search

mitre-attack / attack-arsenal

A collection of red team and adversary emulation resources developed and released by MITRE.
Apache License 2.0
491 stars 77 forks source link

APT 29 Installation steps for CALDERA DIY #27

Closed leonardogavaudan closed 3 years ago

leonardogavaudan commented 3 years ago

Hi,

I was trying to follow the installation steps given to reproduce the APT 29 attack. I'm currently on a MacOS BigSur version 11.2.1 and running a zsh shell, although that shouldn't be a problem given that the script interpreters use /bin/bash Go version: go version go1.16.2 darwin/amd64 Python version: Python 3.7.7

The first command given in the 'Initial CALDERA Installation' is:

git clone https://github.com/mitre/caldera.git --recursive --branch 2.6.6 && sudo ./install.sh

My first question is whether the 2.6.6 branch is required for this specific attack, or if we can use the latest branch version in order to limit amount of bugs encountered (perhaps that could be added to the readme).

Edit: Just saw that 2.6.6 was required for the attack, still think it'd be useful to add to readme

And then, because the install.sh file is in the repo itself shouldn't the first command be as such:

git clone https://github.com/mitre/caldera.git --recursive --branch 2.6.6 && sudo ./caldera/install.sh

or

git clone https://github.com/mitre/caldera.git --recursive --branch 2.6.6 && cd caldera && sudo ./install.sh

Hope this helps! Thanks in advance for your help and time. Please let me know if you need anything else.

Leonardo

jcwilliamsATmitre commented 3 years ago

@leonardogavaudan thanks for the notes! Made some changes based on your suggestions but yes you are correct that 2.6.6 is required.

As just a heads up, we ported this over to https://github.com/center-for-threat-informed-defense/adversary_emulation_library a few months ago, but you can still view this format here or in https://github.com/center-for-threat-informed-defense/adversary_emulation_library/tree/master/apt29/Archive.