elastic / SWAT

Simple Workspace Attack Tool (SWAT) is a tool for simulating malicious behavior against Google Workspace in reference to the MITRE ATT&CK framework.
Apache License 2.0
160 stars 7 forks source link

[Bug] Duplicate File Logs for Emulations #73

Open terrancedejesus opened 1 year ago

terrancedejesus commented 1 year ago

🐛 Bug Report

Describe the bug

When running an emulation, there is a separate console and file handler set to self.elogger within BaseEmulation. This allows emulations to use a secondary logger to separate logging. The log files written to are within the logs/ directory where the log file name represents the emulation.

There is a bug currently that is duplicating logs within each respective emulation log file.

Steps to reproduce

Steps to reproduce the behavior:

  1. Start SWAT Shell
  2. Authenticate with OAuth credentials
  3. Run any OOTB emulation
  4. Review log file in logs/

Expected behavior

The logging should only be happening once per self.elogger.* call.

Screenshots

2023-08-12 15:15:32,486 - initial_access.gmail_phishing_form_link - INFO - Created Google Form: 17b0DwhmBY0Ihv_q85zuZj2fJdPYOFQuiuhuZvbGSgAg (gmail_phishing_form_link.py:47)
2023-08-12 15:15:32,486 - initial_access.gmail_phishing_form_link - INFO - Created Google Form: 17b0DwhmBY0Ihv_q85zuZj2fJdPYOFQuiuhuZvbGSgAg (gmail_phishing_form_link.py:47)
2023-08-12 15:15:32,488 - initial_access.gmail_phishing_form_link - INFO - Created email with Google Form link (gmail_phishing_form_link.py:59)
2023-08-12 15:15:32,488 - initial_access.gmail_phishing_form_link - INFO - Created email with Google Form link (gmail_phishing_form_link.py:59)
2023-08-12 15:15:33,333 - initial_access.gmail_phishing_form_link - INFO - Sent email to terrance@dejesusarcheology.com from rekcahatonton@gmail.com (gmail_phishing_form_link.py:65)
2023-08-12 15:15:33,333 - initial_access.gmail_phishing_form_link - INFO - Sent email to terrance@dejesusarcheology.com from rekcahatonton@gmail.com (gmail_phishing_form_link.py:65)

SWAT version

0.0.1

Checklist

Please ensure you've completed the following tasks: