guardicore / guardicore/monkey

Gather already present connections

Open
#592 0 comments 0 reactions 0 assignees View on GitHub
Beginner friendly Complexity: Medium Feature Impact: Low
Dominant language
Python
Stars
7.1k
Forks
830
PR merge metrics
No merged PRs in 30d

Description

Monkey could analyze already established connections on the network in order to
1. Prioritize further scanning/exploitation.
2. For the sake of reporting.

Any number of following steps counts as solution and should be opened as separate PR's.
1. Monkey gathers established network connections and reports them back to the island. We can do that by looking up the ARP table, checking netstat for existing connections and checking the DNS cache. This feature is added to system info collectors in configuration. Example commands that give this info in Windows: `netstat` , `arp`. This feature should end up in configuration as "Established connections collector" plugin in "System info collectors".
2. Monkey parses established network connections to assess which connections happen on the subnetwork that user scans. Relevant connections are sent to island and shown on report.
3. Display already present internal network connections with differently coloured edges and new nodes.
4. Monkey prioritizes scanning/exploiting machines with already present connections instead of blindly searching for machines.
5. Create new ATT&CK configuration value. Map [ATT&CK technique](https://attack.mitre.org/techniques/T1049/) configuration value to the "Established connections collector" system info collector. Make sure to add a section in the ATT&CK report for this technique.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.