This repository was archived by the owner on Jul 18, 2019. It is now read-only.
-
Notifications
You must be signed in to change notification settings - Fork 82
/
Copy pathInvoke-ATTACKAPI.ps1
1301 lines (1177 loc) · 80.4 KB
/
Invoke-ATTACKAPI.ps1
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899
900
901
902
903
904
905
906
907
908
909
910
911
912
913
914
915
916
917
918
919
920
921
922
923
924
925
926
927
928
929
930
931
932
933
934
935
936
937
938
939
940
941
942
943
944
945
946
947
948
949
950
951
952
953
954
955
956
957
958
959
960
961
962
963
964
965
966
967
968
969
970
971
972
973
974
975
976
977
978
979
980
981
982
983
984
985
986
987
988
989
990
991
992
993
994
995
996
997
998
999
1000
function Invoke-ATTACKAPI
{
<#
.SYNOPSIS
A PS script to interact with the MITRE ATT&CK Framework via its own API
.DESCRIPTION
Use this script to interact with the MITRE ATT&CK Framework via its API and gather information about techniques,
tactics, groups, software and references provided by the MITRE ATT&CK Team @MITREattack
Almost all data in ATT&CK can be accessed using the Semantic MediaWiki Ask API. URLs targeting
the API are constructed in the following pattern
/api.php?action=ask&format=<format specifier>&query=<insert query statement>
where <format specifier> is a specific output format (usually json or jsonfm) and <insert query statement>
refers to a query that specifies the data that will be retrieved. Queries are structured as if they are
targeting the Semantic MediaWiki #ask parser function.
Queries are constructed by combining one or more page selectors with a set of display parameters.
A simple selector for all techniques is [[Category:Technique]] and a simple display parameter is
?Has display name which maps to the name of the ATT&CK Technique. To construct the query, the selector
is combined with the display parameter by placing a | symbol in between. So the combined query
is [[Category:Technique]]|?Has display name. This query will retrieve all ATT&CK techniques along
with their display name. To run this we just have to URL encode the combined query and place it in the URL.
The final query is:
https://attack.mitre.org/api.php?action=ask&format=jsonfm&query=%5B%5BCategory%3ATechnique%5D%5D%7C%3FHas%20display%20name
.PARAMETER Sync
Connects to the MITRE ATT&CK framework and dumps all its data to an object.
The output of this is needed before running any other parameters.
.PARAMETER Matrix
Switch that you can use to display an up to date ATT&CK Matrix for Enterprise
.PARAMETER Category
Page selector switch.
.PARAMETER Technique
Page Selector to show all Techniques at once with their respective properties.
.PARAMETER Group
Page Selector to show all Groups at once with their respective properties.
.PARAMETER Software
Page Selector to show all Software at once with their respective properties.
.PARAMETER Tactic
Page Selector to show all Tactics at once with their respective properties.
.PARAMETER Reference
Page Selector to show all References at once with their respective properties.
.PARAMETER Attribution
Switch used to display a table with techniques and Tools attributed to a specific Group/APT
.PARAMETER All
Switch used to get all the valuable information from the MITRE ATTACK DB at once.
.PARAMETER FullText
Depending on what page selector you choose, the values of this parameter vary.
This is usually an ID, and it is available with every single page selector.
.PARAMETER ID
Depending on what page selector you choose, the values of this parameter vary.
This is property 'Has ID', and it is available with Technique, Group and Software page selectors
.PARAMETER Name
Depending on what page selector you choose, the values of this parameter vary.
This is usually property 'Has display name' or 'Has title', and it is available with
every single page selector.
.PARAMETER TechniqueTactic
This is property 'Has tactic', and it is available only with Technique page selector.
.PARAMETER Platform
This is property 'Has platform', and it is available only with Technique page selector.
.PARAMETER Alias
This is property 'Has alias', and it is available only with Group page selector.
.PARAMETER TechniqueID
This is property 'Has technique'.fulltext , and it is available in Group and Software pages selector.
.PARAMETER TechniqueName
This is property 'Has technique'.displaytitle , and it is available in Group and Software pages selector.
.PARAMETER Tool
This is property 'Uses software, it is available only with Group page selector.
.PARAMETER Type
This is property 'Has software type' , and it is available only with Software page selector.
.PARAMETER Key
This is property 'Citation key' , and it is available only with Reference page selector.
.PARAMETER Author
This is property 'Has authors'.fulltext , and it is available only with Reference page selector.
.PARAMETER Date
Available only with Reference page selector.
.PARAMETER Year
Available only with Reference page selector.
.EXAMPLE
This query matches all techniques
Invoke-ATTACKAPI -Category -Technique
ID : {T1001}
Bypass : {}
Contributor : {}
Requires System : {}
Data Source : {Packet capture, Process use of network, Process monitoring, Network protocol analysis}
Description : {Command and control (C2) communications are hidden (but not necessarily encrypted) in an
attempt to make the content more difficult to discover or decipher and to make the
communication less conspicuous and hide commands from being seen. This encompasses many
methods, such as adding junk data to protocol traffic, using steganography, commingling
legitimate traffic with C2 communications traffic, or using a non-standard data encoding
system, such as a modified Base64 encoding for the message body of an HTTP request.}
Mitigation : {Network intrusion detection and prevention systems that use network signatures to
identify traffic for specific adversary malware can be used to mitigate activity at the
network level. Signatures are often for unique indicators within protocols and may be
based on the specific obfuscation technique used by a particular adversary or tool, and
will likely be different across various malware families and versions. Adversaries will
likely change tool C2 signatures over time or construct protocols in such a way as to
avoid detection by common defensive tools.[[CiteRef::University of Birmingham C2]]}
Tactic : Command and Control
Analytic Details : {Analyze network data for uncommon data flows (e.g., a client sending significantly more
data than it receives from a server). Processes utilizing the network that do not normally
have network communication or have never been seen before are suspicious. Analyze packet
contents to detect communications that do not follow the expected protocol behavior for
the port that is being used.[[CiteRef::University of Birmingham C2]]}
TechniqueName : {Data Obfuscation}
FullText : Technique/T1001
Link Text : {[[Technique/T1001|Data Obfuscation]]}
Reference : {University of Birmingham C2, FireEye APT28, Axiom, FireEye APT30...}
Platform : {Windows Server 2003, Windows Server 2008, Windows Server 2012, Windows XP...}
Name : {Data Obfuscation}
CAPEC ID : {}
Requires Permission : {}
URL : https://attack.mitre.org/wiki/Technique/T1001
.............
..................
ID : {T1068}
Bypass : {Anti-virus, System access controls}
Contributor : {John Lambert, Microsoft Threat Intelligence Center}
Requires System : {Unpatched software or otherwise vulnerable target. Depending on the target and goal, the
system and exploitable service may need to be remotely accessible from the internal
network. In the case of privilege escalation, the adversary likely already has user
permissions on the target system.}
Data Source : {Windows Error Reporting, File monitoring, Process monitoring}
Description : {Exploitation of a software vulnerability occurs when an adversary takes advantage of a
programming error in a program, service, or within the operating system software or
kernel itself to execute adversary-controlled code. Exploiting software vulnerabilities
may allow adversaries to run a command or binary on a remote system for lateral movement,
escalate a current process to a higher privilege level, or bypass security mechanisms.
Exploits may also allow an adversary access to privileged accounts and credentials. One
example of this is MS14-068, which can be used to forge Kerberos tickets using domain
user permissions.[[CiteRef::Technet MS14-068]][[CiteRef::ADSecurity Detecting Forged
Tickets]]}
Mitigation : {Update software regularly by employing patch management for internal enterprise
endpoints and servers. Develop a robust cyber threat intelligence capability to determine
what types and levels of threat may use software exploits and 0-days against a particular
organization. Make it difficult for adversaries to advance their operation through
exploitation of undiscovered or unpatched vulnerabilities by using sandboxing,
virtualization, and exploit prevention tools such as the Microsoft Enhanced Mitigation
Experience Toolkit.[[CiteRef::SRD EMET]]}
Tactic : {Credential Access, Defense Evasion, Lateral Movement, Privilege Escalation}
Analytic Details : {Software exploits may not always succeed or may cause the exploited process to become
unstable or crash. Software and operating system crash reports may contain useful
contextual information about attempted exploits that correlate with other malicious
activity. Exploited processes may exhibit behavior that is unusual for the specific
process, such as spawning additional processes or reading and writing to files.}
TechniqueName : {Exploitation of Vulnerability}
FullText : Technique/T1068
Link Text : {[[Technique/T1068|Exploitation of Vulnerability]]}
Reference : {ADSecurity Detecting Forged Tickets, Bitdefender APT28 Dec 2015, ESET Sednit July 2015,
ESET Sednit Part 1...}
Platform : {Windows Server 2003, Windows Server 2008, Windows Server 2012, Windows XP...}
Name : {Exploitation of Vulnerability}
CAPEC ID : {69}
Requires Permission : {User, Administrator, SYSTEM}
URL : https://attack.mitre.org/wiki/Technique/T1068
.EXAMPLE
This query matches the page Technique with ID T1014
Invoke-ATTACKAPI -Category -Technique -ID T1014
ID : {T1014}
Bypass : {Anti-virus, File monitoring, Host intrusion prevention systems, Process whitelisting...}
Contributor : {}
Requires System : {}
Data Source : {BIOS, MBR, System calls}
Description : {Rootkits are programs that hide the existence of malware by intercepting and modifying
operating system API calls that supply system information. Rootkits or rootkit enabling
functionality may reside at the user or kernel level in the operating system or lower, to
include a [[Technique/T1062|Hypervisor]], Master Boot Record, or the
[[Technique/T1019|System Firmware]].[[CiteRef::Wikipedia Rootkit]]
Adversaries may use rootkits to hide the presence of programs, files, network
connections, services, drivers, and other system components.}
Mitigation : {Identify potentially malicious software that may contain rootkit functionality, and
audit and/or block it by using whitelisting[[CiteRef::Beechey 2010]] tools, like
AppLocker,[[CiteRef::Windows Commands JPCERT]][[CiteRef::NSA MS AppLocker]] or Software
Restriction Policies[[CiteRef::Corio 2008]] where appropriate.[[CiteRef::TechNet
Applocker vs SRP]]}
Tactic : Defense Evasion
Analytic Details : {Some rootkit protections may be built into anti-virus or operating system software.
There are dedicated rootkit detection tools that look for specific types of rootkit
behavior. Monitor for the existence of unrecognized DLLs, devices, services, and changes
to the MBR.[[CiteRef::Wikipedia Rootkit]]}
TechniqueName : {Rootkit}
FullText : Technique/T1014
Link Text : {[[Technique/T1014|Rootkit]]}
Reference : {Wikipedia Rootkit, Beechey 2010, Windows Commands JPCERT, NSA MS AppLocker...}
Platform : {Windows Server 2003, Windows Server 2008, Windows Server 2012, Windows XP...}
Name : {Rootkit}
CAPEC ID : {}
Requires Permission : {Administrator, SYSTEM}
URL : https://attack.mitre.org/wiki/Technique/T1014
.EXAMPLE
This query matches against all the group that use a specific software (in this case Cobalt Strike)
SYNTAX: "Software: <tool name>"
Invoke-ATTACKAPI -Category -Group -Tool "Software: Cobalt Strike"
Tool : {Software: Cobalt Strike, Software: KOMPROGO, Software: WINDSHIELD, Software: SOUNDBITE...}
Alias : {APT32, OceanLotus Group}
ID : {G0050}
URL : https://attack.mitre.org/wiki/Group/G0050
TechniqueName : {Scheduled Task, Regsvr32, PowerShell, Custom Command and Control Protocol...}
FullText : Group/G0050
Reference : {FireEye APT32 May 2017, GitHub Malleable C2, GitHub Invoke-Obfuscation}
Link Text : {[[Group/G0050|APT32]]}
Name : {APT32}
Description : {[[Group/G0050|APT32]] is a threat group that has been active since at least 2014. The group
has targeted multiple private sector industries as well as with foreign governments,
dissidents, and journalists. The group's operations are aligned with Vietnamese state
interests.[[CiteRef::FireEye APT32 May 2017]]}
TechniqueID : {Technique/T1053, Technique/T1117, Technique/T1086, Technique/T1094...}
Display Title : Group: APT32, OceanLotus Group
.EXAMPLE
[BETA] Exporting custom results to a CSV
Invoke-ATTACKAPI -Category -Technique | where-object -Property ID -GE "T1134" |
select @{Name="Name"; Expression={$_.Name -join ","}}, @{Name="Tactic"; Expression={$_.Tactic -join ","}}, @{Name ="ID"; Expression={$_.ID -join ","}},
@{Name="Description"; Expression={$_.Description -join ","}}, @{Name="Analytic details"; Expression={$_.'Analytic Details' -join ","}},
@{Name="Data Source";Expression={$_.'Data Source' -join ","}} | export-csv F:\wardog\scripts\demo6.csv -NoTypeInformation
.EXAMPLE
Showing an up to date table with all the valuable information from the MITRE ATTACK DB at once
Invoke-ATTACKAPI -All | ft
Tactic TechniqueName TechniqueID Group Group Alias Group ID Tool
------ ------------- ----------- ----- ----------- -------- ----
Collection Screen Capture Technique/T1113 APT28 {APT28, Sednit, Sofacy, Pawn Storm...} G0007
Collection Screen Capture Technique/T1113 APT28 {APT28, Sednit, Sofacy, Pawn Storm...} G0007 Software: XAgentOSX
Collection Data from Local System Technique/T1005 APT1 {APT1, Comment Crew, Comment Group, Comment Panda} G0006
Collection Screen Capture Technique/T1113 Cleaver {Cleaver, TG-2889, Threat Group 2889} G0003 Software: TinyZBot
Collection Screen Capture Technique/T1113 APT32 {APT32, OceanLotus Group} G0050 Software: Cobalt Strike
Collection Screen Capture Technique/T1113 APT29 {APT29, The Dukes, Cozy Bear} G0016 Software: CosmicDuke, TinyBaron,...
Collection Data Staged Technique/T1074 APT30 APT30 G0013 Software: SPACESHIP
Collection Data from Local System Technique/T1005 Ke3chang Ke3chang G0004
Collection Data from Local System Technique/T1005 Lazarus Group {Lazarus Group, HIDDEN COBRA, Guardians of Peace} G0032
Collection Data from Local System Technique/T1005 APT29 {APT29, The Dukes, Cozy Bear} G0016 Software: CosmicDuke, TinyBaron,...
Collection Data from Local System Technique/T1005 APT29 {APT29, The Dukes, Cozy Bear} G0016 Software: PinchDuke
Collection Data from Local System Technique/T1005 APT30 APT30 G0013 Software: FLASHFLOOD
Collection Screen Capture Technique/T1113 RTM RTM G0048 Software: RTM
Collection Screen Capture Technique/T1113 MONSOON {MONSOON, Operation Hangover} G0042 Software: BADNEWS
Collection Screen Capture Technique/T1113 menuPass {menuPass, Stone Panda, APT10, Red Apollo...} G0045 Software: RedLeaves, BUGJUICE
Collection Email Collection Technique/T1114 APT29 {APT29, The Dukes, Cozy Bear} G0016 Software: SeaDuke, SeaDaddy, Sea...
Collection Email Collection Technique/T1114 APT1 {APT1, Comment Crew, Comment Group, Comment Panda} G0006
Collection Screen Capture Technique/T1113 Sandworm Team {Sandworm Team, Quedagh} G0034 Software: BlackEnergy, Black Energy
Collection Screen Capture Technique/T1113 FIN7 FIN7 G0046 Software: HALFBAKED
Collection Screen Capture Technique/T1113 Dust Storm Dust Storm G0031 Software: ZLib
Collection Screen Capture Technique/T1113 Dragonfly {Dragonfly, Energetic Bear} G0035 Software: Trojan.Karagany
Collection Screen Capture Technique/T1113 menuPass {menuPass, Stone Panda, APT10, Red Apollo...} G0045 Software: EvilGrab
Collection Screen Capture Technique/T1113 Group5 Group5 G0043
Collection Screen Capture Technique/T1113 Gamaredon Group Gamaredon Group G0047 Software: Pteranodon
Collection Data Staged Technique/T1074 APT30 APT30 G0013 Software: FLASHFLOOD
.EXAMPLE
Show up to date ATT&CK Matrix for Enterprise and export it to a CSV (Technique Names are retrieved as Strings)
Invoke-ATTACKAPI -Matrix | select Persistence, 'Privilege Escalation', 'Defense Evasion','Credential Access', Discovery, 'Lateral Movement', Execution, Collection, Exfiltration, 'Command and Control' | Export-Csv C:\wardog\scripts\matrix.csv -NoTypeInformation
.EXAMPLE
Show an up to date table of Groups/APTs with the techniques and tools attributed to them
Invoke-ATTACKAPI -Attribution | ft
Group Group Alias Group ID Tactic TechniqueName TechniqueID Tool
----- ----------- -------- ------ ------------- ----------- ----
admin@338 admin@338 G0018 Discovery System Time Discovery Technique/T1124 Software: Net, net.exe
admin@338 admin@338 G0018 Defense Evasion Network Share Connection Removal Technique/T1126 Software: Net, net.exe
admin@338 admin@338 G0018 Command and Control Commonly Used Port Technique/T1043 Software: LOWBALL
admin@338 admin@338 G0018 {Command and Control, Lateral Movement} Remote File Copy Technique/T1105 Software: LOWBALL
admin@338 admin@338 G0018 Discovery System Network Connections Discovery Technique/T1049 Software: netstat, netstat.exe
admin@338 admin@338 G0018 Discovery System Information Discovery Technique/T1082 Software: BUBBLEWRAP, Backdoor.APT...
admin@338 admin@338 G0018 Discovery Account Discovery Technique/T1087
admin@338 admin@338 G0018 Execution Command-Line Interface Technique/T1059
admin@338 admin@338 G0018 Discovery System Service Discovery Technique/T1007
admin@338 admin@338 G0018 Defense Evasion Masquerading Technique/T1036
admin@338 admin@338 G0018 Discovery Remote System Discovery Technique/T1018 Software: Net, net.exe
admin@338 admin@338 G0018 Discovery System Network Connections Discovery Technique/T1049 Software: Net, net.exe
admin@338 admin@338 G0018 Lateral Movement Windows Admin Shares Technique/T1077 Software: Net, net.exe
admin@338 admin@338 G0018 {Defense Evasion, Privilege Escalation} DLL Injection Technique/T1055 Software: PoisonIvy, Poison Ivy
admin@338 admin@338 G0018 Discovery System Service Discovery Technique/T1007 Software: Net, net.exe
admin@338 admin@338 G0018 Discovery Account Discovery Technique/T1087 Software: Net, net.exe
admin@338 admin@338 G0018 Command and Control Standard Non-Application Layer Protocol Technique/T1095 Software: BUBBLEWRAP, Backdoor.APT...
admin@338 admin@338 G0018 Discovery System Information Discovery Technique/T1082 Software: Systeminfo, systeminfo.exe
admin@338 admin@338 G0018 Credential Access Create Account Technique/T1136 Software: Net, net.exe
admin@338 admin@338 G0018 Discovery Permission Groups Discovery Technique/T1069
admin@338 admin@338 G0018 Discovery Network Share Discovery Technique/T1135 Software: Net, net.exe
admin@338 admin@338 G0018 Command and Control Web Service Technique/T1102 Software: LOWBALL
admin@338 admin@338 G0018 Execution Service Execution Technique/T1035 Software: Net, net.exe
admin@338 admin@338 G0018 Discovery File and Directory Discovery Technique/T1083
admin@338 admin@338 G0018 Discovery Permission Groups Discovery Technique/T1069 Software: Net, net.exe
admin@338 admin@338 G0018 Discovery System Network Connections Discovery Technique/T1049
admin@338 admin@338 G0018 Discovery System Information Discovery Technique/T1082
admin@338 admin@338 G0018 Command and Control Standard Application Layer Protocol Technique/T1071 Software: LOWBALL
admin@338 admin@338 G0018 Command and Control Standard Cryptographic Protocol Technique/T1032 Software: PoisonIvy, Poison Ivy
admin@338 admin@338 G0018 {Collection, Credential Access} Input Capture Technique/T1056 Software: PoisonIvy, Poison Ivy
admin@338 admin@338 G0018 Command and Control Standard Application Layer Protocol Technique/T1071 Software: BUBBLEWRAP, Backdoor.APT...
admin@338 admin@338 G0018 Discovery System Network Configuration Discovery Technique/T1016 Software: ipconfig, ipconfig.exe
admin@338 admin@338 G0018 Discovery System Network Configuration Discovery Technique/T1016
APT1 {APT1, Comment Crew, Comment Group, Comment Panda} G0006 Collection Data from Local System Technique/T1005
APT1 {APT1, Comment Crew, Comment Group, Comment Panda} G0006 Execution Service Execution Technique/T1035 Software: xCmd
APT1 {APT1, Comment Crew, Comment Group, Comment Panda} G0006 Lateral Movement Pass the Hash Technique/T1075 Software: Pass-The-Hash Toolkit
APT1 {APT1, Comment Crew, Comment Group, Comment Panda} G0006 Execution Service Execution Technique/T1035 Software: Net, net.exe
APT1 {APT1, Comment Crew, Comment Group, Comment Panda} G0006 Discovery Remote System Discovery Technique/T1018 Software: Net, net.exe
APT1 {APT1, Comment Crew, Comment Group, Comment Panda} G0006 Collection Email Collection Technique/T1114
APT1 {APT1, Comment Crew, Comment Group, Comment Panda} G0006 Lateral Movement Pass the Hash Technique/T1075
.EXAMPLE
Show an up to date table of the techniques and tools attributed to APT with Group ID G0046 (FIN7)
Invoke-ATTACKAPI -Attribution | Where-Object -Property 'Group ID' -EQ 'G0046' | ft
Group Group Alias Group ID Tactic TechniqueName TechniqueID Tool Description
----- ----------- -------- ------ ------------- ----------- ---- -----------
FIN7 FIN7 G0046 Discovery Process Discovery Technique/T1057 Software: HALFBAKED {[[Software/S0151|HALFBAKED]] can obtain information about running processes on the victim.[[CiteRef::Fir...
FIN7 FIN7 G0046 Persistence Registry Run Keys / Start Folder Technique/T1060 {[[Group/G0046|FIN7]] malware has created a Registry Run key pointing to its malicious LNK file to establ...
FIN7 FIN7 G0046 Discovery Query Registry Technique/T1012 Software: POWERSOURCE, DNSMessenger {[[Software/S0145|POWERSOURCE]] queries Registry keys in preparation for setting Run keys to achieve pers...
FIN7 FIN7 G0046 Persistence Registry Run Keys / Start Folder Technique/T1060 Software: POWERSOURCE, DNSMessenger {[[Software/S0145|POWERSOURCE]] achieves persistence by setting a Registry Run key, with the path dependi...
FIN7 FIN7 G0046 {Command and Control, Lateral Movement} Remote File Copy Technique/T1105 Software: POWERSOURCE, DNSMessenger {[[Software/S0145|POWERSOURCE]] has been observed being used to download [[Software/S0146|TEXTMATE]] and ...
FIN7 FIN7 G0046 {Execution, Persistence, Privilege Escalation} Application Shimming Technique/T1138 {[[Group/G0046|FIN7]] has used application shim databases for persistence.[[CiteRef::FireEye FIN7 Shim Da...
FIN7 FIN7 G0046 {Execution, Persistence, Privilege Escalation} Scheduled Task Technique/T1053 {[[Group/G0046|FIN7]] malware has created scheduled tasks to establish persistence.[[CiteRef::FireEye FIN...
FIN7 FIN7 G0046 Command and Control Standard Application Layer Protocol Technique/T1071 Software: Carbanak, Anunak {The [[Software/S0030|Carbanak]] malware communicates to its command server using HTTP with an encrypted ...
FIN7 FIN7 G0046 Collection Screen Capture Technique/T1113 Software: HALFBAKED {[[Software/S0151|HALFBAKED]] can obtain screenshots from the victim.[[CiteRef::FireEye FIN7 April 2017]]}
FIN7 FIN7 G0046 Command and Control Standard Application Layer Protocol Technique/T1071 Software: POWERSOURCE, DNSMessenger {[[Software/S0145|POWERSOURCE]] uses DNS TXT records for C2.[[CiteRef::FireEye FIN7 March 2017]][[CiteRef...
FIN7 FIN7 G0046 Execution Windows Management Instrumentation Technique/T1047 Software: HALFBAKED {[[Software/S0151|HALFBAKED]] can use WMI queries to gather system information.[[CiteRef::FireEye FIN7 Ap...
FIN7 FIN7 G0046 Command and Control Standard Application Layer Protocol Technique/T1071 Software: TEXTMATE, DNSMessenger {[[Software/S0146|TEXTMATE]] uses DNS TXT records for C2.[[CiteRef::FireEye FIN7 March 2017]]}
FIN7 FIN7 G0046 Discovery System Information Discovery Technique/T1082 Software: HALFBAKED {[[Software/S0151|HALFBAKED]] can obtain information about the OS, processor, and BIOS.[[CiteRef::FireEye...
FIN7 FIN7 G0046 {Collection, Credential Access} Input Capture Technique/T1056 Software: Carbanak, Anunak {[[Software/S0030|Carbanak]] contains keylogger functionality.[[CiteRef::Kaspersky Carbanak]]}
FIN7 FIN7 G0046 Command and Control Standard Cryptographic Protocol Technique/T1032 Software: Carbanak, Anunak {[[Software/S0030|Carbanak]] encrypts the message body of HTTP traffic with RC2 and Base64 encoding.[[Cit...
FIN7 FIN7 G0046 Execution PowerShell Technique/T1086 Software: HALFBAKED {[[Software/S0151|HALFBAKED]] can execute PowerShell scripts.[[CiteRef::FireEye FIN7 April 2017]]}
FIN7 FIN7 G0046 {Command and Control, Lateral Movement} Remote File Copy Technique/T1105 {[[Group/G0046|FIN7]] uses a PowerShell script to launch shellcode that retrieves an additional payload.[...
FIN7 FIN7 G0046 Execution PowerShell Technique/T1086 Software: POWERSOURCE, DNSMessenger {[[Software/S0145|POWERSOURCE]] is a PowerShell backdoor.[[CiteRef::FireEye FIN7 March 2017]][[CiteRef::C...
FIN7 FIN7 G0046 Execution PowerShell Technique/T1086 {[[Group/G0046|FIN7]] uses a PowerShell script to launch shellcode that retrieves an additional payload.[...
FIN7 FIN7 G0046 Defense Evasion Masquerading Technique/T1036 {[[Group/G0046|FIN7]] has created a scheduled task named “AdobeFlashSync” to establish persistence.[[Cite...
FIN7 FIN7 G0046 Defense Evasion Obfuscated Files or Information Technique/T1027 Software: POWERSOURCE, DNSMessenger {If the victim is using PowerShell 3.0 or later, [[Software/S0145|POWERSOURCE]] writes its decoded payloa...
FIN7 FIN7 G0046 Defense Evasion File Deletion Technique/T1107 Software: HALFBAKED {[[Software/S0151|HALFBAKED]] can delete a specified file.[[CiteRef::FireEye FIN7 April 2017]]}
FIN7 FIN7 G0046 Execution Command-Line Interface Technique/T1059 Software: TEXTMATE, DNSMessenger {[[Software/S0146|TEXTMATE]] executes cmd.exe to provide a reverse shell to attackers.[[CiteRef::FireEye...
.LINK
https://github.com/Cyb3rWard0g/Invoke-ATTACKAPI
.LINK
https://attack.mitre.org/wiki/Using_the_API
.LINK
https://github.com/SadProcessor/SomeStuff/blob/master/Get-ATTaCK.ps1
.LINK
https://www.semantic-mediawiki.org/wiki/Semantic_MediaWiki
.NOTES
This script was inspired by @SadProcessor's Get-ATTack.ps1 script
#>
[CmdletBinding(HelpURI='https://github.com/Cyb3rWard0g/Invoke-ATTACKAPI',DefaultParameterSetName='NoParam')]
param(
[Parameter(Position=0,Mandatory=$true,ParameterSetname='Technique')]
[Parameter(Position=0,Mandatory=$true,ParameterSetname='Group')]
[Parameter(Position=0,Mandatory=$true,ParameterSetname='Software')]
[Parameter(Position=0,Mandatory=$true,ParameterSetname='Tactic')]
[Parameter(Position=0,Mandatory=$true,ParameterSetname='Reference')][switch]$Category,
[Parameter(Position=1,Mandatory=$true,ParameterSetname='Technique')][switch]$Technique,
[Parameter(Position=1,Mandatory=$true,ParameterSetname='Group')][switch]$Group,
[Parameter(Position=1,Mandatory=$true,ParameterSetname='Software')][switch]$Software,
[Parameter(Position=1,Mandatory=$true,ParameterSetname='Tactic')][switch]$Tactic,
[Parameter(Position=1,Mandatory=$true,ParameterSetname='Reference')][switch]$Reference,
[Parameter(Position=0,Mandatory=$true,ParameterSetname='SyncATTCK')]
[switch]$Sync,
[Parameter(Position=0,Mandatory=$true,ParameterSetname='ATTACKMatrix')]
[switch]$Matrix,
[Parameter(Position=0,Mandatory=$true,ParameterSetname='ATTCKAttribution')]
[switch]$Attribution,
[Parameter(Position=0,Mandatory=$true,ParameterSetname='ATTCKAll')]
[switch]$All
)
DynamicParam
{
$TechniqueSet = $ATTCKLookUp.Technique
$GroupSet = $ATTCKLookUp.Group
$SoftwareSet = $ATTCKLookUp.Software
$TacticSet = $ATTCKLookUp.Tactic
$ReferenceSet = $ATTCKLookUp.Reference
If($PSCmdlet.ParameterSetName -eq 'Technique')
{
# Create Attribute
$Attrib1 = New-Object System.Management.Automation.ParameterAttribute
$Attrib1.Mandatory = $False
$Attrib1.Position = 2
# Create AttributeCollection object for the attribute
$Collection1 = new-object System.Collections.ObjectModel.Collection[System.Attribute]
# Add our custom attribute
$Collection1.Add($Attrib1)
# Add Validate Set
$ValidateSet1=new-object System.Management.Automation.ValidateSetAttribute($TechniqueSet.FullText)
$Collection1.Add($ValidateSet1)
# Create Runtime Parameter
$DynParam1 = New-Object System.Management.Automation.RuntimeDefinedParameter('FullText', [String], $Collection1)
# Create Attribute
$Attrib2 = New-Object System.Management.Automation.ParameterAttribute
$Attrib2.Mandatory = $False
$Attrib2.Position = 3
# Create AttributeCollection object for the attribute
$Collection2 = new-object System.Collections.ObjectModel.Collection[System.Attribute]
# Add our custom attribute
$Collection2.Add($Attrib2)
# Add Validate Set
$ValidateSet2=new-object System.Management.Automation.ValidateSetAttribute($TechniqueSet.ID)
$Collection2.Add($ValidateSet2)
# Create Runtime Parameter
$DynParam2 = New-Object System.Management.Automation.RuntimeDefinedParameter('ID', [String], $Collection2)
# Create Attribute
$Attrib3 = New-Object System.Management.Automation.ParameterAttribute
$Attrib3.Mandatory = $False
$Attrib3.Position = 4
# Create AttributeCollection object for the attribute
$Collection3 = new-object System.Collections.ObjectModel.Collection[System.Attribute]
# Add our custom attribute
$Collection3.Add($Attrib3)
# Add Validate Set
$ValidateSet3=new-object System.Management.Automation.ValidateSetAttribute($TechniqueSet.Name)
$Collection3.Add($ValidateSet3)
# Create Runtime Parameter
$DynParam3 = New-Object System.Management.Automation.RuntimeDefinedParameter('Name', [String], $Collection3)
# Create Attribute
$Attrib4 = New-Object System.Management.Automation.ParameterAttribute
$Attrib4.Mandatory = $False
$Attrib4.Position = 5
# Create AttributeCollection object for the attribute
$Collection4 = new-object System.Collections.ObjectModel.Collection[System.Attribute]
# Add our custom attribute
$Collection4.Add($Attrib4)
# Add Validate Set
$ValidateSet4=new-object System.Management.Automation.ValidateSetAttribute($TechniqueSet.Tactic)
$Collection4.Add($ValidateSet4)
# Create Runtime Parameter
$DynParam4 = New-Object System.Management.Automation.RuntimeDefinedParameter('TechniqueTactic', [String], $Collection4)
# Create Attribute
$Attrib5 = New-Object System.Management.Automation.ParameterAttribute
$Attrib5.Mandatory = $False
$Attrib5.Position = 6
# Create AttributeCollection object for the attribute
$Collection5 = new-object System.Collections.ObjectModel.Collection[System.Attribute]
# Add our custom attribute
$Collection5.Add($Attrib5)
# Add Validate Set
$ValidateSet5=new-object System.Management.Automation.ValidateSetAttribute($TechniqueSet.Platform)
$Collection5.Add($ValidateSet5)
# Create Runtime Parameter
$DynParam5 = New-Object System.Management.Automation.RuntimeDefinedParameter('Platform', [String], $Collection5)
$Dictionary = New-Object System.Management.Automation.RuntimeDefinedParameterDictionary
$Dictionary.Add('FullText', $dynParam1)
$Dictionary.Add('ID', $dynParam2)
$Dictionary.Add('Name', $dynParam3)
$Dictionary.Add('TechniqueTactic', $dynParam4)
$Dictionary.Add('Platform', $dynParam5)
return $Dictionary
}
If($PSCmdlet.ParameterSetName -eq 'Group')
{
# Create Attribute
$Attrib1 = New-Object System.Management.Automation.ParameterAttribute
$Attrib1.Mandatory = $False
$Attrib1.Position = 2
# Create AttributeCollection object for the attribute
$Collection1 = new-object System.Collections.ObjectModel.Collection[System.Attribute]
# Add our custom attribute
$Collection1.Add($Attrib1)
# Add Validate Set
$ValidateSet1=new-object System.Management.Automation.ValidateSetAttribute($GroupSet.FullText)
$Collection1.Add($ValidateSet1)
# Create Runtime Parameter
$DynParam1 = New-Object System.Management.Automation.RuntimeDefinedParameter('FullText', [String], $Collection1)
# Create Attribute
$Attrib2 = New-Object System.Management.Automation.ParameterAttribute
$Attrib2.Mandatory = $False
$Attrib2.Position = 3
# Create AttributeCollection object for the attribute
$Collection2 = new-object System.Collections.ObjectModel.Collection[System.Attribute]
# Add our custom attribute
$Collection2.Add($Attrib2)
# Add Validate Set
$ValidateSet2=new-object System.Management.Automation.ValidateSetAttribute($GroupSet.ID)
$Collection2.Add($ValidateSet2)
# Create Runtime Parameter
$DynParam2 = New-Object System.Management.Automation.RuntimeDefinedParameter('ID', [String], $Collection2)
# Create Attribute
$Attrib3 = New-Object System.Management.Automation.ParameterAttribute
$Attrib3.Mandatory = $False
$Attrib3.Position = 4
# Create AttributeCollection object for the attribute
$Collection3 = new-object System.Collections.ObjectModel.Collection[System.Attribute]
# Add our custom attribute
$Collection3.Add($Attrib3)
# Add Validate Set
$ValidateSet3=new-object System.Management.Automation.ValidateSetAttribute($GroupSet.Name)
$Collection3.Add($ValidateSet3)
# Create Runtime Parameter
$DynParam3 = New-Object System.Management.Automation.RuntimeDefinedParameter('Name', [String], $Collection3)
# Create Attribute
$Attrib4 = New-Object System.Management.Automation.ParameterAttribute
$Attrib4.Mandatory = $False
$Attrib4.Position = 5
# Create AttributeCollection object for the attribute
$Collection4 = new-object System.Collections.ObjectModel.Collection[System.Attribute]
# Add our custom attribute
$Collection4.Add($Attrib4)
# Add Validate Set
$ValidateSet4=new-object System.Management.Automation.ValidateSetAttribute($GroupSet.Alias)
$Collection4.Add($ValidateSet4)
# Create Runtime Parameter
$DynParam4 = New-Object System.Management.Automation.RuntimeDefinedParameter('Alias', [String], $Collection4)
# Create Attribute
$Attrib5 = New-Object System.Management.Automation.ParameterAttribute
$Attrib5.Mandatory = $False
$Attrib5.Position = 6
# Create AttributeCollection object for the attribute
$Collection5 = new-object System.Collections.ObjectModel.Collection[System.Attribute]
# Add our custom attribute
$Collection5.Add($Attrib5)
# Add Validate Set
$ValidateSet5=new-object System.Management.Automation.ValidateSetAttribute($GroupSet.TechniqueID)
$Collection5.Add($ValidateSet5)
# Create Runtime Parameter
$DynParam5 = New-Object System.Management.Automation.RuntimeDefinedParameter('TechniqueID', [String], $Collection5)
# Create Attribute
$Attrib6 = New-Object System.Management.Automation.ParameterAttribute
$Attrib6.Mandatory = $False
$Attrib6.Position = 7
# Create AttributeCollection object for the attribute
$Collection6 = new-object System.Collections.ObjectModel.Collection[System.Attribute]
# Add our custom attribute
$Collection6.Add($Attrib6)
# Add Validate Set
$ValidateSet6=new-object System.Management.Automation.ValidateSetAttribute($GroupSet.TechniqueName)
$Collection6.Add($ValidateSet6)
# Create Runtime Parameter
$DynParam6 = New-Object System.Management.Automation.RuntimeDefinedParameter('TechniqueName', [String], $Collection6)
# Create Attribute
$Attrib7 = New-Object System.Management.Automation.ParameterAttribute
$Attrib7.Mandatory = $False
$Attrib7.Position = 8
# Create AttributeCollection object for the attribute
$Collection7 = new-object System.Collections.ObjectModel.Collection[System.Attribute]
# Add our custom attribute
$Collection7.Add($Attrib7)
# Add Validate Set
$ValidateSet7=new-object System.Management.Automation.ValidateSetAttribute($GroupSet.Tool)
$Collection7.Add($ValidateSet7)
# Create Runtime Parameter
$DynParam7 = New-Object System.Management.Automation.RuntimeDefinedParameter('Tool', [String], $Collection7)
$Dictionary = New-Object System.Management.Automation.RuntimeDefinedParameterDictionary
$Dictionary.Add('FullText', $dynParam1)
$Dictionary.Add('ID', $dynParam2)
$Dictionary.Add('Name', $dynParam3)
$Dictionary.Add('Alias', $dynParam4)
$Dictionary.Add('TechniqueID', $dynParam5)
$Dictionary.Add('TechniqueName', $dynParam6)
$Dictionary.Add('Tool', $dynParam7)
return $Dictionary
}
If($PSCmdlet.ParameterSetName -eq 'Software')
{
# Create Attribute
$Attrib1 = New-Object System.Management.Automation.ParameterAttribute
$Attrib1.Mandatory = $False
$Attrib1.Position = 2
# Create AttributeCollection object for the attribute
$Collection1 = new-object System.Collections.ObjectModel.Collection[System.Attribute]
# Add our custom attribute
$Collection1.Add($Attrib1)
# Add Validate Set
$ValidateSet1=new-object System.Management.Automation.ValidateSetAttribute($SoftwareSet.FullText)
$Collection1.Add($ValidateSet1)
# Create Runtime Parameter
$DynParam1 = New-Object System.Management.Automation.RuntimeDefinedParameter('FullText', [String], $Collection1)
# Create Attribute
$Attrib2 = New-Object System.Management.Automation.ParameterAttribute
$Attrib2.Mandatory = $False
$Attrib2.Position = 3
# Create AttributeCollection object for the attribute
$Collection2 = new-object System.Collections.ObjectModel.Collection[System.Attribute]
# Add our custom attribute
$Collection2.Add($Attrib2)
# Add Validate Set
$ValidateSet2=new-object System.Management.Automation.ValidateSetAttribute($SoftwareSet.ID)
$Collection2.Add($ValidateSet2)
# Create Runtime Parameter
$DynParam2 = New-Object System.Management.Automation.RuntimeDefinedParameter('ID', [String], $Collection2)
# Create Attribute
$Attrib3 = New-Object System.Management.Automation.ParameterAttribute
$Attrib3.Mandatory = $False
$Attrib3.Position = 4
# Create AttributeCollection object for the attribute
$Collection3 = new-object System.Collections.ObjectModel.Collection[System.Attribute]
# Add our custom attribute
$Collection3.Add($Attrib3)
# Add Validate Set
$ValidateSet3=new-object System.Management.Automation.ValidateSetAttribute($SoftwareSet.Name)
$Collection3.Add($ValidateSet3)
# Create Runtime Parameter
$DynParam3 = New-Object System.Management.Automation.RuntimeDefinedParameter('Name', [String], $Collection3)
# Create Attribute
$Attrib4 = New-Object System.Management.Automation.ParameterAttribute
$Attrib4.Mandatory = $False
$Attrib4.Position = 5
# Create AttributeCollection object for the attribute
$Collection4 = new-object System.Collections.ObjectModel.Collection[System.Attribute]
# Add our custom attribute
$Collection4.Add($Attrib4)
# Add Validate Set
$ValidateSet4=new-object System.Management.Automation.ValidateSetAttribute($SoftwareSet.TechniqueID)
$Collection4.Add($ValidateSet4)
# Create Runtime Parameter
$DynParam4 = New-Object System.Management.Automation.RuntimeDefinedParameter('TechniqueID', [String], $Collection4)
# Create Attribute
$Attrib5 = New-Object System.Management.Automation.ParameterAttribute
$Attrib5.Mandatory = $False
$Attrib5.Position = 6
# Create AttributeCollection object for the attribute
$Collection5 = new-object System.Collections.ObjectModel.Collection[System.Attribute]
# Add our custom attribute
$Collection5.Add($Attrib5)
# Add Validate Set
$ValidateSet5=new-object System.Management.Automation.ValidateSetAttribute($SoftwareSet.TechniqueName)
$Collection5.Add($ValidateSet5)
# Create Runtime Parameter
$DynParam5 = New-Object System.Management.Automation.RuntimeDefinedParameter('TechniqueName', [String], $Collection5)
# Create Attribute
$Attrib6 = New-Object System.Management.Automation.ParameterAttribute
$Attrib6.Mandatory = $False
$Attrib6.Position = 7
# Create AttributeCollection object for the attribute
$Collection6 = new-object System.Collections.ObjectModel.Collection[System.Attribute]
# Add our custom attribute
$Collection6.Add($Attrib6)
# Add Validate Set
$ValidateSet6=new-object System.Management.Automation.ValidateSetAttribute($SoftwareSet.Type)
$Collection6.Add($ValidateSet6)
# Create Runtime Parameter
$DynParam6 = New-Object System.Management.Automation.RuntimeDefinedParameter('Type', [String], $Collection6)
$Dictionary = New-Object System.Management.Automation.RuntimeDefinedParameterDictionary
$Dictionary.Add('FullText', $dynParam1)
$Dictionary.Add('ID', $dynParam2)
$Dictionary.Add('Name', $dynParam3)
$Dictionary.Add('TechniqueID', $dynParam4)
$Dictionary.Add('TechniqueName', $dynParam5)
$Dictionary.Add('Type', $dynParam6)
return $Dictionary
}
If($PSCmdlet.ParameterSetName -eq 'Tactic')
{
# Create Attribute
$Attrib1 = New-Object System.Management.Automation.ParameterAttribute
$Attrib1.Mandatory = $False
$Attrib1.Position = 2
# Create AttributeCollection object for the attribute
$Collection1 = new-object System.Collections.ObjectModel.Collection[System.Attribute]
# Add our custom attribute
$Collection1.Add($Attrib1)
# Add Validate Set
$ValidateSet1=new-object System.Management.Automation.ValidateSetAttribute($TacticSet.FullText)
$Collection1.Add($ValidateSet1)
# Create Runtime Parameter
$DynParam1 = New-Object System.Management.Automation.RuntimeDefinedParameter('Name', [String], $Collection1)
$Dictionary = New-Object System.Management.Automation.RuntimeDefinedParameterDictionary
$Dictionary.Add('Name', $dynParam1)
return $Dictionary
}
If($PSCmdlet.ParameterSetName -eq 'Reference')
{
# Create Attribute
$Attrib1 = New-Object System.Management.Automation.ParameterAttribute
$Attrib1.Mandatory = $Fase
$Attrib1.Position = 2
# Create AttributeCollection object for the attribute
$Collection1 = new-object System.Collections.ObjectModel.Collection[System.Attribute]
# Add our custom attribute
$Collection1.Add($Attrib1)
# Add Validate Set
$ValidateSet1=new-object System.Management.Automation.ValidateSetAttribute($ReferenceSet.FullText)
$Collection1.Add($ValidateSet1)
# Create Runtime Parameter
$DynParam1 = New-Object System.Management.Automation.RuntimeDefinedParameter('FullText', [String], $Collection1)
# Create Attribute
$Attrib2 = New-Object System.Management.Automation.ParameterAttribute
$Attrib2.Mandatory = $False
$Attrib2.Position = 3
# Create AttributeCollection object for the attribute
$Collection2 = new-object System.Collections.ObjectModel.Collection[System.Attribute]
# Add our custom attribute
$Collection2.Add($Attrib2)
# Add Validate Set
$ValidateSet2=new-object System.Management.Automation.ValidateSetAttribute($ReferenceSet.Key)
$Collection2.Add($ValidateSet2)
# Create Runtime Parameter
$DynParam2 = New-Object System.Management.Automation.RuntimeDefinedParameter('Key', [String], $Collection2)
# Create Attribute
$Attrib3 = New-Object System.Management.Automation.ParameterAttribute
$Attrib3.Mandatory = $False
$Attrib3.Position = 4
# Create AttributeCollection object for the attribute
$Collection3 = new-object System.Collections.ObjectModel.Collection[System.Attribute]
# Add our custom attribute
$Collection3.Add($Attrib3)
# Add Validate Set
$ValidateSet3=new-object System.Management.Automation.ValidateSetAttribute($ReferenceSet.Name)
$Collection3.Add($ValidateSet3)
# Create Runtime Parameter
$DynParam3 = New-Object System.Management.Automation.RuntimeDefinedParameter('Name', [String], $Collection3)
# Create Attribute
$Attrib4 = New-Object System.Management.Automation.ParameterAttribute
$Attrib4.Mandatory = $False
$Attrib4.Position = 5
# Create AttributeCollection object for the attribute
$Collection4 = new-object System.Collections.ObjectModel.Collection[System.Attribute]
# Add our custom attribute
$Collection4.Add($Attrib4)
# Add Validate Set
$ValidateSet4=new-object System.Management.Automation.ValidateSetAttribute($ReferenceSet.Author)
$Collection4.Add($ValidateSet4)
# Create Runtime Parameter
$DynParam4 = New-Object System.Management.Automation.RuntimeDefinedParameter('Author', [String], $Collection4)
# Create Attribute
$Attrib5 = New-Object System.Management.Automation.ParameterAttribute
$Attrib5.Mandatory = $False
$Attrib5.Position = 6
# Create AttributeCollection object for the attribute
$Collection5 = new-object System.Collections.ObjectModel.Collection[System.Attribute]
# Add our custom attribute
$Collection5.Add($Attrib5)
# Add Validate Set
$ValidateSet5=new-object System.Management.Automation.ValidateSetAttribute($ReferenceSet.Date)
$Collection5.Add($ValidateSet5)
# Create Runtime Parameter
$DynParam5 = New-Object System.Management.Automation.RuntimeDefinedParameter('Date', [String], $Collection5)
# Create Attribute
$Attrib6 = New-Object System.Management.Automation.ParameterAttribute
$Attrib6.Mandatory = $False
$Attrib6.Position = 7
# Create AttributeCollection object for the attribute
$Collection6 = new-object System.Collections.ObjectModel.Collection[System.Attribute]
# Add our custom attribute
$Collection6.Add($Attrib6)
# Add Validate Set
$ValidateSet6=new-object System.Management.Automation.ValidateSetAttribute($ReferenceSet.Year)
$Collection6.Add($ValidateSet6)
# Create Runtime Parameter
$DynParam6 = New-Object System.Management.Automation.RuntimeDefinedParameter('Year', [String], $Collection6)
$Dictionary = New-Object System.Management.Automation.RuntimeDefinedParameterDictionary
$Dictionary.Add('FullText', $dynParam1)
$Dictionary.Add('Key', $dynParam2)
$Dictionary.Add('Name', $dynParam3)
$Dictionary.Add('Author', $dynParam4)
$Dictionary.Add('Date', $dynParam5)
$Dictionary.Add('Year', $dynParam6)
return $Dictionary
}
}
Begin
{
if($PSCmdlet.ParameterSetName -eq 'NoParam'){
get-help Invoke-ATTACKAPI -Online
get-help Invoke-ATTACKAPI
Break
}
if($PSCmdlet.ParameterSetName -eq 'Technique'){
if ($DynParam1.IsSet)
{
$Property = "Fulltext"
$match = "$($DynParam1.value)"
$Query = $ATTCKLookUp.Technique | ? -Property $Property -eq $match
}
elseif ($DynParam2.IsSet)
{
$Property = "ID"
$match = "$($DynParam2.value)"
$Query = $ATTCKLookUp.Technique | ? -Property $Property -eq $match
}
elseif ($DynParam3.IsSet)
{
$Property = "Name"
$match = "$($DynParam3.value)"
$Query = $ATTCKLookUp.Technique | ? -Property $Property -eq $match
}
elseif ($DynParam4.IsSet)
{
$Property = "Tactic"
$match = "$($DynParam4.value)"
$Query = $ATTCKLookUp.Technique | ? -Property $Property -eq $match
}
elseif ($DynParam5.IsSet)
{
$Property = "Platform"
$match = "$($DynParam5.value)"
$Query = $ATTCKLookUp.Technique | ? -Property $Property -eq $match
}
else
{
$Query = $ATTCKLookUp.Technique
}
}
if($PSCmdlet.ParameterSetName -eq 'Group'){
if ($DynParam1.IsSet)
{
$Property = "Fulltext"
$match = "$($DynParam1.value)"
$Query = $ATTCKLookUp.Group| ? -Property $Property -eq $match
}
elseif ($DynParam2.IsSet)
{
$Property = "ID"
$match = "$($DynParam2.value)"
$Query = $ATTCKLookUp.Group | ? -Property $Property -eq $match
}
elseif ($DynParam3.IsSet)
{
$Property = "Name"
$match = "$($DynParam3.value)"
$Query = $ATTCKLookUp.Group | ? -Property $Property -eq $match
}
elseif ($DynParam4.IsSet)
{
$Property = "Alias"
$match = "$($DynParam4.value)"
$Query = $ATTCKLookUp.Group | ? -Property $Property -eq $match
}
elseif ($DynParam5.IsSet)
{
$Property = "TechniqueID"
$match = "$($DynParam5.value)"
$Query = $ATTCKLookUp.Group | ? -Property $Property -eq $match
}
elseif ($DynParam6.IsSet)
{
$Property = "TechniqueName"
$match = "$($DynParam6.value)"
$Query = $ATTCKLookUp.Group | ? -Property $Property -eq $match
}
elseif ($DynParam7.IsSet)
{
$Property = "Tool"
$match = "$($DynParam7.value)"
$Query = $ATTCKLookUp.Group | ? -Property $Property -eq $match
}
else
{
$Query = $ATTCKLookUp.Group
}
}
if($PSCmdlet.ParameterSetName -eq 'Software'){
if ($DynParam1.IsSet)
{
$Property = "Fulltext"
$match = "$($DynParam1.value)"
$Query = $ATTCKLookUp.Software| ? -Property $Property -eq $match
}
elseif ($DynParam2.IsSet)
{
$Property = "ID"
$match = "$($DynParam2.value)"
$Query = $ATTCKLookUp.Software | ? -Property $Property -eq $match
}
elseif ($DynParam3.IsSet)
{
$Property = "Name"
$match = "$($DynParam3.value)"
$Query = $ATTCKLookUp.Software | ? -Property $Property -eq $match
}
elseif ($DynParam4.IsSet)
{
$Property = "TechniqueID"
$match = "$($DynParam4.value)"
$Query = $ATTCKLookUp.Software | ? -Property $Property -eq $match
}
elseif ($DynParam5.IsSet)
{
$Property = "TechniqueName"
$match = "$($DynParam5.value)"
$Query = $ATTCKLookUp.Software | ? -Property $Property -eq $match
}
elseif ($DynParam6.IsSet)
{
$Property = "Type"
$match = "$($DynParam6.value)"
$Query = $ATTCKLookUp.Software | ? -Property $Property -eq $match
}
else
{
$Query = $ATTCKLookUp.Software
}
}
if($PSCmdlet.ParameterSetName -eq 'Tactic'){
if ($DynParam1.IsSet)
{
$Property = "Fulltext"
$match = "$($DynParam1.value)"
$Query = $ATTCKLookUp.Tactic| ? -Property $Property -eq $match
}
else
{
$Query = $ATTCKLookUp.Tactic
}
}
if($PSCmdlet.ParameterSetName -eq 'Reference'){
if ($DynParam1.IsSet)
{
$Property = "Fulltext"
$match = "$($DynParam1.value)"
$Query = $ATTCKLookUp.Reference| ? -Property $Property -eq $match
}
elseif ($DynParam2.IsSet)
{
$Property = "Key"
$match = "$($DynParam2.value)"
$Query = $ATTCKLookUp.Reference | ? -Property $Property -eq $match
}