souleyez 2.43.26__py3-none-any.whl → 2.43.34__py3-none-any.whl

souleyez/detection/__init__.py

@@ -4,4 +4,4 @@
 from .validator import DetectionValidator
 from .attack_signatures import ATTACK_SIGNATURES
 
-__all__ = ['DetectionValidator', 'ATTACK_SIGNATURES']
+__all__ = ["DetectionValidator", "ATTACK_SIGNATURES"]

souleyez/detection/attack_signatures.py

@@ -22,18 +22,21 @@ ATTACK_SIGNATURES: Dict[str, Dict[str, Any]] = {
         "detection_window_seconds": 300,
         "severity": "low",
     },
-
     # Brute force attacks
     "hydra": {
         "description": "Brute force authentication",
         "category": "credential_access",
         "wazuh_rules": [5551, 5710, 5712, 5720, 5763, 5764, 5765],
-        "search_patterns": ["brute force", "authentication failure", "failed login", "invalid user"],
+        "search_patterns": [
+            "brute force",
+            "authentication failure",
+            "failed login",
+            "invalid user",
+        ],
         "expected_fields": ["srcip", "user"],
         "detection_window_seconds": 600,
         "severity": "high",
     },
-
     "medusa": {
         "description": "Brute force authentication",
         "category": "credential_access",
@@ -43,7 +46,6 @@ ATTACK_SIGNATURES: Dict[str, Dict[str, Any]] = {
         "detection_window_seconds": 600,
         "severity": "high",
     },
-
     # Web application attacks
     "sqlmap": {
         "description": "SQL injection attempts",
@@ -54,17 +56,20 @@ ATTACK_SIGNATURES: Dict[str, Dict[str, Any]] = {
         "detection_window_seconds": 300,
         "severity": "critical",
     },
-
     "gobuster": {
         "description": "Directory enumeration / forced browsing",
         "category": "web_attack",
         "wazuh_rules": [31100, 31101, 31120, 31121, 31122],
-        "search_patterns": ["web scanner", "directory traversal", "404", "403 forbidden"],
+        "search_patterns": [
+            "web scanner",
+            "directory traversal",
+            "404",
+            "403 forbidden",
+        ],
         "expected_fields": ["srcip", "url"],
         "detection_window_seconds": 300,
         "severity": "medium",
     },
-
     "ffuf": {
         "description": "Fuzzing / directory enumeration",
         "category": "web_attack",
@@ -74,7 +79,6 @@ ATTACK_SIGNATURES: Dict[str, Dict[str, Any]] = {
         "detection_window_seconds": 300,
         "severity": "medium",
     },
-
     "dirsearch": {
         "description": "Directory enumeration",
         "category": "web_attack",
@@ -84,7 +88,6 @@ ATTACK_SIGNATURES: Dict[str, Dict[str, Any]] = {
         "detection_window_seconds": 300,
         "severity": "medium",
     },
-
     "nikto": {
         "description": "Web vulnerability scanning",
         "category": "web_attack",
@@ -94,7 +97,6 @@ ATTACK_SIGNATURES: Dict[str, Dict[str, Any]] = {
         "detection_window_seconds": 300,
         "severity": "medium",
     },
-
     # SMB/Network attacks
     "crackmapexec": {
         "description": "SMB enumeration and lateral movement",
@@ -105,7 +107,6 @@ ATTACK_SIGNATURES: Dict[str, Dict[str, Any]] = {
         "detection_window_seconds": 300,
         "severity": "high",
     },
-
     "smbclient": {
         "description": "SMB share enumeration",
         "category": "reconnaissance",
@@ -115,7 +116,6 @@ ATTACK_SIGNATURES: Dict[str, Dict[str, Any]] = {
         "detection_window_seconds": 300,
         "severity": "low",
     },
-
     # DNS enumeration
     "dnsrecon": {
         "description": "DNS reconnaissance",
@@ -126,7 +126,6 @@ ATTACK_SIGNATURES: Dict[str, Dict[str, Any]] = {
         "detection_window_seconds": 300,
         "severity": "low",
     },
-
     "fierce": {
         "description": "DNS reconnaissance",
         "category": "reconnaissance",
@@ -136,7 +135,6 @@ ATTACK_SIGNATURES: Dict[str, Dict[str, Any]] = {
         "detection_window_seconds": 300,
         "severity": "low",
     },
-
     # Password attacks
     "hashcat": {
         "description": "Password cracking (offline)",
@@ -148,7 +146,6 @@ ATTACK_SIGNATURES: Dict[str, Dict[str, Any]] = {
         "severity": "info",
         "offline": True,
     },
-
     "john": {
         "description": "Password cracking (offline)",
         "category": "credential_access",
@@ -159,7 +156,6 @@ ATTACK_SIGNATURES: Dict[str, Dict[str, Any]] = {
         "severity": "info",
         "offline": True,
     },
-
     # Exploitation
     "metasploit": {
         "description": "Exploitation framework",
@@ -170,7 +166,6 @@ ATTACK_SIGNATURES: Dict[str, Dict[str, Any]] = {
         "detection_window_seconds": 600,
         "severity": "critical",
     },
-
     # Generic/fallback
     "custom": {
         "description": "Custom tool execution",

souleyez/detection/mitre_mappings.py

@@ -127,7 +127,6 @@ MITRE_TECHNIQUES: Dict[str, Dict[str, Any]] = {
         "tools": ["nmap", "nikto", "nuclei"],
         "parent": "T1595",
     },
-
     # Initial Access techniques
     "T1190": {
         "name": "Exploit Public-Facing Application",
@@ -143,7 +142,6 @@ MITRE_TECHNIQUES: Dict[str, Dict[str, Any]] = {
         "description": "Leverage external-facing remote services",
         "tools": ["hydra", "medusa", "crackmapexec"],
     },
-
     # Execution techniques
     "T1059": {
         "name": "Command and Scripting Interpreter",
@@ -152,7 +150,6 @@ MITRE_TECHNIQUES: Dict[str, Dict[str, Any]] = {
         "description": "Abuse command and script interpreters",
         "tools": ["metasploit"],
     },
-
     # Credential Access techniques
     "T1110": {
         "name": "Brute Force",
@@ -194,7 +191,6 @@ MITRE_TECHNIQUES: Dict[str, Dict[str, Any]] = {
         "description": "Search for insecurely stored credentials",
         "tools": ["crackmapexec", "smbclient"],
     },
-
     # Discovery techniques
     "T1046": {
         "name": "Network Service Discovery",
@@ -231,7 +227,6 @@ MITRE_TECHNIQUES: Dict[str, Dict[str, Any]] = {
         "description": "Get a listing of accounts on a system",
         "tools": ["enum4linux", "crackmapexec"],
     },
-
     # Lateral Movement techniques
     "T1021": {
         "name": "Remote Services",
@@ -282,6 +277,7 @@ CATEGORY_TO_TACTICS: Dict[str, List[str]] = {
 @dataclass
 class TechniqueResult:
     """Result of a technique being tested."""
+
     technique_id: str
     technique_name: str
     tactic_id: str
@@ -297,6 +293,7 @@ class TechniqueResult:
 @dataclass
 class TacticResult:
     """Result of a tactic being tested."""
+
     tactic_id: str
     tactic_name: str
     techniques_tested: int = 0
@@ -347,15 +344,17 @@ class MITREMappings:
         techniques = []
         for tech_id in technique_ids:
             tech_data = MITRE_TECHNIQUES.get(tech_id, {})
-            techniques.append({
-                "id": tech_id,
-                "name": tech_data.get("name", "Unknown"),
-                "tactic_id": tech_data.get("tactic_id", ""),
-                "tactic_name": tech_data.get("tactic_name", ""),
-                "description": tech_data.get("description", ""),
-                "is_subtechnique": "." in tech_id,
-                "offline": tech_data.get("offline", False),
-            })
+            techniques.append(
+                {
+                    "id": tech_id,
+                    "name": tech_data.get("name", "Unknown"),
+                    "tactic_id": tech_data.get("tactic_id", ""),
+                    "tactic_name": tech_data.get("tactic_name", ""),
+                    "description": tech_data.get("description", ""),
+                    "is_subtechnique": "." in tech_id,
+                    "offline": tech_data.get("offline", False),
+                }
+            )
 
         return techniques
 
@@ -373,11 +372,13 @@ class MITREMappings:
         tactics = []
         for tactic_id in tactic_ids:
             tactic_data = MITRE_TACTICS.get(tactic_id, {})
-            tactics.append({
-                "id": tactic_id,
-                "name": tactic_data.get("name", "Unknown"),
-                "phase": tactic_data.get("phase", ""),
-            })
+            tactics.append(
+                {
+                    "id": tactic_id,
+                    "name": tactic_data.get("name", "Unknown"),
+                    "phase": tactic_data.get("phase", ""),
+                }
+            )
         return tactics
 
     def get_technique_by_id(self, technique_id: str) -> Optional[Dict[str, Any]]:
@@ -392,18 +393,19 @@ class MITREMappings:
         """Get all tactics sorted by attack phase order."""
         tactics = []
         for tactic_id, tactic_data in MITRE_TACTICS.items():
-            tactics.append({
-                "id": tactic_id,
-                "name": tactic_data["name"],
-                "description": tactic_data["description"],
-                "phase": tactic_data["phase"],
-                "order": tactic_data["order"],
-            })
+            tactics.append(
+                {
+                    "id": tactic_id,
+                    "name": tactic_data["name"],
+                    "description": tactic_data["description"],
+                    "phase": tactic_data["phase"],
+                    "order": tactic_data["order"],
+                }
+            )
         return sorted(tactics, key=lambda x: x["order"])
 
     def build_coverage_matrix(
-        self,
-        detection_results: List[Any]
+        self, detection_results: List[Any]
     ) -> Dict[str, TechniqueResult]:
         """
         Build MITRE ATT&CK coverage matrix from detection results.
@@ -418,19 +420,23 @@ class MITREMappings:
 
         for result in detection_results:
             # Get attack_type (tool name) from result
-            attack_type = getattr(result, 'attack_type', None)
+            attack_type = getattr(result, "attack_type", None)
             if not attack_type:
                 # Try dict access for backwards compatibility
-                attack_type = result.get('attack_type') if isinstance(result, dict) else None
+                attack_type = (
+                    result.get("attack_type") if isinstance(result, dict) else None
+                )
             if not attack_type:
                 continue
 
             # Get detection status
-            status = getattr(result, 'status', None)
+            status = getattr(result, "status", None)
             if not status:
-                status = result.get('detection_status') if isinstance(result, dict) else None
+                status = (
+                    result.get("detection_status") if isinstance(result, dict) else None
+                )
             if not status:
-                status = result.get('status') if isinstance(result, dict) else 'unknown'
+                status = result.get("status") if isinstance(result, dict) else "unknown"
 
             # Map tool to techniques
             techniques = self.map_tool_to_techniques(attack_type)
@@ -461,7 +467,9 @@ class MITREMappings:
 
         # Calculate detection rates
         for tech_result in matrix.values():
-            countable = tech_result.detected + tech_result.not_detected + tech_result.partial
+            countable = (
+                tech_result.detected + tech_result.not_detected + tech_result.partial
+            )
             if countable > 0:
                 tech_result.detection_rate = round(
                     (tech_result.detected / countable) * 100, 1
@@ -470,8 +478,7 @@ class MITREMappings:
         return matrix
 
     def build_tactic_summary(
-        self,
-        technique_matrix: Dict[str, TechniqueResult]
+        self, technique_matrix: Dict[str, TechniqueResult]
     ) -> Dict[str, TacticResult]:
         """
         Build tactic-level summary from technique coverage matrix.
@@ -517,8 +524,7 @@ class MITREMappings:
         return tactic_summary
 
     def get_coverage_gaps(
-        self,
-        technique_matrix: Dict[str, TechniqueResult]
+        self, technique_matrix: Dict[str, TechniqueResult]
     ) -> List[TechniqueResult]:
         """
         Get techniques that were tested but not detected.
@@ -536,8 +542,7 @@ class MITREMappings:
         return sorted(gaps, key=lambda x: x.not_detected, reverse=True)
 
     def get_heatmap_data(
-        self,
-        technique_matrix: Dict[str, TechniqueResult]
+        self, technique_matrix: Dict[str, TechniqueResult]
     ) -> List[Dict[str, Any]]:
         """
         Generate heatmap data for visualization.
@@ -556,8 +561,7 @@ class MITREMappings:
         for tactic in tactics:
             tactic_id = tactic["id"]
             tactic_techniques = [
-                t for t in technique_matrix.values()
-                if t.tactic_id == tactic_id
+                t for t in technique_matrix.values() if t.tactic_id == tactic_id
             ]
 
             for tech in tactic_techniques:
@@ -571,19 +575,21 @@ class MITREMappings:
                 else:
                     status = "not_tested"
 
-                heatmap.append({
-                    "tactic_id": tactic_id,
-                    "tactic_name": tactic["name"],
-                    "tactic_order": tactic["order"],
-                    "technique_id": tech.technique_id,
-                    "technique_name": tech.technique_name,
-                    "status": status,
-                    "tested": tech.tested,
-                    "detected": tech.detected,
-                    "not_detected": tech.not_detected,
-                    "detection_rate": tech.detection_rate,
-                    "tools_used": tech.tools_used,
-                })
+                heatmap.append(
+                    {
+                        "tactic_id": tactic_id,
+                        "tactic_name": tactic["name"],
+                        "tactic_order": tactic["order"],
+                        "technique_id": tech.technique_id,
+                        "technique_name": tech.technique_name,
+                        "status": status,
+                        "tested": tech.tested,
+                        "detected": tech.detected,
+                        "not_detected": tech.not_detected,
+                        "detection_rate": tech.detection_rate,
+                        "tools_used": tech.tools_used,
+                    }
+                )
 
         return sorted(heatmap, key=lambda x: (x["tactic_order"], x["technique_id"]))