Requirements¶
Requirements are a mechanism used by CALDERA to determine whether an ability should be run in the course of an operation. By default, CALDERA supplies several requirements within the Stockpile plugin that can be used by an ability to ensure the ability only runs when the facts being used by the ability command meet certain criteria.
Requirements are defined in a Python module and are then referenced inside an ability. All requirements must be provided
at least a source
fact to enforce the defined requirement on. Depending on the requirement module, a requirement
module may also need an edge
value and a target
fact to be provided as arguments to enforce the defined requirement.
See Relationships for more information on relationship source
, edge
, and target
values.
Example¶
Let’s look at the Impersonate User ability from Stockpile as an example.
- id: 3796a00b-b11d-4731-b4ca-275a07d83299
name: Impersonate user
description: Run an application as a different user
tactic: execution
technique:
attack_id: T1059.001
name: "Command and Scripting Interpreter: PowerShell"
platforms:
windows:
psh:
command: |
$job = Start-Job -ScriptBlock {
$username = '#{host.user.name}';
$password = '#{host.user.password}';
$securePassword = ConvertTo-SecureString $password -AsPlainText -Force;
$credential = New-Object System.Management.Automation.PSCredential $username, $securePassword;
Start-Process Notepad.exe -NoNewWindow -PassThru -Credential $credential;
};
Receive-Job -Job $job -Wait;
requirements:
- plugins.stockpile.app.requirements.paw_provenance:
- source: host.user.name
- plugins.stockpile.app.requirements.basic:
- source: host.user.name
edge: has_password
target: host.user.password
Notice in the ability command, two facts host.user.name
and host.user.password
will be used. The paw_provenance
requirement enforces that only host.user.name
facts that were discovered by the agent running the ability can be used
(i.e. fact originated from the same paw
). In the scenario this ability is run against two agents on two different
hosts where multiple host.user.name
and host.user.password
facts were discovered, the paw_provenance
prevents
facts discovered by the first agent on the first host from being used by the second agent on the second host. This
ensures facts discovered locally on one host are only used on the host where those facts would apply, such as in the
scenario the host.user.name
is a local account that only exists on the host it was discovered on. Other possible
usages could apply the paw_provenance
requirement to files discovered, file paths, and running processes, all of
which would be discovered information that should only be used by the host they were discovered on and not globally by
other agents running on other hosts in an operation.
Additionally, the basic
requirement enforces that only host.user.name
facts with an existing has_password
relationship to an existing host.user.password
fact may be used. Brute forcing all available combinations of
host.user.name
facts and host.user.password
facts could result in high numbers of failed login attempts or locking
out an account entirely. The basic
requirement ensures that the user and password combination used has a high chance
of success since the combination’s relationship has already been established by a previous ability.
The combined effect these requirements have ensures that the CALDERA operation will only attempt reliable combinations
of host.user.name
and host.user.password
facts specific to the agent running the ability, instead of arbitrarily
attempting all possible combinations of host.user.name
and host.user.password
facts available to the agent.