CrowdStrike / detection-container

https://quay.io/repository/crowdstrike/detection-container
The Unlicense
39 stars 20 forks source link

some options come back as invalid on the interactive menu #26

Closed carlosmmatos closed 2 years ago

carlosmmatos commented 2 years ago

There seems to be an issue with the interactive menu, and the case statement for when a user selects options 1-#of options. Here is an example:

(starting interactive shell)
V1.8

     Select one of the following TTPs

*********************************************
** 1) Medium - Container Drift via File Creation and Exectuion
** 2) Medium - Defense Evasion via Masquerading
** 3) Critical - Defense Evasion via Rootkit
** 4) High - Execution via Command-Line Interface
** 5) High - Exfiltration Over Alternative Protocol
** 6) High - Command & Control via Remote Access Tools
** 7) High - Collection via Automated Collection
** 8) High - Credential Access via Credential Dumping
** 9) High - Persistance via External Remote Services
** 10) High -Webserver Suspicious Terminal Spawn
** 11) High -Webserver Unexpected Child of Web Service
** 12) High - Webserver Bash Reverse Shell
** 13) Medium - Webserver Trigger Metasploit Payload
** 14) High - (inert) Reverse TCP Trojan

** a) Automatically run random scripts
** o) Generate Overwatch test detection

** e) Exit to Container shell
** x) Exit Container
*********************************************
Please enter a menu option and enter: 2
Pick a valid option from the menu
V1.8

As you can see, 2 is a valid option, and oddly enough, 1 works just fine. In fact if you go through the numbers you will see that some work, and others say invalid. 🤷🏼‍♂️