Mongo search logic changes + used/scanned/unscanned message changes

guardicore · Jun 26, 2020 · b0c3b50 · b0c3b50
1 parent c8b636d
commit b0c3b50
Show file tree

Hide file tree

Showing 2 changed files with 10 additions and 8 deletions.
diff --git a/monkey/monkey_island/cc/services/attack/technique_reports/T1053.py b/monkey/monkey_island/cc/services/attack/technique_reports/T1053.py
@@ -9,12 +9,13 @@
 
 class T1053(AttackTechnique):
     tech_id = "T1053"
-    unscanned_msg = "Monkey did not try scheduling a job."
-    scanned_msg = "Monkey tried scheduling a job on the system but failed."
-    used_msg = "Monkey scheduled a job on the system."
+    unscanned_msg = "Monkey did not try scheduling a job on Windows."
+    scanned_msg = "Monkey tried scheduling a job on the Windows system but failed."
+    used_msg = "Monkey scheduled a job on the Windows system."
 
     query = [{'$match': {'telem_category': 'post_breach',
-                         'data.name': POST_BREACH_JOB_SCHEDULING}},
+                         'data.name': POST_BREACH_JOB_SCHEDULING,
+                         'data.command': {'$regex': 'schtasks'}}},
              {'$project': {'_id': 0,
                            'machine': {'hostname': '$data.hostname',
                                        'ips': ['$data.ip']},

diff --git a/monkey/monkey_island/cc/services/attack/technique_reports/T1168.py b/monkey/monkey_island/cc/services/attack/technique_reports/T1168.py
@@ -9,12 +9,13 @@
 
 class T1168(AttackTechnique):
     tech_id = "T1168"
-    unscanned_msg = "Monkey did not try scheduling a job."
-    scanned_msg = "Monkey tried scheduling a job on the system but failed."
-    used_msg = "Monkey scheduled a job on the system."
+    unscanned_msg = "Monkey did not try scheduling a job on Linux."
+    scanned_msg = "Monkey tried scheduling a job on the Linux system but failed."
+    used_msg = "Monkey scheduled a job on the Linux system."
 
     query = [{'$match': {'telem_category': 'post_breach',
-                         'data.name': POST_BREACH_JOB_SCHEDULING}},
+                         'data.name': POST_BREACH_JOB_SCHEDULING,
+                         'data.command': {'$regex': 'crontab'}}},
              {'$project': {'_id': 0,
                            'machine': {'hostname': '$data.hostname',
                                        'ips': ['$data.ip']},