Oilrig is missing crypt_executables.py

center-for-threat-informed-defense / adversary_emulation_library

An open library of adversary emulation plans designed to empower organizations to test their defenses based on real-world TTPs.

https://ctid.io/adversary-emulation

Apache License 2.0

1.6k stars 292 forks source link

Oilrig is missing crypt_executables.py #134

Closed bleepbop closed 11 months ago

bleepbop commented 1 year ago

For compatibility with CALDERA, Oilrig needs a Resources/utilities/crypt_executables.py file, similarly to the other emulation plans. Oilrig has a few payloads in Resources/Binaries/binaries.zip that are never ingested because there is nothing to decrypt the .zip (aside from doing it manually), but adding crypt_executables.py to this emulation plan should resolve that.