mitre / emu

This CALDERA Plugin converts Adversary Emulation Plans from the Center for Threat Informed Defense
https://caldera.mitre.org/
Apache License 2.0
29 stars 9 forks source link

imported adversary's abilities not created with all executors #10

Closed verdann closed 3 years ago

verdann commented 3 years ago

It appears that the executors defined in the emulation library aren't all being imported, and the second listed (pwsh) is getting done instead of both psh and pwsh. For example coming from apt29 yaml adversary:

Looks like after importing to caldera via emu becomes just: mvanopst@ubuntu:~/caldera$ cat plugins/emu/data/abilities/discovery/24ed020e-4730-4000-b6b4-6b5d3e95314f.yml

It's problematic since even with the 'shells' extension installed to the win10 sandcat agents, I'm only set to run ["cmd","psh"] so I'm missing a bunch of the abilities from an adversary profile.

wbooth commented 3 years ago

thank you! addressed here: https://github.com/mitre/emu/pull/12