Skip to content

Commit f5c5cfb

Browse files
Cyb3rWard0gCyb3rWard0g
committed
Updated Docs
+ Updated Docs to show new large data set link + Updated data sources collected from Shire network + Re-run stats on every small dataset to show more sources that did not have tasks mapped to them. Stats script was not counting all of them.
1 parent d99ca6a commit f5c5cfb

File tree

34 files changed

+879
-687
lines changed

34 files changed

+879
-687
lines changed

‎README.md‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -67,7 +67,7 @@ However, I believe that we can expedite the emulation of an adversarial techniqu
6767
* [Available Networks](https://mordor.readthedocs.io/en/latest/network_available.html)
6868
* Mordor Categorization
6969
* [Small Datasets](https://mordor.readthedocs.io/en/latest/mordor_categorization.html#small-datasets)
70-
* Large Datasets
70+
* [Large Datasets](https://mordor.readthedocs.io/en/latest/mordor_categorization.html#large-datasets)
7171
* Mordor Data Consumption
7272
* [Kafkacat Style](https://mordor.readthedocs.io/en/latest/consume_mordor.html#kafkacat-style)
7373
* [Jupyter Notebooks Style](https://mordor.readthedocs.io/en/latest/consume_mordor.html#jupyter-notebook-style)

‎docs/build/doctrees/environment.pickle‎

351 Bytes
Binary file not shown.

‎docs/build/doctrees/mordor_categorization.doctree‎

1.89 KB
Binary file not shown.

‎docs/build/doctrees/network_shire.doctree‎

6.27 KB
Binary file not shown.

‎docs/build/html/_sources/mordor_categorization.rst.txt‎

Lines changed: 8 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -12,8 +12,8 @@ Small Datasets
1212
* They lack of context from other techniques that happen in other tactic categories. For example, if mordor data gives you credential dumping sub-techniques, you only get that and not the potential privilege escalation activity that might have been necessary to be able to dump credentials in the first place.
1313
* Think about them as the results of atomic testing.
1414

15-
Examples
16-
********
15+
Example
16+
*******
1717

1818
* `DCSync Dataset <https://github.com/Cyb3rWard0g/mordor/blob/master/small_datasets/windows/credential_access/credential_dumping_T1003/credentials_from_ad/empire_dcsync.md>`_
1919

@@ -23,4 +23,9 @@ Large Datasets
2323
* They are categorized by known APT groups or custom combination of techniques produced in the mordor lab environments
2424
* They represent events that get generated throughout the ``whole attack lifecycle`` (Initial accesss, discovery, privilege escalation, etc)
2525
* They have a lot of context to identify relationships across several data sources produced by the execution of several adversarial techniques in one mordor file.
26-
* This is going to be available by the end of May 2019.
26+
* They are inspired by the `ATT&CK evaluation emulation playbooks <https://attackevals.mitre.org/evaluations.html#>`_
27+
28+
Example
29+
*******
30+
31+
* `APT3 Dataset <https://github.com/Cyb3rWard0g/mordor/tree/master/large_datasets/apt3>`_

‎docs/build/html/_sources/network_shire.rst.txt‎

Lines changed: 52 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -6,6 +6,7 @@ The Shire
66
:scale: 60%
77

88
This mordor environment was designed to replicate a very small network with the essential devices to colllect information from adversarial activities.
9+
This environment is a windows environment.
910

1011
Network Design
1112
##############
@@ -31,27 +32,63 @@ Network Design
3132
+-----------+-------------+---------------+-----------+---------------+---------------+
3233
| Linux | Kali 2018.4 | Red Team C2 | kali | 10.0.10.106 | wardog |
3334
+-----------+-------------+---------------+-----------+---------------+---------------+
34-
| macOS | coming soon | coming soon.. | .. | .. | .. |
35-
+-----------+-------------+---------------+-----------+---------------+---------------+
3635

3736
Data Sources Collected
3837
######################
3938

4039
The initial events that mordor is collecting to test level of visibility are the following:
4140

42-
+----------+-------------------------------------+--------------------------------------------+
43-
| Type | Log Provider | Log Name |
44-
+==========+=====================================+============================================+
45-
| winevent | Microsoft-Windows-Security-Auditing | Security |
46-
+----------+-------------------------------------+--------------------------------------------+
47-
| winevent | Microsoft-Windows-Sysmon | Microsoft-Windows-Sysmon/Operational |
48-
+----------+-------------------------------------+--------------------------------------------+
49-
| winevent | Microsoft-Windows-PowerShell | Microsoft-Windows-PowerShell/Operational |
50-
+----------+-------------------------------------+--------------------------------------------+
51-
| winevent | Powershell | Windows PowerShell |
52-
+----------+-------------------------------------+--------------------------------------------+
53-
| winevent | Microsoft-Windows-WMI-Activity | Microsoft-Windows-WMI-Activity/Operational |
54-
+----------+-------------------------------------+--------------------------------------------+
41+
+------------------------------------------------------------------------+------------------------------------------------------------+
42+
| Log Name | Log Provider |
43+
+========================================================================+============================================================+
44+
| Security | Microsoft-Windows-Security-Auditing |
45+
+------------------------------------------------------------------------+------------------------------------------------------------+
46+
| Microsoft-Windows-Sysmon/Operational | Microsoft-Windows-Sysmon |
47+
+------------------------------------------------------------------------+------------------------------------------------------------+
48+
| Microsoft-Windows-PowerShell/Operational | Microsoft-Windows-PowerShell |
49+
+------------------------------------------------------------------------+------------------------------------------------------------+
50+
| Windows PowerShell | PowerShell |
51+
+------------------------------------------------------------------------+------------------------------------------------------------+
52+
| Microsoft-Windows-WMI-Activity/Operational | Microsoft-Windows-WMI-Activity |
53+
+------------------------------------------------------------------------+------------------------------------------------------------+
54+
| System | Microsoft-Windows-Directory-Services-SAM |
55+
+------------------------------------------------------------------------+------------------------------------------------------------+
56+
| System | Service Control Manager |
57+
+------------------------------------------------------------------------+------------------------------------------------------------+
58+
| System | Microsoft-Windows-GroupPolicy |
59+
+------------------------------------------------------------------------+------------------------------------------------------------+
60+
| System | Microsoft-Windows-Kernel-General |
61+
+------------------------------------------------------------------------+------------------------------------------------------------+
62+
| System | Microsoft-Windows-DistributedCOM |
63+
+------------------------------------------------------------------------+------------------------------------------------------------+
64+
| System | Microsoft-Windows-Winlogon |
65+
+------------------------------------------------------------------------+------------------------------------------------------------+
66+
| System | Microsoft-Windows-DNS-Client |
67+
+------------------------------------------------------------------------+------------------------------------------------------------+
68+
| System | Microsoft-Windows-Ntfs |
69+
+------------------------------------------------------------------------+------------------------------------------------------------+
70+
| System | Microsoft-Windows-WinRM |
71+
+------------------------------------------------------------------------+------------------------------------------------------------+
72+
| System | e1iexpress |
73+
+------------------------------------------------------------------------+------------------------------------------------------------+
74+
| System | Microsoft-Windows-Kernel-Processor-Power |
75+
+------------------------------------------------------------------------+------------------------------------------------------------+
76+
| System | Microsoft-Windows-Power-Troubleshooter |
77+
+------------------------------------------------------------------------+------------------------------------------------------------+
78+
| System | Microsoft-Windows-Wininit |
79+
+------------------------------------------------------------------------+------------------------------------------------------------+
80+
| System | User32 |
81+
+------------------------------------------------------------------------+------------------------------------------------------------+
82+
| System | vmci |
83+
+------------------------------------------------------------------------+------------------------------------------------------------+
84+
| System | vsepflt |
85+
+------------------------------------------------------------------------+------------------------------------------------------------+
86+
| Microsoft-Windows-Windows Firewall With Advanced Security/Firewall | Microsoft-Windows-Windows Firewall With Advanced Security |
87+
+------------------------------------------------------------------------+------------------------------------------------------------+
88+
| Microsoft-Windows-TerminalServices-RemoteConnectionManager/Operational | Microsoft-Windows-TerminalServices-RemoteConnectionManager |
89+
+------------------------------------------------------------------------+------------------------------------------------------------+
90+
| Microsoft-Windows-Bits-Client/Operational | Microsoft-Windows-Bits-Client |
91+
+------------------------------------------------------------------------+------------------------------------------------------------+
5592

5693
Windows Security Auditing
5794
#########################

‎docs/build/html/mordor_categorization.html‎

Lines changed: 14 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -88,10 +88,13 @@
8888
<ul class="current">
8989
<li class="toctree-l1 current"><a class="current reference internal" href="#">Mordor Data Categorization</a><ul>
9090
<li class="toctree-l2"><a class="reference internal" href="#small-datasets">Small Datasets</a><ul>
91-
<li class="toctree-l3"><a class="reference internal" href="#examples">Examples</a></li>
91+
<li class="toctree-l3"><a class="reference internal" href="#example">Example</a></li>
92+
</ul>
93+
</li>
94+
<li class="toctree-l2"><a class="reference internal" href="#large-datasets">Large Datasets</a><ul>
95+
<li class="toctree-l3"><a class="reference internal" href="#id1">Example</a></li>
9296
</ul>
9397
</li>
94-
<li class="toctree-l2"><a class="reference internal" href="#large-datasets">Large Datasets</a></li>
9598
</ul>
9699
</li>
97100
<li class="toctree-l1"><a class="reference internal" href="consume_mordor.html">Mordor Data Consumption</a></li>
@@ -175,8 +178,8 @@ <h2>Small Datasets<a class="headerlink" href="#small-datasets" title="Permalink
175178
<li>They lack of context from other techniques that happen in other tactic categories. For example, if mordor data gives you credential dumping sub-techniques, you only get that and not the potential privilege escalation activity that might have been necessary to be able to dump credentials in the first place.</li>
176179
<li>Think about them as the results of atomic testing.</li>
177180
</ul>
178-
<div class="section" id="examples">
179-
<h3>Examples<a class="headerlink" href="#examples" title="Permalink to this headline"></a></h3>
181+
<div class="section" id="example">
182+
<h3>Example<a class="headerlink" href="#example" title="Permalink to this headline"></a></h3>
180183
<ul class="simple">
181184
<li><a class="reference external" href="https://github.com/Cyb3rWard0g/mordor/blob/master/small_datasets/windows/credential_access/credential_dumping_T1003/credentials_from_ad/empire_dcsync.md">DCSync Dataset</a></li>
182185
</ul>
@@ -188,8 +191,14 @@ <h2>Large Datasets<a class="headerlink" href="#large-datasets" title="Permalink
188191
<li>They are categorized by known APT groups or custom combination of techniques produced in the mordor lab environments</li>
189192
<li>They represent events that get generated throughout the <code class="docutils literal notranslate"><span class="pre">whole</span> <span class="pre">attack</span> <span class="pre">lifecycle</span></code> (Initial accesss, discovery, privilege escalation, etc)</li>
190193
<li>They have a lot of context to identify relationships across several data sources produced by the execution of several adversarial techniques in one mordor file.</li>
191-
<li>This is going to be available by the end of May 2019.</li>
194+
<li>They are inspired by the <a class="reference external" href="https://attackevals.mitre.org/evaluations.html#">ATT&amp;CK evaluation emulation playbooks</a></li>
192195
</ul>
196+
<div class="section" id="id1">
197+
<h3>Example<a class="headerlink" href="#id1" title="Permalink to this headline"></a></h3>
198+
<ul class="simple">
199+
<li><a class="reference external" href="https://github.com/Cyb3rWard0g/mordor/tree/master/large_datasets/apt3">APT3 Dataset</a></li>
200+
</ul>
201+
</div>
193202
</div>
194203
</div>
195204

‎docs/build/html/network_available.html‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -89,6 +89,7 @@
8989
</ul>
9090
<p class="caption"><span class="caption-text">Getting Started:</span></p>
9191
<ul>
92+
<li class="toctree-l1"><a class="reference internal" href="mordor_categorization.html">Mordor Data Categorization</a></li>
9293
<li class="toctree-l1"><a class="reference internal" href="consume_mordor.html">Mordor Data Consumption</a></li>
9394
</ul>
9495
<p class="caption"><span class="caption-text">Licenses:</span></p>

0 commit comments

Comments
 (0)