poc2_worked

app/mitre.py

@@ -0,0 +1,80 @@
+from __future__ import annotations
+
+from typing import Any
+
+TACTICS = {
+    "recon": ("TA0043", "Reconnaissance"),
+    "initial-access": ("TA0001", "Initial Access"),
+    "credential-access": ("TA0006", "Credential Access"),
+    "lateral-movement": ("TA0008", "Lateral Movement"),
+    "command-and-control": ("TA0011", "Command and Control"),
+    "exfiltration": ("TA0010", "Exfiltration"),
+    "network-spoofing": ("TA0006", "Credential Access"),
+    "dns-anomaly": ("TA0011", "Command and Control"),
+    "threat-intel": ("TA0011", "Command and Control"),
+}
+
+TECHNIQUES = {
+    "recon": ("T1595", "Active Scanning"),
+    "credential-access": ("T1110", "Brute Force"),
+    "lateral-movement": ("T1021", "Remote Services"),
+    "network-spoofing": ("T1557", "Adversary-in-the-Middle"),
+    "command-and-control": ("T1071", "Application Layer Protocol"),
+    "dns-anomaly": ("T1071.004", "DNS"),
+    "exfiltration": ("T1041", "Exfiltration Over C2 Channel"),
+}
+
+
+def classify(stage: str, summary: str = "", record: dict[str, Any] | None = None) -> list[dict[str, str]]:
+    """Return conservative ATT&CK annotations for one network-observable signal."""
+    stage = str(stage or "").strip().lower()
+    text = f"{stage} {summary or ''}".lower()
+    record = record or {}
+    tactic = TACTICS.get(stage)
+    technique = TECHNIQUES.get(stage)
+
+    if stage == "initial-access":
+        if any(token in text for token in ("exploit", "cve-", "web application", "public-facing")):
+            technique = ("T1190", "Exploit Public-Facing Application")
+        elif any(token in text for token in ("phishing", "smtp", "malicious file")):
+            technique = ("T1566", "Phishing")
+    elif stage in {"command-and-control", "threat-intel"}:
+        if record.get("dns_query") or " dns" in text or "domain" in text:
+            technique = ("T1071.004", "DNS")
+        elif record.get("http_host") or "http" in text:
+            technique = ("T1071.001", "Web Protocols")
+        elif record.get("tls_sni") or record.get("quic_sni") or "tls" in text or "quic" in text:
+            technique = ("T1071", "Application Layer Protocol")
+    elif stage == "lateral-movement":
+        if "rdp" in text or int(record.get("dest_port") or 0) == 3389:
+            technique = ("T1021.001", "Remote Desktop Protocol")
+        elif "smb" in text or int(record.get("dest_port") or 0) in {139, 445}:
+            technique = ("T1021.002", "SMB/Windows Admin Shares")
+        elif "ssh" in text or int(record.get("dest_port") or 0) == 22:
+            technique = ("T1021.004", "SSH")
+    elif stage == "exfiltration":
+        if record.get("dns_query") or "dns" in text or "tunnel" in text:
+            technique = ("T1048", "Exfiltration Over Alternative Protocol")
+
+    if not tactic:
+        return []
+    item = {"tactic_id": tactic[0], "tactic": tactic[1]}
+    if technique:
+        item.update({"technique_id": technique[0], "technique": technique[1]})
+    return [item]
+
+
+def merge(existing: list[dict[str, str]], additions: list[dict[str, str]], limit: int = 24) -> list[dict[str, str]]:
+    out: list[dict[str, str]] = []
+    seen: set[tuple[str, str]] = set()
+    for item in list(existing or []) + list(additions or []):
+        if not isinstance(item, dict):
+            continue
+        key = (str(item.get("tactic_id") or ""), str(item.get("technique_id") or ""))
+        if key in seen or not key[0]:
+            continue
+        seen.add(key)
+        out.append({k: str(v) for k, v in item.items() if v not in (None, "")})
+        if len(out) >= limit:
+            break
+    return out