guardicore / monkey

Infection Monkey - An open-source adversary emulation platform
https://www.guardicore.com/infectionmonkey/
GNU General Public License v3.0
6.63k stars 775 forks source link

Add credentials collectors explanation pages #4240

Closed shreyamalviya closed 2 months ago

shreyamalviya commented 2 months ago

What does this PR do?

Fixes #4212

PR Checklist

Testing Checklist

codecov[bot] commented 2 months ago

Codecov Report

All modified and coverable lines are covered by tests :white_check_mark:

Project coverage is 77.07%. Comparing base (dd956f4) to head (85099ce). Report is 1 commits behind head on develop.

Additional details and impacted files ```diff @@ Coverage Diff @@ ## develop #4240 +/- ## ======================================== Coverage 77.07% 77.07% ======================================== Files 442 442 Lines 14135 14135 Branches 18 18 ======================================== Hits 10895 10895 Misses 3240 3240 ```

:umbrella: View full report in Codecov by Sentry.
:loudspeaker: Have feedback on the report? Share it here.

mssalvatore commented 2 months ago

I expanded the explanation of Credentials Collectors:

image

I have two seemingly conflicting goals for this:

  1. Provide context. More specifically, answer the question, "why steal credentials?" To that end, we also need to answer, "how are stolen credentials used?"
  2. Keep this page concise and focused.

There may be a little bit too much detail about exploiters here, but I think it's important for users to understand how the stolen credentials are used. I think the solution would be to provide this information under Self-propagating Agent (Issue #4215) and just say, "for information about how stolen credentials are used ... blah blah ... see Self-propagating Agent". Since that page isn't ready yet, I think we should leave this text here. I've left a note in #4215 to extract/repurpose this text as part of that issue.

Similarly, instead of explaining exploiters, I'd rather just use the term "Exploiter" and link to the relevant documentation, but the relevant documentation doesn't exist yet. I've also left a note in #4213.