daemon-sec-lotl

enrich-data.mjs (4329B)

---

 import { readFileSync, writeFileSync } from 'node:fs';
 import { createHash } from 'node:crypto';
 import { fileURLToPath } from 'node:url';
 import { resolve, dirname } from 'node:path';
 import { validateTechniques, SOURCES, PLATFORMS, CAPABILITIES } from './technique-schema.mjs';
 
 const root = resolve(dirname(fileURLToPath(import.meta.url)), '..');
 const read = p => JSON.parse(readFileSync(resolve(root, p), 'utf8'));
 const uniq = a => [...new Set(a)];
 export const stableId = (prefix, value) => `${prefix}:${createHash('sha256').update(value).digest('hex').slice(0, 16)}`;
 
 export function normalizeTechnique(t) {
   const row = { ...t };
   // A Unix command is not evidence of macOS compatibility. Dedicated LOOBins
   // entries retain macOS; GTFOBins entries remain Linux pending per-command review.
   if (row.source === 'GTFOBins') {
     row.platform = row.platform.filter(p => p !== 'macOS');
     row.compatibility = 'Linux reference. macOS compatibility has not been checked for this command and execution context.';
   }
   const itemMap = { No_Creds: 'No credentials', AES_Key: 'AES key', Hash: 'NTLM hash', PFX: 'Certificate', TGT: 'Kerberos ticket', TGS: 'Kerberos ticket', powershell: 'PowerShell', PowerShell: 'PowerShell' };
   row.requires = uniq((row.requires || []).filter(x => !['PrivEsc', 'Exploitation', 'target', 'service'].includes(x)).map(x => itemMap[x] || x));
   row.services = uniq((row.services || []).filter(x => x !== 'Enumeration'));
   row.environment ||= /kubectl|crictl|^ctr$|runc|nerdctl|docker/i.test(row.toolName) ? ['Containers'] : row.platform.includes('ActiveDirectory') ? ['Active Directory'] : ['Local host'];
   row.verification ||= 'Upstream reference';
   row.availability ||= row.source === 'LOOBins' ? 'Built in' : row.source === 'WADComs' || row.toolId.startsWith('wadcoms:') ? 'Installed tool' : 'Check installation';
   return row;
 }
 
 export function enrich() {
   const previous = read('src/data/techniques.json');
   const existingTools = new Map(read('src/data/tools.json').map(t => [t.id, t]));
   const snapshot = read('src/data/sources/loobins.json');
   const additions = read('src/data/catalog-additions.json');
   const replaceIds = new Set([...snapshot.techniques, ...additions].map(t => t.id));
   const techniques = [...previous.filter(t => t.source !== 'LOOBins' && !replaceIds.has(t.id)), ...snapshot.techniques, ...additions].map(normalizeTechnique);
   const tools = new Map();
   for (const t of techniques) {
     const old = existingTools.get(t.toolId);
     t.aliases = uniq([...(t.aliases || []), ...(old?.aliases || [])]);
     if (!tools.has(t.toolId)) tools.set(t.toolId, { ...old, id: t.toolId, name: t.toolName, source: t.source, platform: [], references: [], count: 0 });
     const tool = tools.get(t.toolId);
     tool.platform = uniq([...tool.platform, ...t.platform]);
     tool.references = uniq([...tool.references, ...t.references]);
     tool.count++;
   }
   const problems = validateTechniques(techniques);
   if (problems.length) throw new Error(problems.join('\n'));
   const count = values => values.reduce((a, v) => ({ ...a, [v]: (a[v] || 0) + 1 }), {});
   const facets = read('src/data/facets.json');
   facets.platforms = PLATFORMS.filter(p => techniques.some(t => t.platform.includes(p)));
   facets.sources = SOURCES.filter(s => techniques.some(t => t.source === s));
   facets.capabilities = CAPABILITIES.filter(c => techniques.some(t => t.capability.includes(c)));
   facets.counts = { techniques: techniques.length, tools: tools.size, added: techniques.filter(t => t.added).length,
     bySource: count(techniques.map(t => t.source)), byPlatform: count(techniques.flatMap(t => t.platform)),
     byCapability: count(techniques.flatMap(t => t.capability)), toolsBySource: count([...tools.values()].map(t => t.source)) };
   facets.commits.loobins = snapshot.commit;
   for (const [file, data] of [['techniques', techniques], ['tools', [...tools.values()]], ['facets', facets]]) {
     writeFileSync(resolve(root, `src/data/${file}.json`), JSON.stringify(data, null, file === 'facets' ? 2 : 0) + '\n');
   }
   console.log(`Enriched ${techniques.length} techniques across ${tools.size} tools (${snapshot.techniques.length} LOOBins, ${additions.length} curated additions).`);
 }
 if (process.argv[1] && resolve(process.argv[1]) === fileURLToPath(import.meta.url)) enrich();