Data Exfiltration Payload

[ilija-lazoroski]

Description

Build a payload plugin that allows Infection Monkey to simulate a data exfiltration. The user should be able to configure:

• Root directory (where the data exfiltration will start from)
• Recursive search/exfiltration
• List of file extensions
• Data Generation (If user doesn't have files on the machine but what to simulate data exfiltration, the payload can generate the data)
  • Enabling Data Generation
  • Limit of generated Data in Mb
  • Types of generated Data
• Data Exfiltration Mechanisms. We decided to go with S3 Bucket andSSH/SFTP
  • S3 Bucket Options
    • S3 Bucket URL
    • AWS Credentials: Access Key and Private Key
  • SSH/SFTP
    • Username and Password
    • SSH Keypairs
    • Port
    • Data Location

Data Exfiltration Payload branch

Notes

• All things needed are in a document explaining this payload.
• The research done about this payload can be found in this issue.
• The initial example config schema is provided.
• We need to be able to exfiltrate a massive amount of data. Take that into consideration when implementing the payload.

Tasks

• [ ] Create plugin skeleton
  • [ ] Options (pydantic)
    • [ ] Determine the options needed based on the example schema provided
    • [ ] Create a pydantic model/s for data exfiltration payload
  • [ ] Create plugin manifest
  • [ ] Fix the provided schema (It may have some missing bits when we do this issue)
• [ ] Research and define events that the payload will generate
• [ ] Fix https://github.com/guardicore/monkey/issues/3887 or https://github.com/guardicore/monkey/issues/3886
• [ ] Build a basic data exfiltration paylod with stubbed components
  • [ ] plugin.py constructs and executes the payload
  • [ ] implement and call stubbed data exfiltrator
    • [ ] implement and call stubbed recursive search for data exfiltration
  • [ ] implement and call stubbed data generator
  • [ ] implement and call stubbed S3 Bucket exfiltration mechanism
  • [ ] implement and call stubbed SSH/SFTP exfiltration mechanism
• [ ] Implement the Data Exfiltrator
  • [ ] Implement recursive search for the Data Exfiltrator
• [ ] Implement the Data Generator
• [ ] Implement S3 Bucket exfiltration mechanism
• [ ] Implement SSH/SFTP exfiltration mechanism
• [ ] Add jenkins job to build the plugin
  • [ ] Update the island build jobs on Jenkins to copy the artifacts from the ransomware plugin build job
• [ ] Final testing
  • [ ] Linux
  • [ ] Windows
• [ ] Add documentation
• [ ] Update Changelog
• [ ] Remove vulture entries

[ilija-lazoroski]

Simplified config schema:

config-schema.json