search

center-for-threat-informed-defense / adversary_emulation_library

An open library of adversary emulation plans designed to empower organizations to test their defenses based on real-world TTPs.
https://ctid.io/adversary-emulation
Apache License 2.0
1.6k stars 292 forks source link

Dependency pinning on APT29 Adversary Emulation Scenario 1 #78

Open Kaenbyo opened 3 years ago

Kaenbyo commented 3 years ago

Hello there,

I'm currently trying to reproduce the APT29 Scenario 1 in local and noticed that the dependencies on the attacker platform (192.168.0.4) aren't pinned.

This is quite troublesome as this doesn't allow to ensure that the environment is identical to the one expected here. As a result, at the time of writing, the step to start Pupy doesn't work as start-compose.sh was removed last month.

Is there any plans to do something about it?

Best regards

leonardogavaudan commented 3 years ago

Hi, these worked for me:


aiohttp-jinja2==1.4.2
aiohttp==3.6.3
aiohttp_session==2.9.0
aiohttp-security==0.4.0
jinja2==2.11.2
pyyaml>=5.1
cryptography==3.3.2
aioconsole==0.1.14
termcolor==1.1.0
pyfiglet==0.8.post1
websockets==8.1
Sphinx==3.5.2
sphinx_rtd_theme==0.5.1
recommonmark==0.7.1

Although I'd recommend looking caldera's new plugin emu that incorporates apt29 attacks released with caldera version 3.0.0 and compatible with 3.1.1

https://github.com/mitre/emu/tree/daed57eb3c611515cc44925b393be7a2f556a965