mirror of
https://github.com/DISARMFoundation/DISARMframeworks.git
synced 2025-05-13 04:02:26 -04:00
add subtechniques to stix2 generator. update STIX bundles. use subtechnique dot notation name convention in DISARM_FRAMEWORKS_MASTER.xlsx
This commit is contained in:
parent
f1d7a8ac3d
commit
c7b5d59876
671 changed files with 15048 additions and 12934 deletions
|
@ -57,59 +57,3 @@ def make_disarm_techniques(data):
|
|||
|
||||
techniques.append(technique)
|
||||
return techniques
|
||||
|
||||
|
||||
def make_disarm_subtechniques(data):
|
||||
"""
|
||||
|
||||
Args:
|
||||
data: The xlsx subtechnique sheet.
|
||||
|
||||
Returns:
|
||||
|
||||
"""
|
||||
tacdict = pd.Series(data["tactics"].name.values, index=data["tactics"].disarm_id).to_dict()
|
||||
techdict = pd.Series(data["techniques"].tactic_id.values, index=data["techniques"].disarm_id).to_dict()
|
||||
|
||||
subtechniques = []
|
||||
for t in data["subtechniques"].values.tolist():
|
||||
external_references = [
|
||||
{
|
||||
'external_id': f'{t[0]}'.strip(),
|
||||
'source_name': 'DISARM',
|
||||
'url': f'https://github.com/DISARMFoundation/DISARM_framework/blob/master/techniques/{t[0]}.md'
|
||||
}
|
||||
]
|
||||
|
||||
kill_chain_phases = [
|
||||
{
|
||||
'phase_name': tacdict[techdict[t[2]]].replace(' ', '-').lower(),
|
||||
'kill_chain_name': 'mitre-attack'
|
||||
}
|
||||
]
|
||||
|
||||
subtechnique = t[0].split(".")
|
||||
x_mitre_is_subtechnique = False
|
||||
if len(subtechnique) > 1:
|
||||
x_mitre_is_subtechnique = True
|
||||
|
||||
# MITRE ATT&CK Navigator expect techniques to have at least one of these platforms.
|
||||
# Without one, the technique will not render in the Navigator.
|
||||
x_mitre_platforms = 'Windows', 'Linux', 'Mac'
|
||||
|
||||
technique = AttackPattern(
|
||||
name=f"{t[1]}",
|
||||
description=f"{t[3]}",
|
||||
external_references=external_references,
|
||||
object_marking_refs=objects.marking_definition.make_disarm_marking_definition(),
|
||||
created_by_ref=objects.identity.make_disarm_identity(),
|
||||
kill_chain_phases=kill_chain_phases,
|
||||
custom_properties={
|
||||
'x_mitre_platforms': x_mitre_platforms,
|
||||
'x_mitre_version': "1.0",
|
||||
'x_mitre_is_subtechnique': x_mitre_is_subtechnique
|
||||
}
|
||||
)
|
||||
|
||||
subtechniques.append(technique)
|
||||
return subtechniques
|
Loading…
Add table
Add a link
Reference in a new issue