AutoTTP | Automated Tactics Techniques & Procedures | Cybersecurity library

AutoTTP is a Python library typically used in Security, Cybersecurity applications. AutoTTP has no vulnerabilities and it has low support. However AutoTTP has 2 bugs and it build file is not available. You can download it from GitHub.

In my case, the tactics are organized as per my Attack Life Cycle model. There are other models like Lockheed Martin's Kill-Chain(R), Mandiant Attack Life Cycle & Mitre's ATT&CK. Whichever model it may be, a "Tactic" essentially groups techniques together, eg. code-execution/run-payload can be achieved with many ways:. I use "Stage" to group relevant "Tactics" together. If you look into the source tree, the folder structure reflects the matrix's Tactics column. The matrix also mentioned respective controls for each offensive tactic. How did these stages came about?. The venn diagram in the middle of the red cycle is from Dartmouth College's "Three Tenets for Secure Cyber-Physical System Design and Assessment". It defines the necessary & sufficient conditions, or simply the requirements of any successful physical/logical attacks. I added the red ring (stages) around the venn diagram to illustrate typical offensive flows which ultimately leads to impact of Information Confidentiality, Integrity, & System Availability or Safety if it is related Cyber-Physical (think Critical Information Infrastructure). An attacker can start from Stage 1 and get straight into Stage 4 eg. default admin credentials on an publicly exposed admin page. It does not need to be linear (stage 1->2->3->4). After the initial infiltration, s/he could have performed some internal information gathering (reconn) first before escalating privilege on the first machine & then launching a remote command to another target machine within the same network. For the next victim machine, it is a Stage 2; successful payload delivery and execution which allows the attacker to gain command & control over yet another machine.