efstratioslontzetidis / whathitme

WhatHitMe is a Python3 tool which provides the possible Groups and their attributed Campaigns that may have attacked you in an incident, based on specific Techniques and Software you have identified (MITRE ATT&CK). It supports both enterprise, mobile and ICS matrixes. It also provides searches to known sources for these Groups for insight!

WhatHitMe

WhatHitMe is a Python3 tool which provides the possible Groups and their attributed Campaigns that may have attacked you in an incident, based on specific Techniques and Software you have identified (MITRE ATT&CK). It supports both enterprise, mobile and ICS matrixes. It also provides searches to known sources for these Groups to get a better insight of what you might had been facing! These sources are:

• OpenCTI

• Alienvault OTX

• Mandiant

• IBM X-FORCE

• ETDA

• Rapid7

• Check Point

• Broadcom

• TrendMicro

• HackerNews

• More coming soon!

It runs in Linux/Unix systems but it can run on Windows as well.

Usage

• You have to have Python3 installed in your system or you can download it from https://www.python.org/downloads/

• You will also need pip which if you don't have just run sudo apt install python3-pip for linux.

• Download the program or clone the repository in your system git clone https://github.com/EfstratiosLontzetidis/WhatHitMe.git

• Go to the WhatHitMe folder cd WhatHitMe

• First run the command sudo chmod +x setup.sh for linux

• Then run the command sudo ./setup.sh for linux, this will automatically install all the reqiured packages and will add the whathitme.py file to the /bin path so that you can run it as a command from anywhere in the system

• After that you can simply run whathitme as a command to show the help guide with the command whathitme -h or simply whathitme.

• It is recommended to run the --update flag before initiating the tool.

• Techniques are mandatory to be supplied to the tool, seperated by spaces (or lines if it is a file). The software flags are optional.

Examples:

python3 whathitme.py -t T1595.002 T1588.001 T1574.001 -o groups.txt -> give to the program specific techniques to search groups for, and save the results to a file

python3 whathitme.py -t T1588.001 T1574.001 -s S0385 S0154 -o groups.txt -> include software also

python3 whathitme.py -t T1588.001 T1574.001 -s S0385 S0154 -ss -> include searches for the groups identified also.

python3 whathitme.py -ft techniques.txt -fs software.txt -> give to the program specific techniques and software from a file to search groups for

python3 whathitme.py -ft techniques.txt -fs software.txt -m 1 -> give to the program specific techniques and software from a file to search groups for the mobile matrix

Sample Results (with searches)

Developers:

Efstratios Lontzetidis (https://github.com/EfstratiosLontzetidis)

Konstantinos Pantazis (https://github.com/kostas-pa)

⚠️ Common Issues

• WhatHitMe presents an attributed Group or Campaign if every input given for techniques and software is included in that Group or Campaign. Its accuracy depends on the accuracy of your technique and software extraction capability. In later versions likelihood will be included for each result.

Sidenote

• If you like this project please consider giving it a star

whathitme's Issues

Implement Scoring indicators

Implement Scoring indicators based on the techniques matched and techniques used by a specific group.

Comparison and Results Presentation

Lists comparison and results presentations

GUI

threat intelligence search for groups

opencti, etc

HTTP request issues?

I'm getting HTTP issues on multiple systems, was there a change that broke this? (verified updated, tested with different tags, versions, software, etc)

whathitme -v 13.1 -t T1555 -o groups.txt

---

\ \ / / | | | | | | () | | / |
\ \ /\ / /| |__ __ | | | |__| || |_ | \ / | ___
\ / / / | '_ \ / ` | __| | __ | | __| | |/| |/ _
\ /\ / | | | | (| | |_ | | | | | |_ | | | | /
/ / || ||_,|_| || |||_| || |_|_|

This is a python script that offers the visibility to a defender to know the possible APT groups and their campaigns that targeted an organization, after understanding the techniques and software used.

[!] Downloading the Techniques excel file for the matrix: enterprise and version: ['13.1']

[-] HTTP request was not successful. Please check the provided version of the matrix and check again

Import from File

Techniques and Software Extraction from Groups

CTI feeds search based on this group

Input Receive

Process to receive user input with guidelines

ATTACK NAVIGATOR LAYERS

CTI feed produce based on the incident artifacts to disclose specific group's activity

Flags from command line