OPSEC warnings completed
This commit is contained in:
marcos.luna
@@ -31,6 +31,7 @@
|
||||
- [Keylogging Support](#%EF%B8%8F-keylogging-support)
|
||||
- [Token Support](#-token-support)
|
||||
- [Context Tracking](#-context-tracking)
|
||||
- [OPSEC Checking](#️-opsec-checking)
|
||||
- [Development](#development)
|
||||
- [Troubleshooting](#troubleshooting)
|
||||
- [Credits](#credits)
|
||||
@@ -1703,6 +1704,217 @@ For more information, see the [Mythic Context Tracking documentation](https://do
|
||||
|
||||
---
|
||||
|
||||
## 🛡️ OPSEC Checking
|
||||
|
||||
Cazalla includes comprehensive **OPSEC Checking** functionality that provides operational security warnings and blocking for commands based on their detection risks. This feature helps operators make informed decisions and prevents accidental OPSEC violations.
|
||||
|
||||
### Overview
|
||||
|
||||
OPSEC Checking is implemented using two types of checks:
|
||||
|
||||
1. **`opsec_pre`**: Runs **before** task creation (`create_tasking`). Can block the task if it detects high-risk operations.
|
||||
2. **`opsec_post`**: Runs **after** task creation but **before** the agent picks up the task. Provides final warnings about artifacts that will be created.
|
||||
|
||||
### How It Works
|
||||
|
||||
#### OPSEC Pre-Check (`opsec_pre`)
|
||||
|
||||
The `opsec_pre` function evaluates the command parameters before creating the task:
|
||||
|
||||
- **Blocking**: Can set `OpsecPreBlocked=True` to prevent task execution
|
||||
- **Warning**: Can provide detailed warnings without blocking
|
||||
- **Bypass Roles**: Defines who can approve blocked tasks:
|
||||
- `operator`: Any operator can bypass
|
||||
- `other_operator`: Requires approval from a different operator
|
||||
- `lead`: Only operation lead can approve
|
||||
|
||||
**Example Flow:**
|
||||
```
|
||||
1. Operator creates task: shell whoami
|
||||
2. opsec_pre detects "whoami" has safer alternative
|
||||
3. Task is BLOCKED with message explaining why
|
||||
4. Another operator must approve to proceed
|
||||
```
|
||||
|
||||
#### OPSEC Post-Check (`opsec_post`)
|
||||
|
||||
The `opsec_post` function runs after task creation but before agent execution:
|
||||
|
||||
- **Artifact Review**: Warns about artifacts that will be created
|
||||
- **Final Warning**: Last chance to cancel before agent picks up task
|
||||
- **Context-Aware**: Can review artifacts generated by `create_tasking`
|
||||
|
||||
**Example Flow:**
|
||||
```
|
||||
1. opsec_pre passes (or is bypassed)
|
||||
2. create_tasking executes
|
||||
3. opsec_post reviews artifacts
|
||||
4. Task is submitted to agent (if approved)
|
||||
```
|
||||
|
||||
### Commands with OPSEC Checking
|
||||
|
||||
#### High-Risk Commands (Blocking)
|
||||
|
||||
| Command | Blocking Conditions | Bypass Role |
|
||||
|---------|---------------------|-------------|
|
||||
| `shell` | Commands with safer Cazalla alternatives (`whoami`, `tasklist`, `powershell`, etc.) | `other_operator` |
|
||||
| `steal_token` | Critical system processes (PID 4) | `other_operator` |
|
||||
| `kill` | Critical system processes (PID 0, 4, 8) | `other_operator` |
|
||||
| `keylog_start` | Always blocked (extremely detectable) | `lead` |
|
||||
| `rm` | Critical system files/directories (System32, SysWOW64, Windows, Boot) | `other_operator` |
|
||||
|
||||
#### Warning-Only Commands
|
||||
|
||||
| Command | Warning Type | Bypass Role |
|
||||
|---------|-------------|-------------|
|
||||
| `screenshot` | Screen capture detection | `operator` |
|
||||
| `rpfwd` | Network activity monitoring | `operator` |
|
||||
| `socks` | High-volume network traffic | `operator` |
|
||||
| `download` | Sensitive file access | `operator` |
|
||||
| `upload` | Executable/script uploads | `operator` |
|
||||
| `make_token` | Authentication event logging | `operator` |
|
||||
| `rev2self` | Token reversion | `operator` |
|
||||
| `list_tokens` | Token enumeration | `operator` |
|
||||
| `cat` | Sensitive file reading | `operator` |
|
||||
| `rm` | File deletion (blocks for system files) | `other_operator` if blocked, `operator` if warning |
|
||||
| `cp` | File copying (sensitive files) | `operator` |
|
||||
|
||||
### Example Messages
|
||||
|
||||
#### Blocking Message (shell whoami)
|
||||
|
||||
```
|
||||
🚨 OPSEC BLOCKED - Command Has Safer Alternative
|
||||
|
||||
This command contains operations that have safer built-in alternatives in Cazalla:
|
||||
|
||||
🚨 whoami: Use Cazalla's 'whoami' command instead (no cmd.exe spawn)
|
||||
|
||||
⚠️ cmd.exe spawn: This command would spawn cmd.exe (highly detectable)
|
||||
|
||||
💡 SAFER ALTERNATIVES:
|
||||
→ Use: 'whoami' (Cazalla built-in, no cmd.exe)
|
||||
|
||||
⚠️ TO PROCEED: You need approval from another operator.
|
||||
This command is blocked to prevent accidental OPSEC violations.
|
||||
```
|
||||
|
||||
#### Warning Message (download)
|
||||
|
||||
```
|
||||
⚠️ OPSEC WARNING - File Download Detected
|
||||
|
||||
File downloads are monitored by:
|
||||
• EDR/XDR solutions
|
||||
• Data loss prevention (DLP) systems
|
||||
• File access monitoring tools
|
||||
• Network monitoring (large file transfers)
|
||||
|
||||
Target File: C:\Windows\System32\config\SAM
|
||||
|
||||
🚨 SENSITIVE FILE DETECTED:
|
||||
🚨 sam: SAM database - Credential extraction heavily monitored
|
||||
|
||||
🔍 DETECTION RISKS:
|
||||
• File access events (if auditing enabled)
|
||||
• Large file transfers (network monitoring)
|
||||
• Sensitive file patterns (DLP detection)
|
||||
• Unusual file access patterns
|
||||
|
||||
✅ This is a WARNING only - command will proceed.
|
||||
Ensure you understand the detection risks before continuing.
|
||||
```
|
||||
|
||||
### OPSEC Checking Logic
|
||||
|
||||
#### Conditional Blocking
|
||||
|
||||
OPSEC checking is **intelligent and conditional**:
|
||||
|
||||
- **Blocking**: Only blocks when there's a clear safer alternative or critical risk
|
||||
- **Warning**: Provides informative warnings for moderate risks
|
||||
- **Context-Aware**: Considers command parameters (PID, file paths, etc.)
|
||||
|
||||
#### Example: `shell` Command
|
||||
|
||||
```python
|
||||
# Blocks if command contains:
|
||||
- "whoami" → Use Cazalla's 'whoami' instead
|
||||
- "tasklist" → Use Cazalla's 'ps' instead
|
||||
- "powershell" → Highly monitored, use alternatives
|
||||
|
||||
# Warns if command contains:
|
||||
- "netstat" → Network enumeration, proceed with caution
|
||||
- "ipconfig" → Network queries, proceed with caution
|
||||
```
|
||||
|
||||
### Bypass Roles
|
||||
|
||||
| Role | Description | Use Case |
|
||||
|------|-------------|----------|
|
||||
| `operator` | Any operator can bypass | Low-risk warnings |
|
||||
| `other_operator` | Requires different operator approval | High-risk operations |
|
||||
| `lead` | Only operation lead can approve | Critical operations (keyloggers) |
|
||||
|
||||
### Benefits
|
||||
|
||||
1. **Prevents Accidents**: Blocks dangerous commands with safer alternatives
|
||||
2. **Informs Operators**: Provides detailed risk information
|
||||
3. **Improves OPSEC**: Reduces accidental detection
|
||||
4. **Educational**: Teaches operators about detection risks
|
||||
5. **Context-Aware**: Adapts to specific command parameters
|
||||
|
||||
### Technical Implementation
|
||||
|
||||
OPSEC checking is implemented in each command's Python definition:
|
||||
|
||||
```python
|
||||
async def opsec_pre(self, taskData: PTTaskMessageAllData) -> PTTTaskOPSECPreTaskMessageResponse:
|
||||
"""
|
||||
OPSEC check before creating the task.
|
||||
"""
|
||||
# Analyze command parameters
|
||||
command = taskData.args.get_arg("command") or ""
|
||||
|
||||
# Determine if blocking is needed
|
||||
blocked = False
|
||||
if "dangerous_pattern" in command:
|
||||
blocked = True
|
||||
|
||||
# Build informative message
|
||||
message = "⚠️ OPSEC WARNING - ...\n\n"
|
||||
message += "Detailed explanation...\n"
|
||||
|
||||
return PTTTaskOPSECPreTaskMessageResponse(
|
||||
TaskID=taskData.Task.ID,
|
||||
Success=True,
|
||||
OpsecPreBlocked=blocked,
|
||||
OpsecPreBypassRole="other_operator" if blocked else "operator",
|
||||
OpsecPreMessage=message
|
||||
)
|
||||
|
||||
async def opsec_post(self, taskData: PTTaskMessageAllData) -> PTTTaskOPSECPostTaskMessageResponse:
|
||||
"""
|
||||
OPSEC check after creating the task.
|
||||
"""
|
||||
# Review artifacts that will be created
|
||||
message = "⚠️ OPSEC POST-CHECK - Artifacts\n\n"
|
||||
message += "Artifacts that will be created...\n"
|
||||
|
||||
return PTTTaskOPSECPostTaskMessageResponse(
|
||||
TaskID=taskData.Task.ID,
|
||||
Success=True,
|
||||
OpsecPostBlocked=False, # Usually don't block in post
|
||||
OpsecPostBypassRole="operator",
|
||||
OpsecPostMessage=message
|
||||
)
|
||||
```
|
||||
|
||||
For more information, see the [Mythic OPSEC Checking documentation](https://docs.mythic-c2.net/customizing/payload-type-development/opsec-checking).
|
||||
|
||||
---
|
||||
|
||||
## 🔧 Development
|
||||
|
||||
### Project Structure
|
||||
|
||||
Reference in New Issue
Block a user