mirror of
https://github.com/DISARMFoundation/DISARMframeworks.git
synced 2025-05-13 12:12:24 -04:00
Added EEAS framework objects and STIX generator
Added framework objects: - Added technique T0066 "Degrade adversary" to TA02 - Added technique T0067 "Plan to discredit credible sources" to TA02 - Added technique T0068 "respond to breaking news event" to TA02 - Added technique T0069 "respond to active crisis" to TA02 - Added technique T0070 "Analyze existing communities" to TA02 - Added technique T0071 "Find echo chambers" to TA13 - Added technique T0072 "Segment audiences" to TA13 Added STIX generator from repo DISARM-stix2, and added code to generate github files, databases, and STIX from the same Jupyter notebook.
This commit is contained in:
parent
2117dcf09b
commit
c11e9d06ad
46 changed files with 2428 additions and 17533 deletions
71
CODE/DISARM-STIX2/objects/technique.py
Normal file
71
CODE/DISARM-STIX2/objects/technique.py
Normal file
|
@ -0,0 +1,71 @@
|
|||
from stix2 import AttackPattern, properties, ExternalReference
|
||||
import objects.marking_definition
|
||||
import pandas as pd
|
||||
from objects import identity, marking_definition
|
||||
|
||||
|
||||
def make_disarm_techniques(data):
|
||||
"""Create all DISARM Techniques objects.
|
||||
|
||||
Args:
|
||||
data: The xlsx technique sheet.
|
||||
|
||||
Returns:
|
||||
A list of Techniques.
|
||||
|
||||
"""
|
||||
tacdict = pd.Series(data["tactics"].name.values, index=data["tactics"].disarm_id).to_dict()
|
||||
techniques = []
|
||||
for t in data["techniques"].values.tolist():
|
||||
external_references = [
|
||||
{
|
||||
'external_id': f'{t[0]}',
|
||||
'source_name': 'DISARM',
|
||||
'url': f'https://github.com/DISARMFoundation/DISARM_framework/blob/master/techniques/{t[0]}.md'
|
||||
}
|
||||
]
|
||||
|
||||
kill_chain_phases = [
|
||||
{
|
||||
'phase_name': tacdict[t[3]].replace(' ', '-').lower(),
|
||||
'kill_chain_name': 'mitre-attack'
|
||||
}
|
||||
]
|
||||
|
||||
subtechnique = t[0].split(".")
|
||||
x_mitre_is_subtechnique = False
|
||||
if len(subtechnique) > 1:
|
||||
x_mitre_is_subtechnique = True
|
||||
|
||||
# MITRE ATT&CK Navigator expect techniques to have at least one of these platforms.
|
||||
# Without one, the technique will not render in the Navigator.
|
||||
x_mitre_platforms = 'Windows', 'Linux', 'Mac'
|
||||
|
||||
technique = AttackPattern(
|
||||
name=f"{t[1]}",
|
||||
description=f"{t[3]}",
|
||||
external_references=external_references,
|
||||
object_marking_refs=objects.marking_definition.make_disarm_marking_definition(),
|
||||
created_by_ref=objects.identity.make_disarm_identity(),
|
||||
kill_chain_phases=kill_chain_phases,
|
||||
custom_properties={
|
||||
'x_mitre_platforms': x_mitre_platforms,
|
||||
'x_mitre_version': "1,0",
|
||||
'x_mitre_is_subtechnique': x_mitre_is_subtechnique
|
||||
}
|
||||
)
|
||||
|
||||
techniques.append(technique)
|
||||
return techniques
|
||||
|
||||
|
||||
def make_subtechnique_map(techinques):
|
||||
"""
|
||||
|
||||
Args:
|
||||
techinques:
|
||||
|
||||
Returns:
|
||||
|
||||
"""
|
||||
pass
|
Loading…
Add table
Add a link
Reference in a new issue