre_is_subtechnique
}
)
@ -59,13 +59,57 @@ def make_disarm_techniques(data):
return techniques
def make_subtechnique_map(techinques):
def make_disarm_subtechniques(data):
"""
Args:
techinques:
data: The xlsx subtechnique sheet.
Returns:
"""
pass
tacdict = pd.Series(data["tactics"].name.values, index=data["tactics"].disarm_id).to_dict()
techdict = pd.Series(data["techniques"].tactic_id.values, index=data["techniques"].disarm_id).to_dict()
subtechniques = []
for t in data["subtechniques"].values.tolist():
external_references = [
{
'external_id': f'{t[0]}'.strip(),
'source_name': 'DISARM',
'url': f'https://github.com/DISARMFoundation/DISARM_framework/blob/master/techniques/{t[0]}.md'
}
]
kill_chain_phases = [
{
'phase_name': tacdict[techdict[t[2]]].replace(' ', '-').lower(),
'kill_chain_name': 'mitre-attack'
}
]
subtechnique = t[0].split(".")
x_mitre_is_subtechnique = False
if len(subtechnique) > 1:
x_mitre_is_subtechnique = True
# MITRE ATT&CK Navigator expect techniques to have at least one of these platforms.
# Without one, the technique will not render in the Navigator.
x_mitre_platforms = 'Windows', 'Linux', 'Mac'
technique = AttackPattern(
name=f"{t[1]}",
description=f"{t[3]}",
external_references=external_references,
object_marking_refs=objects.marking_definition.make_disarm_marking_definition(),
created_by_ref=objects.identity.make_disarm_identity(),
kill_chain_phases=kill_chain_phases,
custom_properties={
'x_mitre_platforms': x_mitre_platforms,
'x_mitre_version': "1.0",
'x_mitre_is_subtechnique': x_mitre_is_subtechnique
}
)
subtechniques.append(technique)
return subtechniques