-
Notifications
You must be signed in to change notification settings - Fork 116
AttributeError: 'function' object has no attribute 'query' when using get_techniques_used_by_group_software #67
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Labels
bug
Something isn't working
Comments
Hey @cudeso ! It seemed that there was a double 'query' method being called. I removed the extra 'query' from ATTACK-Python-Client/attackcti/attack_api.py Line 1912 in 127a8eb
and tested the quick fix: >>> from attackcti.attack_api import attack_client
>>> lift = attack_client()
>>>
>>> group = lift.get_group_by_alias('APT12')
>>>
>>> techniques_group_software = lift.get_techniques_used_by_group_software(group[0])
>>>
>>> len(techniques_group_software)
19
>>> techniques_group_software[0]
AttackPattern(type='attack-pattern', id='attack-pattern--24bfaeba-cb0d-4525-b3dc-507c77ecec41', created_by_ref='identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5', created='2020-03-16T15:45:17.032Z', modified='2020-03-26T21:25:37.306Z', name='Symmetric Cryptography', description='Adversaries may employ a known symmetric encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Symmetric encryption algorithms use the same key for plaintext encryption and ciphertext decryption. Common symmetric encryption algorithms include AES, DES, 3DES, Blowfish, and RC4.', kill_chain_phases=[KillChainPhase(kill_chain_name='mitre-attack', phase_name='command-and-control')], revoked=False, external_references=[ExternalReference(source_name='mitre-attack', url='https://attack.mitre.org/techniques/T1573/001', external_id='T1573.001'), ExternalReference(source_name='University of Birmingham C2', description='Gardiner, J., Cova, M., Nagaraja, S. (2014, February). Command & Control Understanding, Denying and Detecting. Retrieved April 20, 2016.', url='https://arxiv.org/ftp/arxiv/papers/1408/1408.1136.pdf')], object_marking_refs=['marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168'], x_mitre_data_sources=['Network Traffic: Network Traffic Content'], x_mitre_detection='With symmetric encryption, it may be possible to obtain the algorithm and key from samples and use them to decode network traffic to detect malware communications signatures.\n\nIn general, analyze network data for uncommon data flows (e.g., a client sending significantly more data than it receives from a server). Processes utilizing the network that do not normally have network communication or have never been seen before are suspicious. Analyze packet contents to detect communications that do not follow the expected protocol behavior for the port that is being used.(Citation: University of Birmingham C2)', x_mitre_domains=['enterprise-attack'], x_mitre_is_subtechnique=True, x_mitre_modified_by_ref='identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5', x_mitre_platforms=['Linux', 'Windows', 'macOS'], x_mitre_version='1.0') I will push the quick fix and then update the library |
Cyb3rWard0g
added a commit
that referenced
this issue
Apr 1, 2024
Removed double query method from COMPOSITE_DS.query, fix #67
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
I'm unable to use get_techniques_used_by_group_software. Latest version of library is installed.
When using
this error is raised
The text was updated successfully, but these errors were encountered: