oxbrbtx/PrimAITE
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

#3075: Markdown changes.

Browse Source
This commit is contained in:
Nick Todd
2025-02-17 14:19:56 +00:00
parent 486c797d60
commit 7e82de919c
3 changed files with 4548 additions and 116 deletions
Download Patch File Download Diff File Expand all files Collapse all files

85
src/primaite/notebooks/Command-and-Control-E2E-Demonstration.ipynb
View File

@@ -6,7 +6,7 @@
"source": [ "source": [
"# Command and Control Application Suite E2E Demonstration\n", "# Command and Control Application Suite E2E Demonstration\n",
"\n", "\n",
"© Crown-owned copyright 2024, Defence Science and Technology Laboratory UK\n", "© Crown-owned copyright 2025, Defence Science and Technology Laboratory UK\n",
"\n", "\n",
"This notebook demonstrates the current implementation of the command and control (C2) server and beacon applications in primAITE." "This notebook demonstrates the current implementation of the command and control (C2) server and beacon applications in primAITE."
] ]
@@ -201,15 +201,15 @@
" nodes: # Node List\n", " nodes: # Node List\n",
" - node_name: web_server\n", " - node_name: web_server\n",
" applications: \n", " applications: \n",
" - application_name: C2Beacon\n", " - application_name: c2-beacon\n",
" ...\n", " ...\n",
" ...\n", " ...\n",
" action_map:\n", " action_map:\n",
" 1:\n", " 1:\n",
" action: node_application_install \n", " action: node-application-install \n",
" options:\n", " options:\n",
" node_id: 0 # Index 0 at the node list.\n", " node_id: 0 # Index 0 at the node list.\n",
" application_name: C2Beacon\n", " application_name: c2-beacon\n",
"```" "```"
] ]
}, },
@@ -244,7 +244,7 @@
" action_map:\n", " action_map:\n",
" ...\n", " ...\n",
" 2:\n", " 2:\n",
" action: configure_c2_beacon\n", " action: configure-c2-beacon\n",
" options:\n", " options:\n",
" node_id: 0 # Node Index\n", " node_id: 0 # Node Index\n",
" config: # Further information about these config options can be found at the bottom of this notebook.\n", " config: # Further information about these config options can be found at the bottom of this notebook.\n",
@@ -273,7 +273,7 @@
"source": [ "source": [
"### **Command and Control** | C2 Beacon Actions | node_application_execute\n", "### **Command and Control** | C2 Beacon Actions | node_application_execute\n",
"\n", "\n",
"The final action is ``node_application_execute`` which is used to establish a connection for the C2 application. This action can be called by the Red Agent via action ``3`` in it's action map. \n", "The final action is ``node-application-execute`` which is used to establish a connection for the C2 application. This action can be called by the Red Agent via action ``3`` in it's action map. \n",
"\n", "\n",
"The yaml snippet below shows all the relevant agent options for this action:\n", "The yaml snippet below shows all the relevant agent options for this action:\n",
"\n", "\n",
@@ -283,13 +283,13 @@
" nodes: # Node List\n", " nodes: # Node List\n",
" - node_name: web_server\n", " - node_name: web_server\n",
" applications: \n", " applications: \n",
" - application_name: C2Beacon\n", " - application_name: c2-beacon\n",
" ...\n", " ...\n",
" ...\n", " ...\n",
" action_map:\n", " action_map:\n",
" ...\n", " ...\n",
" 3:\n", " 3:\n",
" action: node_application_execute\n", " action: node-application-execute\n",
" options:\n", " options:\n",
" node_id: 0\n", " node_id: 0\n",
" application_id: 0\n", " application_id: 0\n",
@@ -331,34 +331,27 @@
"cell_type": "markdown", "cell_type": "markdown",
"metadata": {}, "metadata": {},
"source": [ "source": [
"### **Command and Control** | C2 Server Actions | C2_SERVER_TERMINAL_COMMAND\n", "### **Command and Control** | C2 Server Actions | c2-server-terminal-command\n",
"\n", "\n",
"The C2 Server's terminal action: ``C2_SERVER_TERMINAL_COMMAND`` is indexed at ``4`` in it's action map. \n", "The C2 Server's terminal action: ``c2-server-terminal-command`` is indexed at ``4`` in it's action map. \n",
"\n", "\n",
"This action leverages the terminal service that is installed by default on all nodes to grant red agents a lot more configurability. If you're unfamiliar with terminals then it's recommended that you refer to the ``Terminal Processing`` notebook.\n", "This action leverages the terminal service that is installed by default on all nodes to grant red agents a lot more configurability. If you're unfamiliar with terminals then it's recommended that you refer to the ``Terminal Processing`` notebook.\n",
"\n", "\n",
"It's worth noting that an additional benefit a red agent has when using the terminal service via the C2 Server is that you can execute multiple commands in one action. \n", "It's worth noting that an additional benefit a red agent has when using the terminal service via the C2 Server is that you can execute multiple commands in one action. \n",
"\n", "\n",
"In this notebook, the ``C2_SERVER_TERMINAL_COMMAND`` is used to install a RansomwareScript application on the ``web_server`` node.\n", "In this notebook, the ``c2-server-terminal-command`` is used to install a RansomwareScript application on the ``web_server`` node.\n",
"\n", "\n",
"The yaml snippet below shows all the relevant agent options for this action:\n", "The yaml snippet below shows all the relevant agent options for this action:\n",
"\n", "\n",
"``` yaml\n", "``` yaml\n",
" action_space:\n", " action_space:\n",
" options:\n",
" nodes: # Node List\n",
" ...\n",
" - node_name: client_1\n",
" applications: \n",
" - application_name: C2Server\n",
" ...\n",
" action_map:\n", " action_map:\n",
" ...\n",
" 4:\n", " 4:\n",
" action: C2_SERVER_TERMINAL_COMMAND\n", " action: c2-server-terminal-command\n",
" options:\n", " options:\n",
" node_id: 1\n", " node_name: client_1\n",
" ip_address:\n", " ip_address:\n",
" account:\n",
" username: admin\n", " username: admin\n",
" password: admin\n", " password: admin\n",
" commands:\n", " commands:\n",
@@ -366,7 +359,7 @@
" - software_manager\n", " - software_manager\n",
" - application\n", " - application\n",
" - install\n", " - install\n",
" - RansomwareScript\n", " - ransomware-script\n",
"```" "```"
] ]
}, },
@@ -402,14 +395,8 @@
"\n", "\n",
"``` yaml\n", "``` yaml\n",
" action_space:\n", " action_space:\n",
" options:\n",
" nodes: # Node List\n",
" ...\n",
" - node_name: client_1\n",
" applications: \n",
" - application_name: C2Server\n",
" ...\n",
" action_map:\n", " action_map:\n",
" ...\n",
" 5:\n", " 5:\n",
" action: c2-server-ransomware-configure\n", " action: c2-server-ransomware-configure\n",
" options:\n", " options:\n",
@@ -444,9 +431,9 @@
"cell_type": "markdown", "cell_type": "markdown",
"metadata": {}, "metadata": {},
"source": [ "source": [
"### **Command and Control** | C2 Server Actions | c2_server_data_exfiltrate\n", "### **Command and Control** | C2 Server Actions | c2-server-data-exfiltrate\n",
"\n", "\n",
"The second to last action available is the ``c2_server_data_exfiltrate`` which is indexed as action ``6`` in the action map.\n", "The second to last action available is the ``c2-server-data-exfiltrate`` which is indexed as action ``6`` in the action map.\n",
"\n", "\n",
"This action can be used to exfiltrate a target file on a remote node to the C2 Beacon and the C2 Server's host file system via the ``FTP`` services.\n", "This action can be used to exfiltrate a target file on a remote node to the C2 Beacon and the C2 Server's host file system via the ``FTP`` services.\n",
"\n", "\n",
@@ -454,25 +441,18 @@
"\n", "\n",
"``` yaml\n", "``` yaml\n",
" action_space:\n", " action_space:\n",
" options:\n",
" nodes: # Node List\n",
" ...\n",
" - node_name: client_1\n",
" applications: \n",
" - application_name: C2Server\n",
" ...\n",
" action_map:\n", " action_map:\n",
" ...\n",
" 6:\n", " 6:\n",
" action: c2_server_data_exfiltrate\n", " action: c2-server-data-exfiltrate\n",
" options:\n", " options:\n",
" node_id: 1\n", " node_id: 1\n",
" target_file_name: \"database.db\"\n", " target_file_name: \"database.db\"\n",
" target_folder_name: \"database\"\n", " target_folder_name: \"database\"\n",
" exfiltration_folder_name: \"spoils\"\n", " exfiltration_folder_name: \"spoils\"\n",
" target_ip_address: \"192.168.1.14\"\n", " target_ip_address: \"192.168.1.14\"\n",
" account:\n", " username: \"admin\",\n",
" username: \"admin\",\n", " password: \"admin\"\n",
" password: \"admin\"\n",
"\n", "\n",
"```" "```"
] ]
@@ -510,9 +490,9 @@
"cell_type": "markdown", "cell_type": "markdown",
"metadata": {}, "metadata": {},
"source": [ "source": [
"### **Command and Control** | C2 Server Actions | c2_server_ransomware_launch\n", "### **Command and Control** | C2 Server Actions | c2-server-ransomware-launch\n",
"\n", "\n",
"Finally, the last available action is for the c2_server_ransomware_launch to start the ransomware script installed on the same node as the C2 beacon.\n", "Finally, the last available action is for the c2-server-ransomware-launch to start the ransomware script installed on the same node as the C2 beacon.\n",
"\n", "\n",
"This action is indexed as action ``7``.\n", "This action is indexed as action ``7``.\n",
"\n", "\n",
@@ -520,16 +500,10 @@
"\n", "\n",
"``` yaml\n", "``` yaml\n",
" action_space:\n", " action_space:\n",
" options:\n",
" nodes: # Node List\n",
" ...\n",
" - node_name: client_1\n",
" applications: \n",
" - application_name: C2Server\n",
" ...\n", " ...\n",
" action_map:\n", " action_map:\n",
" 7:\n", " 7:\n",
" action: c2_server_ransomware_launch\n", " action: c2-server-ransomware-launch\n",
" options:\n", " options:\n",
" node_id: 1\n", " node_id: 1\n",
"```\n" "```\n"
@@ -1337,18 +1311,15 @@
"cell_type": "markdown", "cell_type": "markdown",
"metadata": {}, "metadata": {},
"source": [ "source": [
"As demonstrated earlier, red agents can use the ``configure_c2_beacon`` action to configure these settings mid episode through the configuration options:\n", "As demonstrated earlier, red agents can use the ``configure-c2-beacon`` action to configure these settings mid episode through the configuration options:\n",
"\n", "\n",
"``` YAML\n", "``` YAML\n",
"...\n", "...\n",
" action: configure_c2_beacon\n", " action: configure-c2-beacon\n",
" options:\n", " options:\n",
" node_id: 0\n", " node_name: web_server\n",
" config:\n", " config:\n",
" c2_server_ip_address: 192.168.10.21\n", " c2_server_ip_address: 192.168.10.21\n",
" keep_alive_frequency: 10\n",
" masquerade_protocol: TCP\n",
" masquerade_port: DNS\n",
"```" "```"
] ]
}, },

48
src/primaite/notebooks/Data-Manipulation-Customising-Red-Agent.ipynb
View File

@@ -146,42 +146,15 @@
"```yaml\n", "```yaml\n",
" - ref: data_manipulation_attacker # name of agent\n", " - ref: data_manipulation_attacker # name of agent\n",
" team: RED # not used, just for human reference\n", " team: RED # not used, just for human reference\n",
" type: RedDatabaseCorruptingAgent # type of agent - this lets primaite know which agent class to use\n", " type: red-database-corrupting-agent # type of agent - this lets primaite know which agent class to use\n",
"\n",
" # Since the agent does not need to react to what is happening in the environment, the observation space is empty.\n",
" observation_space:\n",
" type: UC2RedObservation\n",
" options:\n",
" nodes: {}\n",
"\n",
" action_space:\n",
" \n",
" # The agent has access to the DataManipulationBoth on clients 1 and 2.\n",
" options:\n",
" nodes:\n",
" - node_name: client_1 # The network should have a node called client_1\n",
" applications:\n",
" - application_name: DataManipulationBot # The node client_1 should have DataManipulationBot configured on it\n",
" - node_name: client_2 # The network should have a node called client_2\n",
" applications:\n",
" - application_name: DataManipulationBot # The node client_2 should have DataManipulationBot configured on it\n",
"\n",
" # not important\n",
" max_folders_per_node: 1\n",
" max_files_per_folder: 1\n",
" max_services_per_node: 1\n",
"\n",
" # red agent does not need a reward function\n",
" reward_function:\n",
" reward_components:\n",
" - type: DUMMY\n",
"\n", "\n",
" # These actions are passed to the RedDatabaseCorruptingAgent init method, they dictate the schedule of attacks\n", " # These actions are passed to the RedDatabaseCorruptingAgent init method, they dictate the schedule of attacks\n",
" agent_settings:\n", " agent_settings:\n",
" start_settings:\n", " possible_start_nodes: [client_1, client_2] # List of clients the attack can start from\n",
" start_step: 25 # first attack at step 25\n", " target_application: data-manipulation-bot\n",
" frequency: 20 # attacks will happen every 20 steps (on average)\n", " start_step: 25 # first attack at step 25\n",
" variance: 5 # the timing of attacks will vary by up to 5 steps earlier or later\n", " frequency: 20 # attacks will happen every 20 steps (on average)\n",
" variance: 5 # the timing of attacks will vary by up to 5 steps earlier or later\n",
"```" "```"
] ]
}, },
@@ -201,8 +174,7 @@
"simulation:\n", "simulation:\n",
" network:\n", " network:\n",
" nodes:\n", " nodes:\n",
" - ref: client_1\n", " - hostname: client_1\n",
" hostname: client_1\n",
" type: computer\n", " type: computer\n",
" ip_address: 192.168.10.21\n", " ip_address: 192.168.10.21\n",
" subnet_mask: 255.255.255.0\n", " subnet_mask: 255.255.255.0\n",
@@ -210,15 +182,13 @@
" \n", " \n",
" # \n", " # \n",
" applications:\n", " applications:\n",
" - ref: data_manipulation_bot\n", " - type: data-manipulation-bot\n",
" type: DataManipulationBot\n",
" options:\n", " options:\n",
" port_scan_p_of_success: 0.8 # Probability that port scan is successful\n", " port_scan_p_of_success: 0.8 # Probability that port scan is successful\n",
" data_manipulation_p_of_success: 0.8 # Probability that SQL attack is successful\n", " data_manipulation_p_of_success: 0.8 # Probability that SQL attack is successful\n",
" payload: \"DELETE\" # The SQL query which causes the attack (this has to be DELETE)\n", " payload: \"DELETE\" # The SQL query which causes the attack (this has to be DELETE)\n",
" server_ip: 192.168.1.14 # IP address of server hosting the database\n", " server_ip: 192.168.1.14 # IP address of server hosting the database\n",
" - ref: client_1_database_client\n", " - type: database-client # Database client must be installed in order for DataManipulationBot to function\n",
" type: DatabaseClient # Database client must be installed in order for DataManipulationBot to function\n",
" options:\n", " options:\n",
" db_server_ip: 192.168.1.14 # IP address of server hosting the database\n", " db_server_ip: 192.168.1.14 # IP address of server hosting the database\n",
"```" "```"

4531
src/primaite/notebooks/Data-Manipulation-E2E-Demonstration.ipynb
View File

File diff suppressed because it is too large Load Diff