daemon-sec-lotl

wadcoms-normalize.mjs (4234B)

---

 /**
  * WADComs family normalisation — shared by the dataset builder
  * (build-dataset.mjs) and the one-time committed-data migration
  * (split-impacket.mjs), so a fresh regen and the checked-in JSON agree.
  *
  * Two normalisations live here:
  *
  *  1. splitImpacket — Impacket is not one tool, it is a *suite* of independent
  *     example scripts (secretsdump.py, ntlmrelayx.py, psexec.py, …). WADComs
  *     files them all under a single "Impacket" family, which collapses ~48
  *     distinct techniques onto one unreadable tool page. We split them back out
  *     by the actual `examples/<script>.py` each technique references, so every
  *     script gets its own tool exactly as impacket ships — `ntlmrelayx.py`'s
  *     ten relay variants group together, `secretsdump.py`'s two do, and so on.
  *
  *  2. canonicalizeFamilyCase — two WADComs families that differ only in case
  *     (e.g. `Enum4Linux` and `enum4linux`) slug to the same route, and the
  *     static tool page silently drops one. We fold case-variants of the same
  *     toolId onto a single canonical spelling (the one with more techniques).
  *
  * Both are pure and deterministic (no wall-clock, no randomness).
  */
 
 // Match `…/impacket/…/examples/<script>.py`. The script basename is impacket's
 // own canonical casing (secretsdump, GetUserSPNs, getST, ntlmrelayx, …).
 const IMPACKET_EXAMPLE_RE = /impacket\/(?:[^\s"']*\/)?examples\/([A-Za-z0-9_+.-]+)\.py/i;
 const PY_BASENAME_RE = /([A-Za-z0-9_+.-]+)\.py/;
 
 /**
  * Resolve the impacket example script a technique belongs to, preferring the
  * `examples/<script>.py` reference URL and falling back to the first `*.py`
  * token in the command. Returns null when neither resolves (the technique is
  * then left under the umbrella Impacket tool rather than mis-filed).
  */
 export function impacketScript(references = [], command = '') {
   for (const r of references) {
     const m = IMPACKET_EXAMPLE_RE.exec(String(r));
     if (m) return m[1];
   }
   const m = PY_BASENAME_RE.exec(String(command));
   return m ? m[1] : null;
 }
 
 /**
  * If a technique is filed under the umbrella `wadcoms:Impacket` family, refile
  * it under `wadcoms:Impacket-<script>` (toolName `Impacket-<script>`) so it
  * lands on the script's own page. Idempotent and a no-op for everything else.
  */
 export function splitImpacket(tech) {
   if (tech.toolId !== 'wadcoms:Impacket') return tech;
   const script = impacketScript(tech.references, tech.command);
   if (!script) return tech;
   return { ...tech, toolId: `wadcoms:Impacket-${script}`, toolName: `Impacket-${script}` };
 }
 
 /**
  * Fold case-duplicate toolIds within one namespace onto a single canonical
  * spelling. The canonical variant is the one carrying the most techniques
  * (tie-break: an uppercase-initial family, then first-seen). Rewrites toolId
  * and toolName in place on a shallow copy; every other field is untouched.
  */
 export function canonicalizeFamilyCase(techniques) {
   // key = lowercased toolId → { count, byId: Map<toolId,{count,name,first}> }
   const groups = new Map();
   let order = 0;
   for (const t of techniques) {
     const key = t.toolId.toLowerCase();
     if (!groups.has(key)) groups.set(key, new Map());
     const byId = groups.get(key);
     if (!byId.has(t.toolId)) byId.set(t.toolId, { count: 0, name: t.toolName, first: order++ });
     byId.get(t.toolId).count += 1;
   }
 
   const canonical = new Map(); // toolId → { toolId, toolName }
   for (const byId of groups.values()) {
     if (byId.size < 2) continue; // no case-variants, nothing to fold
     const variants = [...byId.entries()].map(([id, v]) => ({ id, ...v }));
     variants.sort((a, b) =>
       b.count - a.count ||
       (isUpperInitialFamily(b.id) - isUpperInitialFamily(a.id)) ||
       a.first - b.first,
     );
     const win = variants[0];
     for (const v of variants) canonical.set(v.id, { toolId: win.id, toolName: win.name });
   }
 
   if (!canonical.size) return techniques;
   return techniques.map((t) => {
     const c = canonical.get(t.toolId);
     return c ? { ...t, toolId: c.toolId, toolName: c.toolName } : t;
   });
 }
 
 function isUpperInitialFamily(toolId) {
   const family = toolId.split(':').slice(1).join(':');
   return /^[A-Z]/.test(family) ? 1 : 0;
 }