InvestigationDetailedSummaryParse

Parses attacks from context, and shows them according to the MITRE technique they use.

python · Malware Investigation and Response

Details

ID	`InvestigationDetailedSummaryParse`
Language	python
From Version	6.2.0
Docker Image	`demisto/python3:3.12.13.10404775`
Tags	basescript

README

This script parses attacks from context and shows them according to the MITRE technique they use.
The MITRE ATT&CK v2 pack (v1.1.0 or newer) is required for this automation to run properly.

Script Data

Name	Description
Script Type	python3
Tags	basescript
Cortex XSOAR Version	6.2.0

Inputs

There are no inputs for this script.

Outputs

Path	Description	Type
InvestigationDetailedSummary.Execution.Command and Scripting Interpreter	Whether the Command and Scripting Interpreter technique was detected.	bool
InvestigationDetailedSummary.Privilege Escalation.Boot or Logon Autostart Execution	Whether the Boot or Logon Autostart Execution technique was detected.	bool
InvestigationDetailedSummary.Lateral Movement.Command and Scripting Interpreter	Whether the Indicator Removal on Host technique was detected.	bool
InvestigationDetailedSummary.Defense Evasion.Remote Services	Whether the Remote Services technique was detected.	bool
InvestigationDetailedSummary.Persistence.Boot or Logon Autostart Execution	Whether the Boot or Logon Autostart Execution technique was detected.	bool

Source

InvestigationDetailedSummaryParse.py InvestigationDetailedSummaryParse_test.py InvestigationDetailedSummaryParse.yml

Download History Raw

import json
from pathlib import Path

import pytest
from InvestigationDetailedSummaryParse import DemistoException, parse_command

TEST_DATA_DIR = Path(__file__).parent / "test_data"


def _dump_test_file(file_name: str, content: dict | list):
    (TEST_DATA_DIR / file_name).write_text(json.dumps(content))


def _load_test_file(file_name: str):
    return json.loads((TEST_DATA_DIR / file_name).read_text())


def test_empty_context():
    assert [_.to_context() for _ in parse_command({})] == _load_test_file("empty_context.json")


def test_parse_command():
    context = {
        "AttackPattern": [
            {"KillChainPhases": ["Lateral Movement", "dummy"], "MITREID": "T1210", "Value": "Exploitation of Remote Services"},
            {"KillChainPhases": ["Execution"], "MITREID": "T1059", "Value": "Command and Scripting Interpreter"},
            {"KillChainPhases": ["dummy"], "MITREID": "T0000", "Value": "dummy value"},
        ]
    }
    assert [_.to_context() for _ in parse_command(context)] == _load_test_file("parse_command.json")


def test_parse_command_value_lower_case():
    """
    The same UT as above just with 'value' key (lower case) instead of 'Value'.
    When 'Value' key is missing, it should retrieve the content from 'value'.
    """
    context = {
        "AttackPattern": [
            {"KillChainPhases": ["Lateral Movement", "dummy"], "MITREID": "T1210", "value": "Exploitation of Remote Services"},
            {"KillChainPhases": ["Execution"], "MITREID": "T1059", "Value": "Command and Scripting Interpreter"},
            {"KillChainPhases": ["dummy"], "MITREID": "T0000", "Value": "dummy value"},
        ]
    }
    assert [_.to_context() for _ in parse_command(context)] == _load_test_file("parse_command.json")


def test_missing_value():
    """
    Given   a context where at least one of the AttackPattern results does not have a `Value` key
    When    running InvestigationDetailedSummaryParse
    Then    make sure an exception is raised.
    """
    context = {
        "AttackPattern": [
            {"KillChainPhases": ["Lateral Movement", "dummy"], "MITREID": "T1210"},  # missing Value key
            {"KillChainPhases": ["Execution"], "MITREID": "T1059", "Value": "Command and Scripting Interpreter"},
        ]
    }
    with pytest.raises(DemistoException) as e:
        parse_command(context)
    assert e.value.message == "please make sure the MITRE ATT&CK v2 pack is up-to-date (v1.1.1 or newer)"