search

mitre / caldera

Automated Adversary Emulation Platform
https://caldera.mitre.org
Apache License 2.0
5.66k stars 1.08k forks source link

Ability timeout #962

Closed perra22 closed 4 years ago

perra22 commented 4 years ago

Hi, In which situations abilities (during an operation) can go in timeout?

I'm doing a lateral movement copying Sandcat from a machine to another one and then starting it. I can see that the Sandcat process is up (it appears in Caldera agents tab) but the "Start 54ndc47" step in the operation fall in timeout status.

Thanks!

ghost commented 4 years ago

good question.

abilities will timeout, by default, after 60 seconds. you can override this in the ability YML file itself by adding a timeout property (at the same "level" of indentation as the command itself). The timeout is valued in seconds. Example: 

    command: whoami
    timeout: 120

When CALDERA runs an ability, it will consider it timed out if it doesn't complete within this time. However, that doesn't necessarily mean it didn't work. For example, if a lateral movement command stays alive because it is intended to "live forever" CALDERA may think that command timed out but really it's just long-living.

You can either disregard the timeout feedback - or you can run your command as a "job" or in the background (like nohup) to force it to complete and return a status code, instead of staying alive.

perra22 commented 4 years ago

Thank you for the explanation!