| """MITRE ATT&CK knowledge base for Shield Agents.""" |
|
|
| MITRE_TECHNIQUES = { |
| "T1190": { |
| "name": "Exploit Public-Facing Application", |
| "tactic": "Initial Access", |
| "description": "Adversaries may exploit weaknesses in public-facing applications.", |
| }, |
| "T1059": { |
| "name": "Command and Scripting Interpreter", |
| "tactic": "Execution", |
| "description": "Adversaries may abuse command and script interpreters.", |
| }, |
| "T1078": { |
| "name": "Valid Accounts", |
| "tactic": "Defense Evasion", |
| "description": "Adversaries may use stolen credentials.", |
| }, |
| "T1110": { |
| "name": "Brute Force", |
| "tactic": "Credential Access", |
| "description": "Adversaries may use brute force techniques.", |
| }, |
| "T1053": { |
| "name": "Scheduled Task/Job", |
| "tactic": "Execution", |
| "description": "Adversaries may abuse task scheduling.", |
| }, |
| "T1041": { |
| "name": "Exfiltration Over C2 Channel", |
| "tactic": "Exfiltration", |
| "description": "Adversaries may steal data through C2 channel.", |
| }, |
| "T1566": { |
| "name": "Phishing", |
| "tactic": "Initial Access", |
| "description": "Adversaries may use phishing to gain access.", |
| }, |
| "T1071": { |
| "name": "Application Layer Protocol", |
| "tactic": "Command and Control", |
| "description": "Adversaries may use application layer protocols for C2.", |
| }, |
| } |
|
|
|
|
| def get_mitre_technique(vulnerability_type: str) -> dict: |
| """Get MITRE ATT&CK technique for a vulnerability type.""" |
| mapping = { |
| "sql_injection": "T1190", |
| "xss": "T1190", |
| "command_injection": "T1059", |
| "credential_theft": "T1110", |
| "brute_force": "T1110", |
| "phishing": "T1566", |
| "exfiltration": "T1041", |
| "c2_communication": "T1071", |
| "injection": "T1190", |
| } |
| tech_id = mapping.get(vulnerability_type.lower(), "T1190") |
| return MITRE_TECHNIQUES.get(tech_id, MITRE_TECHNIQUES["T1190"]) |
|
|
