MITRE ATT&CK Lookup Tool

Last update: Nov 22, 2022

Related tags

Overview

MITRE ATT&CK Lookup Tool

attack-lookup is a tool that lets you easily check what Tactic, Technique, or Sub-technique ID maps to what name, and vice versa. It can be used interactively, for batch processing, or in your own tooling.

Installation

attack-lookup can be installed from PyPi:

$ pip install attack-lookup

It can also be installed manually:

$ git clone https://github.com/curated-intel/attack-lookup.git
$ cd attack-lookup
$ python setup.py install --user

Usage

$ attack-lookup --help
usage: attack-lookup [-h] [-v VERSION] [-m {enterprise,ics,mobile}] [-O] [-i INPUT] [-o OUTPUT] [--output-mode {results,csv}]

MITRE ATT&CK Lookup Tool

optional arguments:
  -h, --help            show this help message and exit
  -v VERSION, --version VERSION
                        ATT&CK matrix version to use (default: v10.1)
  -m {enterprise,ics,mobile}, --matrix {enterprise,ics,mobile}
                        ATT&CK matrix to use (default: enterprise)
  -O, --offline         Run in offline mode (default: False)
  -i INPUT, --input INPUT
                        Path to input file (one lookup value per line) (default: None)
  -o OUTPUT, --output OUTPUT
                        Path to output file (default: -)
  --output-mode {results,csv}
                        Mode for output file ("result" only has the lookup results, "csv" outputs a CSV with the lookup and result values (default: results)

By default, attack-lookup uses the latest version of the Enterprise matrix. When running in Online mode, attack-lookup pulls the latest matrix from MITRE's GitHub repo. When running in Offline mode, it can use any matrix available in attack_lookup/data.

You can use attack-lookup in interactive or batch mode:

$ attack-lookup
(loading latest enterprise matrix...done)
Running attack-lookup in interactive mode, exit with (q)uit
ATT&CK> T1539
Steal Web Session Cookie
ATT&CK>

For batch mode, specify an input file, and optionally an output file/mode. By default, output will go to stdout.

$ attack-lookup -i test
(loading latest enterprise matrix...done)
Collection
T1133
Peripheral Device Discovery

$ attack-lookup -i test --output-mode=csv
(loading latest enterprise matrix...done)
TA0009,Collection
External Remote Services,T1133
T1120,Peripheral Device Discovery

$ attack-lookup -i test --output-mode=csv -o out_file
(loading latest enterprise matrix...done)
Wrote output data to out_file

If multiple mappings exist (e.g., "Domains"), attack-lookup will provide all possible values:

ATT&CK> Domains
Multiple possible values: T1583.001, T1584.001

API

You can also use attack-lookup in your own scripts.

from attack_lookup import AttackMapping

# version is ignored when running online FYSA
mapping = AttackMapping(matrix="enterprise", version="v10.1", offline=False)

# load the data
# this can take ~10sec
if not mapping.load_data():
    print("failed to load data")
else:
    mapping.lookup("T1574") # returns "Hijack Execution Flow"

a tool for annotating table

table_annotate_tool a tool for annotating table motivated by wiki2bio,we create a tool to annoate all types of tables,this tool can annotate a table w

4 Sep 23, 2021

A simple tool that updates your pubspec.yaml file, of a Flutter project, without altering the structure of your file.

3 Dec 10, 2021

A tool written in python to generate basic repo files from github

7 Dec 2, 2021

Simple Python tool that generates a pseudo-random password with numbers, letters, and special characters in accordance with password policy best practices.

7 Mar 25, 2022

Releases(v1.0.1)

v1.0.1(Nov 26, 2021)

Minor update, changed the prompt info.
Source code(tar.gz)
Source code(zip)
v1.0.0(Nov 25, 2021)

This is the first release of attack-lookup.

Offline data includes v10.1 for the Enterprise, ICS, and Mobile matrices.
Source code(tar.gz)
Source code(zip)

MITRE ATT&CK Lookup Tool

Related tags

Overview

MITRE ATT&CK Lookup Tool

Installation

Usage

API

You might also like...

a tool for annotating table

A simple tool that updates your pubspec.yaml file, of a Flutter project, without altering the structure of your file.

A tool written in python to generate basic repo files from github

Simple Python tool that generates a pseudo-random password with numbers, letters, and special characters in accordance with password policy best practices.

SmarTool - Smart Util Tool for Python

A simple tool to move and rename Nvidia Share recordings to a more sensible format.

The Black shade analyser and comparison tool.

This tool analyzes the json files generated by stream-lnd-htlcs to find hidden channel demand.

Animation retargeting tool for Autodesk Maya. Retargets mocap to a custom rig with a few clicks.

Releases(v1.0.1)

v1.0.1(Nov 26, 2021)

v1.0.0(Nov 25, 2021)

Owner

Curated Intel

Python program to do with percentages and chances, random generation.

Automatic generator of readmes for git repositories (Includes file' listing)

A Python script that parses and checks public proxies. Multithreading is supported.

Grank is a feature-rich script that automatically grinds Dank Memer for you

Helper script to bootstrap a Python environment with the tools required to build and install packages.

produces PCA on genotypes from fasta files (popPhyl's ID format)

A module for account creation with python

Cleaning-utils - a collection of small Python functions and classes which make cleaning pipelines shorter and easier

✨ Un générateur d'adresse IP aléatoire totalement fait en Python par moi, et en français.

This two python programs can convert km to miles and miles to km

kawadi is a versatile tool that used as a form of weapon and is used to cut, shape and split wood.

Python program for analyzing the output files of phonopy.

Simple script to export contacts from telegram into vCard file

Build capture utility for Linux

Factoral Methods using two different method

Python based tool to extract forensic info from EventTranscript.db (Windows Diagnostic Data)

Two fast AUC calculation implementations for python

Python humanize functions

This project is a set of programs that I use to create a README.md file.

Lark is a parsing toolkit for Python, built with a focus on ergonomics, performance and modularity.