The purpose of this document is to capture the configuration and setup to run Android on docker on a synology NAS. The purpose of running android is to capture and route notifications via MQTT.
| #baseline_layer.json is exported layer from the navigator... there certainly is a way to create the json from scratch reviewing specs, but it was very fsat to just do this. | |
| $sourcefile = ".attack nav layers\baseline_layer.json" | |
| $offtechoutfile = ".\attack nav layers\offensive_techs.json" | |
| $deftechoutfile = ".\attack nav layers\defensive_techs.json" | |
| #goal here is to: | |
| # define two att&ck navigator layer json files | |
| # one is for offensive techniques |
| $orcacomplianceframework = @" | |
| Collection - Automated Collection - T1119 | |
| Collection - Data from Cloud Storage - T1530 | |
| Collection - Data from Information Repositories - T1213 | |
| Collection - Data Staged - T1074 | |
| Collection - Email Collection - T1114 | |
| Credential Access - Brute Force - T1110 | |
| Credential Access - Forge Web Credentials - T1606 | |
| Credential Access - Modify Authentication Process - T1556 | |
| Credential Access - Multi-Factor Authentication Request Generation - T1621 |
| # summary: | |
| # Process ATT&CK and D3FEND data to indicate likelihood an ATT&CK technique is a choke point as defined in this article (https://medium.com/mitre-engenuity/where-to-begin-prioritizing-att-ck-techniques-c535b50983f4). This theory considers the following conjecture: MITRE will assign research hours to align with prioritization of offensive technique (resulting severity, frequency of observation, etc). This theory considers the following facts: ATT&CK procedure examples are well documented, D3FEND offensive blast radius is well documented. | |
| # Remember to see "Limitations and future work" section of the above blog post/article. | |
| # also see "BIASES WHEN MAPPING TO MITRE ATT&CK" section of (https://www.cisa.gov/uscert/sites/default/files/publications/Best%20Practices%20for%20MITRE%20ATTCK%20Mapping.pdf) | |
| # this covers the following biases: Novelty bias, Visibility bias, Producer bias, Victim bias, Availability bias... | |
| # you won't ever be able to eliminate these, either within yourself, on your team, o |
| # summary of code covered here: https://isc.sans.edu/diary/Port%20Scanning%20in%20Powershell%20Redux%3A%20Speeding%20Up%20the%20Results%20%28challenge%20accepted!%29/29324 | |
| $gkeclusters = [System.Collections.Concurrent.ConcurrentDictionary[string,object]]::new() | |
| $gcpprojects.projectId | % -ThrottleLimit 10 -Parallel { | |
| write-host "checking $($_)" | |
| $dict = $using:gkeclusters | |
| $dict.TryAdd($(gcloud container clusters list --project $_ --format json), $_) | out-null | |
| } |