You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Describe the bug
I think this is the correct place to open this issue since it is related to the emu plugin's emu_svc.py.
When starting a CALDERA server with enabled emu plugin and the information about APT29 from the adversary emulation library (see here), the wrong payloads are copied to plugins/emu/payloads.
I would expect the emu_svc.py to copy the payloads in plugins/emu/data/adversary-emulation-plans/apt29/resources/ (here) but instead the payloads from the archived directory plugins/emu/data/adversary-emulation-plans/apt29/Archive/CALDERA_DIY/evals/payloads (here) are copied (see output with debug-prints added below). For other emulation plans the correct directory was searched (probably because there is no "Archive" directory?)(tested with carbanak emulation plan).
I know this does not belong here but rather in the adversary-emulation-library but I still want to mention it here. Maybe I will open another issue over there as well about this.
The APT29 adversary emulation library information contains 3 payload directories in total. For example the stepFourteen_bypassUAC.ps1 payload is found 3 times in:
The payload that will be used by the emu plugin is number 3 in the above list.
It is also worth to mention that the payloads' contents are not the same. Also this is really confusing when you want to edit the payloads (which is necessary for the attacks) because it is not clear which are really used by CALDERA.
To Reproduce
Steps to reproduce the behavior:
Enable emu plugin
Start server
Expected behavior
I would expect the emu_svc to copy the payloads from the "not-archived" directory (plugins/emu/data/adversary-emulation-plans/apt29/resources/).
Describe the bug
I think this is the correct place to open this issue since it is related to the emu plugin's emu_svc.py.
When starting a CALDERA server with enabled emu plugin and the information about APT29 from the adversary emulation library (see here), the wrong payloads are copied to
plugins/emu/payloads
.I would expect the emu_svc.py to copy the payloads in
plugins/emu/data/adversary-emulation-plans/apt29/resources/
(here) but instead the payloads from the archived directoryplugins/emu/data/adversary-emulation-plans/apt29/Archive/CALDERA_DIY/evals/payloads
(here) are copied (see output with debug-prints added below). For other emulation plans the correct directory was searched (probably because there is no "Archive" directory?)(tested with carbanak emulation plan).I know this does not belong here but rather in the adversary-emulation-library but I still want to mention it here. Maybe I will open another issue over there as well about this.
The APT29 adversary emulation library information contains 3 payload directories in total. For example the
stepFourteen_bypassUAC.ps1
payload is found 3 times in:The payload that will be used by the emu plugin is number 3 in the above list.
It is also worth to mention that the payloads' contents are not the same. Also this is really confusing when you want to edit the payloads (which is necessary for the attacks) because it is not clear which are really used by CALDERA.
To Reproduce
Steps to reproduce the behavior:
Expected behavior
I would expect the emu_svc to copy the payloads from the "not-archived" directory (
plugins/emu/data/adversary-emulation-plans/apt29/resources/
).Screenshots
Desktop (please complete the following information):
Additional context
...
The text was updated successfully, but these errors were encountered: