daemon-sec-lotl

import-loobins.mjs (2284B)

---

 // Import a checked-out upstream into a committed snapshot. Build/deploy is offline.
 import { readFileSync, readdirSync, writeFileSync, mkdirSync } from 'node:fs';
 import { resolve } from 'node:path';
 import { execFileSync } from 'node:child_process';
 import yaml from 'js-yaml';
 import { stableId } from './enrich-data.mjs';
 import { CAPABILITIES } from './technique-schema.mjs';
 
 const checkout = process.argv[2];
 if (!checkout) throw new Error('Usage: node scripts/import-loobins.mjs /path/to/LOOBins-checkout');
 const commit = execFileSync('git', ['-C', checkout, 'rev-parse', 'HEAD'], { encoding: 'utf8' }).trim();
 const http = u => typeof u === 'string' && /^https?:\/\/\S+$/.test(u);
 const techniques = [];
 for (const file of readdirSync(resolve(checkout, 'LOOBins')).filter(f => f.endsWith('.yml')).sort()) {
   const bin = yaml.load(readFileSync(resolve(checkout, 'LOOBins', file), 'utf8'));
   for (const use of bin.example_use_cases || []) {
     if (!use.code?.trim()) continue;
     const ref = `https://github.com/infosecB/LOOBins/blob/${commit}/LOOBins/${file}`;
     techniques.push({
       id: stableId(`loobins:${bin.name}`, `${use.name}\n${use.code}`),
       toolId: `loobins:${bin.name}`, toolName: bin.name, name: use.name.trim(), source: 'LOOBins',
       platform: ['macOS'], capability: (use.tactics || []).filter(t => CAPABILITIES.includes(t)), nativeCategory: use.tactics || [],
       command: use.code.trim(), description: use.description || bin.full_description,
       mitre: [], fullPath: bin.paths || [], environment: ['Local host'], availability: 'Built in',
       verification: 'Upstream reference', compatibility: 'Imported from LOOBins; availability and behaviour depend on macOS version, privacy permissions and installed components. Not lab tested here.',
       detection: (bin.detections || []).map(d => ({ type: d.name, value: http(d.url) ? d.url : d.name })),
       references: [ref, ...(bin.resources || []).map(r => r.url).filter(http)],
     });
   }
 }
 mkdirSync('src/data/sources', { recursive: true });
 writeFileSync('src/data/sources/loobins.json', JSON.stringify({ repository: 'https://github.com/infosecB/LOOBins', commit, license: 'GPL-3.0', techniques }, null, 2) + '\n');
 console.log(`Imported ${techniques.length} use cases at ${commit}.`);