carbonblack / tau-tools Goto Github PK

A repo containing tools developed by Carbon Black's Threat Research Team: Threat Analysis Unit

License: MIT License

Python 37.26% C++ 1.52% C 0.27% YARA 11.73% Shell 0.84% PowerShell 48.38%

tau-tools's Introduction

 _____ _____ _____    _____         _     
|_   _|  _  |  |  |  |_   _|___ ___| |___ 
  | | |     |  |  |    | | | . | . | |_ -|
  |_| |__|__|_____|    |_| |___|___|_|___|

Various tools from the VMware Carbon Black Threat Analysis Unit

VMware Carbon Black ThreatHunter

Watchlist-Manager

VMware Carbon Black Response

CB-Command_R

MITRE ATT&CK

Threat Hunting

Remediation

Threat Emulation

Pseudo Ransomware

Malware Specific

Last updated: March 13, 2020

tau-tools's People

Contributors

Stargazers

Watchers

tau-tools's Issues

Feature request: Analyze watchlists also

I understand that this might be hard to do, but maybe it's easier if we put the ATTACK ID in the Description?

Sometimes we take the query from a threat report and modify it to fit our environment.

Invalid Syntax error in navgen.py

I'm attempting to run the navgen.py, but keep getting an error after I input the Cb Response URL.
Below is the syntax I get. I have replaced the URL in this extract to the default example URL, but I get the exact same error when I add in our true URL:

[!] To find your API key, login to your Cb Response UI and navigate to the profile section.
[!] Here, enter the full url of your Cb Response instance. Example: https://bugcrowd.my.carbonblack.io
[*] > https://bugcrowd.my.carbonblack.io
Traceback (most recent call last):
File "navgen.py", line 499, in
main()
File "navgen.py", line 456, in main
api_key, url = get_auth()
File "navgen.py", line 12, in get_auth
full_url = input("[!] Here, enter the full url of your Cb Response instance. Example: https://bugcrowd.my.carbonblack.io\n[*] > ")
File "", line 1
https://bugcrowd.my.carbonblack.io
^
SyntaxError: invalid syntax

Importing apt29.ps1

I am experiencing this error when I try importing apt29.ps1. What do I do? I've already set the execution policy to bypass

Any help?

Can not get output in CBR version 6.4.0

File "navgen.py", line 503, in
main()
File "navgen.py", line 469, in main
tid_dict = generate_tid_dict(data_from_cbr)
File "navgen.py", line 355, in generate_tid_dict
if "windows" in threat_report['tags'] or "linux" in threat_report['tags'] or "macos" in threat_report['tags']:
KeyError: 'tags'

Wrong HotFix ID for CVE-2020-0796

tau-tools/remediation/EternalDarkness/EternalDarkness.ps1

Line 33 in 0a99ae6

If ($HotFIX -contains "KB4540673")

Based on https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-0796 the Microsoft HotFix should be https://support.microsoft.com/en-us/help/4551762/windows-10-update-kb4551762

SSL: CERTIFICATE_VERIFY_FAILED

I'm attempting to run the navgen.py, but keep getting an SSLError error .
Below is the error:
requests.exceptions.SSLError: HTTPSConnectionPool(host='raw.githubusercontent.com', port=443): Max retries exceeded with url: /mitre/cti/master/enterprise-attack/enterprise-attack.json (Caused by SSLError(SSLCertVerificationError(1, '[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: self signed certificate in certificate chain (_ssl.c:1108)')))

I am using Python38-32 on Windows 10 1909