This commit is contained in:
2026-05-11 09:15:08 +02:00
parent 9bec2b9e42
commit 404ee3fec4
641 changed files with 416825 additions and 0 deletions
@@ -0,0 +1,224 @@
#Import-Module
& "$PSScriptRoot\updateATAP.ps1"
InModuleScope ATAPHtmlReport {
Describe 'Testing Compare-EqualCISVersions' {
It 'Test Windows 7' {
$BasedOn = @(
"CIS Microsoft Windows 7 Workstation Benchmark, Version: 3.1.0, Date: 2018-03-02"
"FB Pro recommendations 'Ciphers Protocols and Hashes Benchmark', Version 1.1.0, Date: 2021-04-15"
)
$MitreMappingCompatible = @("CIS Microsoft Windows 10 Stand-alone Benchmark, Version: 1.0.1, Date: 2022-02-08",
"CIS Microsoft Windows 11 Stand-alone Benchmark, Version: 1.0.0, Date: 2022-11-15",
"CIS Microsoft Windows 10 Enterprise Release 21H1 Benchmark, Version: 1.12.0, Date: 2022-02-15",
"CIS Microsoft Windows 11 Enterprise Release 21H2 Benchmark, Version: 21H2, Date: 2022-02-14",
"CIS Microsoft Windows Server 2019 Benchmark, Version: 1.3.0, Date: 2022-03-18",
"CIS Microsoft Windows Server 2022, Version: 1.0.0, Date 2022-02-14")
try {
Compare-EqualCISVersions -Title "Windows Server 2019 Audit Report" -ReportBasedOn:$BasedOn -MitreMappingCompatible:$MitreMappingCompatible | Should -Be $false
}
catch {
$false | Should -Be $true
}
}
It 'Test Windows 10' {
$BasedOn = @(
"CIS Microsoft Windows 10 Enterprise Release 21H1 Benchmark, Version: 1.12.0, Date: 2022-02-15"
"DISA Windows 10 Security Technical Implementation Guide, Version: V1R16, Date: 2019-10-25"
"Microsoft Security baseline (FINAL) for Windows 10, Version: 21H1, Date: 2021-05-18"
"Configuration Recommendations for Hardening of Windows 10 Using Built-in Functionalities: Version 1.3, Date: 2021-05-03"
"SiSyPHuS Recommendations for Telemetry Components: Version 1.2, Date: 2020-04-27"
"ACSC Hardening Microsoft Windows 10 version 21H1 Workstations, Version: 10.2021, Date 2021-10-01"
"FB Pro recommendations 'Ciphers Protocols and Hashes Benchmark', Version 1.1.0, Date: 2021-04-15"
"FB Pro recommendations 'Enhanced settings', Version 1.1.0, Date: 2023-02-24"
)
$MitreMappingCompatible = @("CIS Microsoft Windows 10 Stand-alone Benchmark, Version: 1.0.1, Date: 2022-02-08",
"CIS Microsoft Windows 11 Stand-alone Benchmark, Version: 1.0.0, Date: 2022-11-15",
"CIS Microsoft Windows 10 Enterprise Release 21H1 Benchmark, Version: 1.12.0, Date: 2022-02-15",
"CIS Microsoft Windows 11 Enterprise Release 21H2 Benchmark, Version: 21H2, Date: 2022-02-14",
"CIS Microsoft Windows Server 2019 Benchmark, Version: 1.3.0, Date: 2022-03-18",
"CIS Microsoft Windows Server 2022, Version: 1.0.0, Date 2022-02-14")
try {
Compare-EqualCISVersions -Title "Windows Server 2019 Audit Report" -ReportBasedOn:$BasedOn -MitreMappingCompatible:$MitreMappingCompatible | Should -Be $true
}
catch {
$false | Should -Be $true
}
}
It 'Test Windows 10 stand-alone' {
$BasedOn = @(
"CIS Microsoft Windows 11 Stand-alone Benchmark, Version: 1.0.0, Date: 2022-11-15"
"Configuration Recommendations for Hardening of Windows 10 Using Built-in Functionalities: Version 1.3, Date: 2021-05-03"
"SiSyPHuS Recommendations for Telemetry Components: Version 1.1, Date: 2019-07-31"
"FB Pro recommendations 'Ciphers Protocols and Hashes Benchmark', Version 1.1.0, Date: 2021-04-15"
"FB Pro recommendations 'Enhanced settings', Version 1.1.0, Date: 2023-02-24"
)
$MitreMappingCompatible = @("CIS Microsoft Windows 10 Stand-alone Benchmark, Version: 1.0.1, Date: 2022-02-08",
"CIS Microsoft Windows 11 Stand-alone Benchmark, Version: 1.0.0, Date: 2022-11-15",
"CIS Microsoft Windows 10 Enterprise Release 21H1 Benchmark, Version: 1.12.0, Date: 2022-02-15",
"CIS Microsoft Windows 11 Enterprise Release 21H2 Benchmark, Version: 21H2, Date: 2022-02-14",
"CIS Microsoft Windows Server 2019 Benchmark, Version: 1.3.0, Date: 2022-03-18",
"CIS Microsoft Windows Server 2022, Version: 1.0.0, Date 2022-02-14")
try {
Compare-EqualCISVersions -Title "Windows Server 2019 Audit Report" -ReportBasedOn:$BasedOn -MitreMappingCompatible:$MitreMappingCompatible | Should -Be $true
}
catch {
$false | Should -Be $true
}
}
It 'Test Windows 11' {
$BasedOn = @(
"CIS Microsoft Windows 11 Enterprise Release 21H2 Benchmark, Version: 21H2, Date: 2022-02-14"
"Security baseline for Microsoft Windows 11, Version: 20H2, Date: 2020-12-17"
"Configuration Recommendations for Hardening of Windows 10 Using Built-in Functionalities: Version 1.3, Date: 2021-05-03"
"SiSyPHuS Recommendations for Telemetry Components: Version 1.1, Date: 2019-07-31"
"FB Pro recommendations 'Ciphers Protocols and Hashes Benchmark', Version 1.1.0, Date: 2021-04-15"
"FB Pro recommendations 'Enhanced settings', Version 1.1.0, Date: 2023-02-24"
)
$MitreMappingCompatible = @("CIS Microsoft Windows 10 Stand-alone Benchmark, Version: 1.0.1, Date: 2022-02-08",
"CIS Microsoft Windows 11 Stand-alone Benchmark, Version: 1.0.0, Date: 2022-11-15",
"CIS Microsoft Windows 10 Enterprise Release 21H1 Benchmark, Version: 1.12.0, Date: 2022-02-15",
"CIS Microsoft Windows 11 Enterprise Release 21H2 Benchmark, Version: 21H2, Date: 2022-02-14",
"CIS Microsoft Windows Server 2019 Benchmark, Version: 1.3.0, Date: 2022-03-18",
"CIS Microsoft Windows Server 2022, Version: 1.0.0, Date 2022-02-14")
try {
Compare-EqualCISVersions -Title "Windows Server 2019 Audit Report" -ReportBasedOn:$BasedOn -MitreMappingCompatible:$MitreMappingCompatible | Should -Be $true
}
catch {
$false | Should -Be $true
}
}
It 'Test Windows 11 stand-alone' {
$BasedOn = @(
"CIS Microsoft Windows 11 Stand-alone Benchmark, Version: 1.0.0, Date: 2022-11-15"
"Configuration Recommendations for Hardening of Windows 10 Using Built-in Functionalities: Version 1.3, Date: 2021-05-03"
"SiSyPHuS Recommendations for Telemetry Components: Version 1.1, Date: 2019-07-31"
"FB Pro recommendations 'Ciphers Protocols and Hashes Benchmark', Version 1.1.0, Date: 2021-04-15"
"FB Pro recommendations 'Enhanced settings', Version 1.1.0, Date: 2023-02-24"
)
$MitreMappingCompatible = @("CIS Microsoft Windows 10 Stand-alone Benchmark, Version: 1.0.1, Date: 2022-02-08",
"CIS Microsoft Windows 11 Stand-alone Benchmark, Version: 1.0.0, Date: 2022-11-15",
"CIS Microsoft Windows 10 Enterprise Release 21H1 Benchmark, Version: 1.12.0, Date: 2022-02-15",
"CIS Microsoft Windows 11 Enterprise Release 21H2 Benchmark, Version: 21H2, Date: 2022-02-14",
"CIS Microsoft Windows Server 2019 Benchmark, Version: 1.3.0, Date: 2022-03-18",
"CIS Microsoft Windows Server 2022, Version: 1.0.0, Date 2022-02-14")
try {
Compare-EqualCISVersions -Title "Windows Server 2019 Audit Report" -ReportBasedOn:$BasedOn -MitreMappingCompatible:$MitreMappingCompatible | Should -Be $true
}
catch {
$false | Should -Be $true
}
}
It 'Test Windows Server 2019' {
$BasedOn = @(
"Windows Server 2019 Security Technical Implementation Guide, Version: 1.5, Date: 2020-06-17"
"CIS Microsoft Windows Server 2019 Benchmark, Version: 1.3.0, Date: 2022-03-18"
"Microsoft Security baseline for Windows Server 2019, Version: FINAL, Date 2019-06-18"
"FB Pro recommendations 'Ciphers Protocols and Hashes Benchmark', Version 1.1.0, Date: 2021-04-15"
"FB Pro recommendations 'Enhanced settings', Version 1.1.0, Date: 2023-02-24"
)
$MitreMappingCompatible = @("CIS Microsoft Windows 10 Stand-alone Benchmark, Version: 1.0.1, Date: 2022-02-08",
"CIS Microsoft Windows 11 Stand-alone Benchmark, Version: 1.0.0, Date: 2022-11-15",
"CIS Microsoft Windows 10 Enterprise Release 21H1 Benchmark, Version: 1.12.0, Date: 2022-02-15",
"CIS Microsoft Windows 11 Enterprise Release 21H2 Benchmark, Version: 21H2, Date: 2022-02-14",
"CIS Microsoft Windows Server 2019 Benchmark, Version: 1.3.0, Date: 2022-03-18",
"CIS Microsoft Windows Server 2022, Version: 1.0.0, Date 2022-02-14")
try {
Compare-EqualCISVersions -Title "Windows Server 2019 Audit Report" -ReportBasedOn:$BasedOn -MitreMappingCompatible:$MitreMappingCompatible | Should -Be $true
}
catch {
$false | Should -Be $true
}
}
It 'Test Windows Server 2022' {
$BasedOn = @(
"Security baseline for Microsoft Windows Server 2022, Version: FINAL, Date 2021-09-27"
"CIS Microsoft Windows Server 2022, Version: 1.0.0, Date 2022-02-14"
"DISA Windows Server 2022, Version: V1R1, Date 2022-09-28"
"FB Pro recommendations 'Ciphers Protocols and Hashes Benchmark', Version 1.1.0, Date: 2021-04-15"
"FB Pro recommendations 'Enhanced settings', Version 1.1.0, Date: 2023-02-24"
)
$MitreMappingCompatible = @("CIS Microsoft Windows 10 Stand-alone Benchmark, Version: 1.0.1, Date: 2022-02-08"
"CIS Microsoft Windows 11 Stand-alone Benchmark, Version: 1.0.0, Date: 2022-11-15"
"CIS Microsoft Windows 10 Enterprise Release 21H1 Benchmark, Version: 1.12.0, Date: 2022-02-15"
"CIS Microsoft Windows 11 Enterprise Release 21H2 Benchmark, Version: 21H2, Date: 2022-02-14"
"CIS Microsoft Windows Server 2019 Benchmark, Version: 1.3.0, Date: 2022-03-18"
"CIS Microsoft Windows Server 2022, Version: 1.0.0, Date 2022-02-14")
try {
Compare-EqualCISVersions -Title "Windows Server 2022 Audit Report" -ReportBasedOn:$BasedOn -MitreMappingCompatible:$MitreMappingCompatible | Should -Be $true
}
catch {
$false | Should -Be $true
}
}
It 'Test for unmatching versions of CIS and MITRE mapping' {
$BasedOn = @(
"CIS Microsoft Windows 10 Enterprise Release 21H1 Benchmark, Version: 1.15.0, Date: 2023-02-15"
"DISA Windows 10 Security Technical Implementation Guide, Version: V1R16, Date: 2019-10-25"
"Microsoft Security baseline (FINAL) for Windows 10, Version: 21H1, Date: 2021-05-18"
"Configuration Recommendations for Hardening of Windows 10 Using Built-in Functionalities: Version 1.3, Date: 2021-05-03"
"SiSyPHuS Recommendations for Telemetry Components: Version 1.2, Date: 2020-04-27"
"ACSC Hardening Microsoft Windows 10 version 21H1 Workstations, Version: 10.2021, Date 2021-10-01"
"FB Pro recommendations 'Ciphers Protocols and Hashes Benchmark', Version 1.1.0, Date: 2021-04-15"
"FB Pro recommendations 'Enhanced settings', Version 1.1.0, Date: 2023-02-24"
)
$MitreMappingCompatible = @("CIS Microsoft Windows 10 Stand-alone Benchmark, Version: 1.0.1, Date: 2022-02-08",
"CIS Microsoft Windows 11 Stand-alone Benchmark, Version: 1.0.0, Date: 2022-11-15",
"CIS Microsoft Windows 10 Enterprise Release 21H1 Benchmark, Version: 1.12.0, Date: 2022-02-15",
"CIS Microsoft Windows 11 Enterprise Release 21H2 Benchmark, Version: 21H2, Date: 2022-02-14",
"CIS Microsoft Windows Server 2019 Benchmark, Version: 1.3.0, Date: 2022-03-18",
"CIS Microsoft Windows Server 2022, Version: 1.0.0, Date 2022-02-14")
Compare-EqualCISVersions -Title "Windows 10 Report" -ReportBasedOn:$BasedOn -MitreMappingCompatible:$MitreMappingCompatible | Should -Be $false
}
It 'Test for matching versions of CIS and MITRE mapping' {
$BasedOn = @(
"CIS Microsoft Windows 10 Enterprise Release 21H1 Benchmark, Version: 1.12.0, Date: 2022-02-15"
"DISA Windows 10 Security Technical Implementation Guide, Version: V1R16, Date: 2019-10-25"
"Microsoft Security baseline (FINAL) for Windows 10, Version: 21H1, Date: 2021-05-18"
"Configuration Recommendations for Hardening of Windows 10 Using Built-in Functionalities: Version 1.3, Date: 2021-05-03"
"SiSyPHuS Recommendations for Telemetry Components: Version 1.2, Date: 2020-04-27"
"ACSC Hardening Microsoft Windows 10 version 21H1 Workstations, Version: 10.2021, Date 2021-10-01"
"FB Pro recommendations 'Ciphers Protocols and Hashes Benchmark', Version 1.1.0, Date: 2021-04-15"
"FB Pro recommendations 'Enhanced settings', Version 1.1.0, Date: 2023-02-24"
)
$MitreMappingCompatible = @("CIS Microsoft Windows 10 Stand-alone Benchmark, Version: 1.0.1, Date: 2022-02-08",
"CIS Microsoft Windows 11 Stand-alone Benchmark, Version: 1.0.0, Date: 2022-11-15",
"CIS Microsoft Windows 10 Enterprise Release 21H1 Benchmark, Version: 1.12.0, Date: 2022-02-15",
"CIS Microsoft Windows 11 Enterprise Release 21H2 Benchmark, Version: 21H2, Date: 2022-02-14",
"CIS Microsoft Windows Server 2019 Benchmark, Version: 1.3.0, Date: 2022-03-18",
"CIS Microsoft Windows Server 2022, Version: 1.0.0, Date 2022-02-14")
Compare-EqualCISVersions -Title "Windows 10 Report" -ReportBasedOn:$BasedOn -MitreMappingCompatible:$MitreMappingCompatible | Should -Be $true
}
It 'Test for matching versions of CIS and MITRE mapping but wrong OS' {
$BasedOn = @(
"CIS Microsoft Windows 10 Enterprise Release 21H1 Benchmark, Version: 1.12.0, Date: 2022-02-15"
"DISA Windows 10 Security Technical Implementation Guide, Version: V1R16, Date: 2019-10-25"
"Microsoft Security baseline (FINAL) for Windows 10, Version: 21H1, Date: 2021-05-18"
"Configuration Recommendations for Hardening of Windows 10 Using Built-in Functionalities: Version 1.3, Date: 2021-05-03"
"SiSyPHuS Recommendations for Telemetry Components: Version 1.2, Date: 2020-04-27"
"ACSC Hardening Microsoft Windows 10 version 21H1 Workstations, Version: 10.2021, Date 2021-10-01"
"FB Pro recommendations 'Ciphers Protocols and Hashes Benchmark', Version 1.1.0, Date: 2021-04-15"
"FB Pro recommendations 'Enhanced settings', Version 1.1.0, Date: 2023-02-24"
)
$MitreMappingCompatible = @("CIS Microsoft Windows 10 Stand-alone Benchmark, Version: 1.0.1, Date: 2022-02-08",
"CIS Microsoft Windows 11 Stand-alone Benchmark, Version: 1.0.0, Date: 2022-11-15",
"CIS Microsoft Windows 10 Enterprise Release 21H1 Benchmark, Version: 1.12.0, Date: 2022-02-15",
"CIS Microsoft Windows 11 Enterprise Release 21H2 Benchmark, Version: 21H2, Date: 2022-02-14",
"CIS Microsoft Windows Server 2019 Benchmark, Version: 1.3.0, Date: 2022-03-18",
"CIS Microsoft Windows Server 2022, Version: 1.0.0, Date 2022-02-14")
Compare-EqualCISVersions -Title "Debian 10" -ReportBasedOn:$BasedOn -MitreMappingCompatible:$MitreMappingCompatible | Should -Be $false
}
}
}
@@ -0,0 +1,50 @@
#Import-Module
& "$PSScriptRoot\updateATAP.ps1"
InModuleScope ATAPHtmlReport {
Describe 'Testing ConvertTo-HtmlTable' {
It 'tests with an example Report' {
$AuditInfos = @{Id = "1.1.4"
Status = [AuditInfoStatus]::False
},
@{Id = "1.2.3"
Status = [AuditInfoStatus]::True
},
@{Id = "1.2.4"
Status = [AuditInfoStatus]::True
},
@{Id = "1.2.6"
Status = [AuditInfoStatus]::True
},
@{Id = "1.2.5"
Status = [AuditInfoStatus]::False
},
@{Id = "1.4.5"
Status = [AuditInfoStatus]::True
}
$Subsection = @{AuditInfos = $AuditInfos }
$Section1 = @{Title = "Cis Benchmarks"
SubSections = $Subsection
}
$Section2 = @{Title = "DISA"
$Subsection = $null
}
$Sections = $Section1, $Section2
$Mappings = $Sections | Where-Object { $_.Title -eq "CIS Benchmarks" } | ForEach-Object { return $_.SubSections } | ForEach-Object { return $_.AuditInfos } | Merge-CisAuditsToMitreMap
# call the function under test and split by opening and closing brackets. Result should be an array of tags.
$tags = (ConvertTo-HtmlTable $Mappings.map).Split("<").Split(">")
$tags | Should -Contain 'table id="MITRETable"'
$tags | Should -Contain 'a href="https://attack.mitre.org/tactics/TA0007/"'
$tags | Should -Contain 'Discovery'
}
}
}
@@ -0,0 +1,55 @@
#Import-Module
& "$PSScriptRoot\updateATAP.ps1"
InModuleScope ATAPHtmlReport {
Describe "Testing Get-ColorValue" {
It "Should return hundred" {
$result = Get-ColorValue -FirstValue 10 -SecondValue 10
$result | Should -Be "#33cca6"
}
It "Should return ninety" {
$result = Get-ColorValue -FirstValue 9 -SecondValue 10
$result | Should -Be "#52CC8F"
}
It "Should return eighty" {
$result = Get-ColorValue -FirstValue 8 -SecondValue 10
$result | Should -Be "#70CC78"
}
It "Should return seventy" {
$result = Get-ColorValue -FirstValue 7 -SecondValue 10
$result | Should -Be "#8FCC61"
}
It "Should return sixty" {
$result = Get-ColorValue -FirstValue 6 -SecondValue 10
$result | Should -Be "#ADCC4A"
}
It "Should return fifty" {
$result = Get-ColorValue -FirstValue 5 -SecondValue 10
$result | Should -Be "#CCCC33"
}
It "Should return fourty" {
$result = Get-ColorValue -FirstValue 4 -SecondValue 10
$result | Should -Be "#CCA329"
}
It "Should return thirty" {
$result = Get-ColorValue -FirstValue 3 -SecondValue 10
$result | Should -Be "#CC7A1F"
}
It "Should return twenty" {
$result = Get-ColorValue -FirstValue 2 -SecondValue 10
$result | Should -Be "#CC5214"
}
It "Should return ten" {
$result = Get-ColorValue -FirstValue 1 -SecondValue 10
$result | Should -Be "#CC290A"
}
It "Should return zero" {
$result = Get-ColorValue -FirstValue 0 -SecondValue 10
$result | Should -Be "#cc0000"
}
It "Should return empty" {
$result = Get-ColorValue -FirstValue 0 -SecondValue 0
$result | Should -Be "#a7a7a7"
}
}
}
@@ -0,0 +1,419 @@
#Import-Module
& "$PSScriptRoot\updateATAP.ps1"
$global:CISToAttackMappingData = Get-Content -Raw "$PSScriptRoot\..\resources\CISToAttackMappingData.json" | ConvertFrom-Json
InModuleScope ATAPHtmlReport {
function global:Add-ToAuditInfos{
param(
[Parameter(Mandatory = $true)]
[string]
$Mitigation,
[Parameter(Mandatory = $true)]
[bool]
$AllIDsFalse
)
$json = $CISToAttackMappingData.'CISAttackMapping'
$json.psobject.properties.name | Where-Object {$json.$_.'Mitigation1' -eq $Mitigation -or $json.$_.'Mitigation2' -eq $Mitigation} | ForEach-Object {return $json.$_.'Recommendation'} | ForEach-Object {
if($AllIDsFalse) {
$global:AuditInfos += @{
Id = $_
Status = [AuditInfoStatus]::False
}
}
else {
$global:AuditInfos += @{
Id = $_
Status = [AuditInfoStatus]::True
}
}
}
}
Describe 'testing function Get-MitigationsFromFailedTests' {
It 'tests the amount of techniques in report' {
$global:AuditInfos = @()
$global:AuditInfos += @{
#T1489
Id = "18.8.5.3"
Status = [AuditInfoStatus]::False
}
$global:AuditInfos += @{
#T1555
Id = "18.9.65.2.2"
Status = [AuditInfoStatus]::False
}
$global:AuditInfos += @{
#T1569 #T1011
Id = "5.1"
Status = [AuditInfoStatus]::False
}
$global:AuditInfos += @{
#T1115
Id = "2.2.1"
Status = [AuditInfoStatus]::False
}
$global:AuditInfos += @{
#T1048
Id = "5.12"
Status = [AuditInfoStatus]::False
}
$global:AuditInfos += @{
#T1059
Id = "18.9.31.4"
Status = [AuditInfoStatus]::False
}
$global:AuditInfos += @{
#T1003
Id = "1.1.7"
Status = [AuditInfoStatus]::False
}
$global:AuditInfos += @{
#T1016
Id = "18.5.19.2.1"
Status = [AuditInfoStatus]::False
}
$Subsection = @{AuditInfos = $global:AuditInfos }
$Section1 = @{
Title = "Cis Benchmarks"
SubSections = $Subsection
}
$mitreMap = $Section1 | Where-Object { $_.Title -eq "CIS Benchmarks" } | ForEach-Object { return $_.SubSections } | ForEach-Object { return $_.AuditInfos } | Merge-CisAuditsToMitreMap
$CISAMitigations = $mitreMap.Map | Get-MitigationsFromFailedTests
$json = $CISToAttackMappingData.'CISAttackMapping'
foreach($Mitigation in $CISAMitigations.Keys) {
$Techniques = @()
$global:AuditInfos | Where-Object {$_.Status -eq [AuditInfoStatus]::False} |
Where-Object {$json.($_.Id).'Mitigation1' -eq $Mitigation -or $json.($_.Id).'Mitigation2' -eq $Mitigation} |
ForEach-Object {
if($null -ne $json.($_.Id).'Technique1' -and $Techniques -notcontains $json.($_.Id).'Technique1'){
$Techniques += $json.($_.Id).'Technique1'
}
if($null -ne $json.($_.Id).'Technique2' -and $Techniques -notcontains $json.($_.Id).'Technique2'){
$Techniques += $json.($_.Id).'Technique2'
}
}
$Techniques = $Techniques | Sort-Object
$CISAMitigations[$Mitigation]['MitreTechniqueIDs'] = $CISAMitigations[$Mitigation]['MitreTechniqueIDs'] | Sort-Object
for($i = 0; $i -lt $CISAMitigations[$Mitigation]['MitreTechniqueIDs'].length; $i++) {
$CISAMitigations[$Mitigation]['MitreTechniqueIDs'][$i] | Should -Be $Techniques[$i]
}
}
}
It 'tests with an example report where every status is [AuditInfoStatus]::False' {
$global:AuditInfos = @()
Add-ToAuditInfos -Mitigation 'M1017' -AllIDsFalse $true
Add-ToAuditInfos -Mitigation 'M1018' -AllIDsFalse $true
Add-ToAuditInfos -Mitigation 'M1021' -AllIDsFalse $true
Add-ToAuditInfos -Mitigation 'M1027' -AllIDsFalse $true
Add-ToAuditInfos -Mitigation 'M1028' -AllIDsFalse $true
Add-ToAuditInfos -Mitigation 'M1030' -AllIDsFalse $true
Add-ToAuditInfos -Mitigation 'M1031' -AllIDsFalse $true
Add-ToAuditInfos -Mitigation 'M1038' -AllIDsFalse $true
Add-ToAuditInfos -Mitigation 'M1041' -AllIDsFalse $true
Add-ToAuditInfos -Mitigation 'M1042' -AllIDsFalse $true
$Subsection = @{AuditInfos = $global:AuditInfos }
$Section1 = @{
Title = "Cis Benchmarks"
SubSections = $Subsection
}
$mitreMap = $Section1 | Where-Object { $_.Title -eq "CIS Benchmarks" } | ForEach-Object { return $_.SubSections } | ForEach-Object { return $_.AuditInfos } | Merge-CisAuditsToMitreMap
#Tests
$CISAMitigations = $mitreMap.Map | Get-MitigationsFromFailedTests
$CISAMitigations.Keys | Should -Be @('M1017', 'M1018', 'M1021', 'M1027', 'M1028', 'M1030', 'M1031', 'M1038', 'M1041', 'M1042')
}
It 'tests with an example report where every status is [AuditInfoStatus]::True' {
$global:AuditInfos = @()
Add-ToAuditInfos -Mitigation 'M1017' -AllIDsFalse $false
Add-ToAuditInfos -Mitigation 'M1018' -AllIDsFalse $false
Add-ToAuditInfos -Mitigation 'M1021' -AllIDsFalse $false
Add-ToAuditInfos -Mitigation 'M1027' -AllIDsFalse $false
Add-ToAuditInfos -Mitigation 'M1028' -AllIDsFalse $false
Add-ToAuditInfos -Mitigation 'M1030' -AllIDsFalse $false
Add-ToAuditInfos -Mitigation 'M1031' -AllIDsFalse $false
Add-ToAuditInfos -Mitigation 'M1038' -AllIDsFalse $false
Add-ToAuditInfos -Mitigation 'M1041' -AllIDsFalse $false
Add-ToAuditInfos -Mitigation 'M1042' -AllIDsFalse $false
$Subsection = @{AuditInfos = $global:AuditInfos }
$Section1 = @{
Title = "Cis Benchmarks"
SubSections = $Subsection
}
$mitreMap = $Section1 | Where-Object { $_.Title -eq "CIS Benchmarks" } | ForEach-Object { return $_.SubSections } | ForEach-Object { return $_.AuditInfos } | Merge-CisAuditsToMitreMap
#Tests
$CISAMitigations = $mitreMap.Map | Get-MitigationsFromFailedTests
$CISAMitigations.Keys | Should -Be @()
}
It 'tests with an example report where just M1017 ids are [AuditInfoStatus]::False' {
$global:AuditInfos = @()
Add-ToAuditInfos -Mitigation 'M1017' -AllIDsFalse $true
Add-ToAuditInfos -Mitigation 'M1018' -AllIDsFalse $false
Add-ToAuditInfos -Mitigation 'M1021' -AllIDsFalse $false
Add-ToAuditInfos -Mitigation 'M1027' -AllIDsFalse $false
Add-ToAuditInfos -Mitigation 'M1028' -AllIDsFalse $false
Add-ToAuditInfos -Mitigation 'M1030' -AllIDsFalse $false
Add-ToAuditInfos -Mitigation 'M1031' -AllIDsFalse $false
Add-ToAuditInfos -Mitigation 'M1038' -AllIDsFalse $false
Add-ToAuditInfos -Mitigation 'M1041' -AllIDsFalse $false
Add-ToAuditInfos -Mitigation 'M1042' -AllIDsFalse $false
$Subsection = @{AuditInfos = $global:AuditInfos }
$Section1 = @{
Title = "Cis Benchmarks"
SubSections = $Subsection
}
$mitreMap = $Section1 | Where-Object { $_.Title -eq "CIS Benchmarks" } | ForEach-Object { return $_.SubSections } | ForEach-Object { return $_.AuditInfos } | Merge-CisAuditsToMitreMap
#Tests
$CISAMitigations = $mitreMap.Map | Get-MitigationsFromFailedTests
$CISAMitigations.Keys | Should -Contain @('M1017')
}
It 'tests with an example report where just M1018 ids are [AuditInfoStatus]::False' {
$global:AuditInfos = @()
Add-ToAuditInfos -Mitigation 'M1017' -AllIDsFalse $false
Add-ToAuditInfos -Mitigation 'M1018' -AllIDsFalse $true
Add-ToAuditInfos -Mitigation 'M1021' -AllIDsFalse $false
Add-ToAuditInfos -Mitigation 'M1027' -AllIDsFalse $false
Add-ToAuditInfos -Mitigation 'M1028' -AllIDsFalse $false
Add-ToAuditInfos -Mitigation 'M1030' -AllIDsFalse $false
Add-ToAuditInfos -Mitigation 'M1031' -AllIDsFalse $false
Add-ToAuditInfos -Mitigation 'M1038' -AllIDsFalse $false
Add-ToAuditInfos -Mitigation 'M1041' -AllIDsFalse $false
Add-ToAuditInfos -Mitigation 'M1042' -AllIDsFalse $false
$Subsection = @{AuditInfos = $global:AuditInfos }
$Section1 = @{
Title = "Cis Benchmarks"
SubSections = $Subsection
}
$mitreMap = $Section1 | Where-Object { $_.Title -eq "CIS Benchmarks" } | ForEach-Object { return $_.SubSections } | ForEach-Object { return $_.AuditInfos } | Merge-CisAuditsToMitreMap
#Tests
$CISAMitigations = $mitreMap.Map | Get-MitigationsFromFailedTests
$CISAMitigations.Keys | Should -Contain @('M1018')
}
It 'tests with an example report where just M1021 ids are [AuditInfoStatus]::False' {
$global:AuditInfos = @()
Add-ToAuditInfos -Mitigation 'M1017' -AllIDsFalse $false
Add-ToAuditInfos -Mitigation 'M1018' -AllIDsFalse $false
Add-ToAuditInfos -Mitigation 'M1021' -AllIDsFalse $true
Add-ToAuditInfos -Mitigation 'M1027' -AllIDsFalse $false
Add-ToAuditInfos -Mitigation 'M1028' -AllIDsFalse $false
Add-ToAuditInfos -Mitigation 'M1030' -AllIDsFalse $false
Add-ToAuditInfos -Mitigation 'M1031' -AllIDsFalse $false
Add-ToAuditInfos -Mitigation 'M1038' -AllIDsFalse $false
Add-ToAuditInfos -Mitigation 'M1041' -AllIDsFalse $false
Add-ToAuditInfos -Mitigation 'M1042' -AllIDsFalse $false
$Subsection = @{AuditInfos = $global:AuditInfos }
$Section1 = @{
Title = "Cis Benchmarks"
SubSections = $Subsection
}
$mitreMap = $Section1 | Where-Object { $_.Title -eq "CIS Benchmarks" } | ForEach-Object { return $_.SubSections } | ForEach-Object { return $_.AuditInfos } | Merge-CisAuditsToMitreMap
#Tests
$CISAMitigations = $mitreMap.Map | Get-MitigationsFromFailedTests
$CISAMitigations.Keys | Should -Contain @('M1021')
}
It 'tests with an example report where just M1027 ids are [AuditInfoStatus]::False' {
$global:AuditInfos = @()
Add-ToAuditInfos -Mitigation 'M1017' -AllIDsFalse $false
Add-ToAuditInfos -Mitigation 'M1018' -AllIDsFalse $false
Add-ToAuditInfos -Mitigation 'M1021' -AllIDsFalse $false
Add-ToAuditInfos -Mitigation 'M1027' -AllIDsFalse $true
Add-ToAuditInfos -Mitigation 'M1028' -AllIDsFalse $false
Add-ToAuditInfos -Mitigation 'M1030' -AllIDsFalse $false
Add-ToAuditInfos -Mitigation 'M1031' -AllIDsFalse $false
Add-ToAuditInfos -Mitigation 'M1038' -AllIDsFalse $false
Add-ToAuditInfos -Mitigation 'M1041' -AllIDsFalse $false
Add-ToAuditInfos -Mitigation 'M1042' -AllIDsFalse $false
$Subsection = @{AuditInfos = $global:AuditInfos }
$Section1 = @{
Title = "Cis Benchmarks"
SubSections = $Subsection
}
$mitreMap = $Section1 | Where-Object { $_.Title -eq "CIS Benchmarks" } | ForEach-Object { return $_.SubSections } | ForEach-Object { return $_.AuditInfos } | Merge-CisAuditsToMitreMap
#Tests
$CISAMitigations = $mitreMap.Map | Get-MitigationsFromFailedTests
$CISAMitigations.Keys | Should -Contain @('M1027')
}
It 'tests with an example report where just M1028 ids are [AuditInfoStatus]::False' {
$global:AuditInfos = @()
Add-ToAuditInfos -Mitigation 'M1017' -AllIDsFalse $false
Add-ToAuditInfos -Mitigation 'M1018' -AllIDsFalse $false
Add-ToAuditInfos -Mitigation 'M1021' -AllIDsFalse $false
Add-ToAuditInfos -Mitigation 'M1027' -AllIDsFalse $false
Add-ToAuditInfos -Mitigation 'M1028' -AllIDsFalse $true
Add-ToAuditInfos -Mitigation 'M1030' -AllIDsFalse $false
Add-ToAuditInfos -Mitigation 'M1031' -AllIDsFalse $false
Add-ToAuditInfos -Mitigation 'M1038' -AllIDsFalse $false
Add-ToAuditInfos -Mitigation 'M1041' -AllIDsFalse $false
Add-ToAuditInfos -Mitigation 'M1042' -AllIDsFalse $false
$Subsection = @{AuditInfos = $global:AuditInfos }
$Section1 = @{
Title = "Cis Benchmarks"
SubSections = $Subsection
}
$mitreMap = $Section1 | Where-Object { $_.Title -eq "CIS Benchmarks" } | ForEach-Object { return $_.SubSections } | ForEach-Object { return $_.AuditInfos } | Merge-CisAuditsToMitreMap
#Tests
$CISAMitigations = $mitreMap.Map | Get-MitigationsFromFailedTests
$CISAMitigations.Keys | Should -Contain @('M1028')
}
It 'tests with an example report where just M1030 ids are [AuditInfoStatus]::False' {
$global:AuditInfos = @()
Add-ToAuditInfos -Mitigation 'M1017' -AllIDsFalse $false
Add-ToAuditInfos -Mitigation 'M1018' -AllIDsFalse $false
Add-ToAuditInfos -Mitigation 'M1021' -AllIDsFalse $false
Add-ToAuditInfos -Mitigation 'M1027' -AllIDsFalse $false
Add-ToAuditInfos -Mitigation 'M1028' -AllIDsFalse $false
Add-ToAuditInfos -Mitigation 'M1030' -AllIDsFalse $true
Add-ToAuditInfos -Mitigation 'M1031' -AllIDsFalse $false
Add-ToAuditInfos -Mitigation 'M1038' -AllIDsFalse $false
Add-ToAuditInfos -Mitigation 'M1041' -AllIDsFalse $false
Add-ToAuditInfos -Mitigation 'M1042' -AllIDsFalse $false
$Subsection = @{AuditInfos = $global:AuditInfos }
$Section1 = @{
Title = "Cis Benchmarks"
SubSections = $Subsection
}
$mitreMap = $Section1 | Where-Object { $_.Title -eq "CIS Benchmarks" } | ForEach-Object { return $_.SubSections } | ForEach-Object { return $_.AuditInfos } | Merge-CisAuditsToMitreMap
#Tests
$CISAMitigations = $mitreMap.Map | Get-MitigationsFromFailedTests
$CISAMitigations.Keys | Should -Contain @('M1030')
}
It 'tests with an example report where just M1031 ids are [AuditInfoStatus]::False' {
$global:AuditInfos = @()
Add-ToAuditInfos -Mitigation 'M1017' -AllIDsFalse $false
Add-ToAuditInfos -Mitigation 'M1018' -AllIDsFalse $false
Add-ToAuditInfos -Mitigation 'M1021' -AllIDsFalse $false
Add-ToAuditInfos -Mitigation 'M1027' -AllIDsFalse $false
Add-ToAuditInfos -Mitigation 'M1028' -AllIDsFalse $false
Add-ToAuditInfos -Mitigation 'M1030' -AllIDsFalse $false
Add-ToAuditInfos -Mitigation 'M1031' -AllIDsFalse $true
Add-ToAuditInfos -Mitigation 'M1038' -AllIDsFalse $false
Add-ToAuditInfos -Mitigation 'M1041' -AllIDsFalse $false
Add-ToAuditInfos -Mitigation 'M1042' -AllIDsFalse $false
$Subsection = @{AuditInfos = $global:AuditInfos }
$Section1 = @{
Title = "Cis Benchmarks"
SubSections = $Subsection
}
$mitreMap = $Section1 | Where-Object { $_.Title -eq "CIS Benchmarks" } | ForEach-Object { return $_.SubSections } | ForEach-Object { return $_.AuditInfos } | Merge-CisAuditsToMitreMap
#Tests
$CISAMitigations = $mitreMap.Map | Get-MitigationsFromFailedTests
$CISAMitigations.Keys | Should -Contain @('M1031')
}
It 'tests with an example report where just M1038 ids are [AuditInfoStatus]::False' {
$global:AuditInfos = @()
Add-ToAuditInfos -Mitigation 'M1017' -AllIDsFalse $false
Add-ToAuditInfos -Mitigation 'M1018' -AllIDsFalse $false
Add-ToAuditInfos -Mitigation 'M1021' -AllIDsFalse $false
Add-ToAuditInfos -Mitigation 'M1027' -AllIDsFalse $false
Add-ToAuditInfos -Mitigation 'M1028' -AllIDsFalse $false
Add-ToAuditInfos -Mitigation 'M1030' -AllIDsFalse $false
Add-ToAuditInfos -Mitigation 'M1031' -AllIDsFalse $false
Add-ToAuditInfos -Mitigation 'M1038' -AllIDsFalse $true
Add-ToAuditInfos -Mitigation 'M1041' -AllIDsFalse $false
Add-ToAuditInfos -Mitigation 'M1042' -AllIDsFalse $false
$Subsection = @{AuditInfos = $global:AuditInfos }
$Section1 = @{
Title = "Cis Benchmarks"
SubSections = $Subsection
}
$mitreMap = $Section1 | Where-Object { $_.Title -eq "CIS Benchmarks" } | ForEach-Object { return $_.SubSections } | ForEach-Object { return $_.AuditInfos } | Merge-CisAuditsToMitreMap
#Tests
$CISAMitigations = $mitreMap.Map | Get-MitigationsFromFailedTests
$CISAMitigations.Keys | Should -Contain @('M1038')
}
It 'tests with an example report where just M1041 ids are [AuditInfoStatus]::False' {
$global:AuditInfos = @()
Add-ToAuditInfos -Mitigation 'M1017' -AllIDsFalse $false
Add-ToAuditInfos -Mitigation 'M1018' -AllIDsFalse $false
Add-ToAuditInfos -Mitigation 'M1021' -AllIDsFalse $false
Add-ToAuditInfos -Mitigation 'M1027' -AllIDsFalse $false
Add-ToAuditInfos -Mitigation 'M1028' -AllIDsFalse $false
Add-ToAuditInfos -Mitigation 'M1030' -AllIDsFalse $false
Add-ToAuditInfos -Mitigation 'M1031' -AllIDsFalse $false
Add-ToAuditInfos -Mitigation 'M1038' -AllIDsFalse $false
Add-ToAuditInfos -Mitigation 'M1041' -AllIDsFalse $true
Add-ToAuditInfos -Mitigation 'M1042' -AllIDsFalse $false
$Subsection = @{AuditInfos = $global:AuditInfos }
$Section1 = @{
Title = "Cis Benchmarks"
SubSections = $Subsection
}
$mitreMap = $Section1 | Where-Object { $_.Title -eq "CIS Benchmarks" } | ForEach-Object { return $_.SubSections } | ForEach-Object { return $_.AuditInfos } | Merge-CisAuditsToMitreMap
#Tests
$CISAMitigations = $mitreMap.Map | Get-MitigationsFromFailedTests
$CISAMitigations.Keys | Should -Contain @('M1041')
}
It 'tests with an example report where just M1042 ids are [AuditInfoStatus]::False' {
$global:AuditInfos = @()
Add-ToAuditInfos -Mitigation 'M1017' -AllIDsFalse $false
Add-ToAuditInfos -Mitigation 'M1018' -AllIDsFalse $false
Add-ToAuditInfos -Mitigation 'M1021' -AllIDsFalse $false
Add-ToAuditInfos -Mitigation 'M1027' -AllIDsFalse $false
Add-ToAuditInfos -Mitigation 'M1028' -AllIDsFalse $false
Add-ToAuditInfos -Mitigation 'M1030' -AllIDsFalse $false
Add-ToAuditInfos -Mitigation 'M1031' -AllIDsFalse $false
Add-ToAuditInfos -Mitigation 'M1038' -AllIDsFalse $false
Add-ToAuditInfos -Mitigation 'M1041' -AllIDsFalse $false
Add-ToAuditInfos -Mitigation 'M1042' -AllIDsFalse $true
$Subsection = @{AuditInfos = $global:AuditInfos }
$Section1 = @{
Title = "Cis Benchmarks"
SubSections = $Subsection
}
$mitreMap = $Section1 | Where-Object { $_.Title -eq "CIS Benchmarks" } | ForEach-Object { return $_.SubSections } | ForEach-Object { return $_.AuditInfos } | Merge-CisAuditsToMitreMap
#Tests
$CISAMitigations = $mitreMap.Map | Get-MitigationsFromFailedTests
$CISAMitigations.Keys | Should -Contain @('M1042')
}
}
}
@@ -0,0 +1,12 @@
#Import-Module
& "$PSScriptRoot\updateATAP.ps1"
InModuleScope ATAPHtmlReport {
Describe 'Testing Get-MitreTacticName' {
It 'tests with example Values' {
Get-MitreTacticName -TacticId 'TA0042' | Should -Be "Resource Development"
Get-MitreTacticName -TacticId 'TA0004' | Should -Be "Privilege Escalation"
Get-MitreTacticName -TacticId 'TA0008' | Should -Be "Lateral Movement"
}
}
}
@@ -0,0 +1,13 @@
#Import-Module
& "$PSScriptRoot\updateATAP.ps1"
InModuleScope ATAPHtmlReport {
Describe 'Testing Get-MitreTactics' {
It 'tests with example Values' {
Get-MitreTactics -TechniqueID "T1591" | Should -Be 'TA0043'
Get-MitreTactics -TechniqueID "T1056" | Should -Be 'TA0009', 'TA0006'
}
}
}
@@ -0,0 +1,17 @@
#Import-Module
& "$PSScriptRoot\updateATAP.ps1"
InModuleScope ATAPHtmlReport {
Describe 'Testing Get-MitreTechniqueName' {
It 'tests with example values' {
Get-MitreTechniqueName -TechniqueID "T1591" | Should -Be 'Gather Victim Org Information'
Get-MitreTechniqueName -TechniqueID "T1056" | Should -Be 'Input Capture'
Get-MitreTechniqueName -TechniqueID "T1056" | Should -BeOfType String
}
It 'tests with wrong values' {
Get-MitreTechniqueName -TechniqueID "TXXXX" | Should -Be $null
Get-MitreTechniqueName -TechniqueID "TXXXX" | Should -Not -Be 'Input Capture'
}
}
}
@@ -0,0 +1,71 @@
#Import-Module
& "$PSScriptRoot\updateATAP.ps1"
InModuleScope ATAPHtmlReport {
Describe "Testing Get-TacticCounter" {
Context "When counting for a tactic without mapped tests" {
It "Should return 0" {
$AuditInfos = @{Id = "1.1.4"
Status = [AuditInfoStatus]::False
},
@{Id = "1.2.3"
Status = [AuditInfoStatus]::True
},
@{Id = "1.2.4"
Status = [AuditInfoStatus]::True
},
@{Id = "1.2.6"
Status = [AuditInfoStatus]::True
},
@{Id = "1.2.5"
Status = [AuditInfoStatus]::False
},
@{Id = "1.4.5"
Status = [AuditInfoStatus]::True
}
$Subsection = @{AuditInfos = $AuditInfos }
$Section1 = @{Title = "Cis Benchmarks"
SubSections = $Subsection
}
$Sections = $Section1
$Mappings = $Sections | Where-Object { $_.Title -eq "CIS Benchmarks" } | ForEach-Object { return $_.SubSections } | ForEach-Object { return $_.AuditInfos } | Merge-CisAuditsToMitreMap
$result = Get-TacticCounter -tactic $Mappings.Map["TA0042"] $Mappings.Map
$result | Should -Be 0
}
}
Context "Counter should be 1 if a technique is a 100% fullfilled" {
It "Should be 1" {
$AuditInfos = @{Id = "18.9.48.13"
Status = [AuditInfoStatus]::True
},
@{Id = "18.9.87.1"
Status = [AuditInfoStatus]::True
}
$Subsection = @{AuditInfos = $AuditInfos }
$Section1 = @{Title = "Cis Benchmarks"
SubSections = $Subsection
}
$Sections = $Section1
$Mappings = $Sections | Where-Object { $_.Title -eq "CIS Benchmarks" } | ForEach-Object { return $_.SubSections } | ForEach-Object { return $_.AuditInfos } | Merge-CisAuditsToMitreMap
$Mappings.Map["TA0043"]["T1592"]["18.9.87.1"] | Should -Be True
$Mappings.Map["TA0043"]["T1592"]["18.9.48.13"] | Should -Be True
$Mappings.Map["TA0043"]["T1592"].count | Should -Be 2
Get-TacticCounter "TA0043" $Mappings.Map | Should -Be 1
}
}
}
}
@@ -0,0 +1,50 @@
#Import-Module
& "$PSScriptRoot\updateATAP.ps1"
InModuleScope ATAPHtmlReport {
Describe 'Testing Merge-CisAuditsToMitreMap' {
It 'tests with an example Report' {
$AuditInfos = @{Id = "1.1.4"
Status = [AuditInfoStatus]::False
},
@{Id = "1.2.3"
Status = [AuditInfoStatus]::True
},
@{Id = "1.2.5"
Status = [AuditInfoStatus]::False
},
@{Id = "1.4.5"
Status = [AuditInfoStatus]::True
}
$Subsection = @{AuditInfos = $AuditInfos }
$Section1 = @{Title = "Cis Benchmarks"
SubSections = $Subsection
}
$Section2 = @{Title = "DISA"
$Subsection = $null
}
$Sections = $Section1, $Section2
$mapping = $Sections | Where-Object { $_.Title -eq "CIS Benchmarks" } | ForEach-Object { return $_.SubSections } | ForEach-Object { return $_.AuditInfos } | Merge-CisAuditsToMitreMap
foreach ($tactic in $mapping.Keys) {
Write-Host "$tactic = "
foreach ($technique in $($mapping[$tactic]).Keys) {
Write-Host " $technique = "
foreach ($id in $($($mapping[$tactic])[$technique]).Keys) {
Write-Host " $id = $($($($mapping[$tactic])[$technique])[$id])"
}
}
}
$mapping.GetType() | Should -Be "MitreMap"
$mapping.Map["TA0001"]["T1078"]["1.1.4"] | Should -Be False
$mapping.Map["TA0006"]["T1110"]["1.2.3"] | Should -Be True
}
}
}
+101
View File
@@ -0,0 +1,101 @@
#Import-Module
& "$PSScriptRoot\updateATAP.ps1"
InModuleScope ATAPHtmlReport {
Describe 'Testing MitreMap' {
It 'tests correct amount of techniques per tacitc' {
$mitreMap = [MitreMap]::new()
#$mitreMap.Print()
$mitreMap.map['TA0043'].count | Should -Be 10
$mitreMap.map['TA0042'].count | Should -Be 8
$mitreMap.map['TA0001'].count | Should -Be 9
$mitreMap.map['TA0002'].count | Should -Be 14
$mitreMap.map['TA0003'].count | Should -Be 19
$mitreMap.map['TA0004'].count | Should -Be 13
$mitreMap.map['TA0005'].count | Should -Be 42
$mitreMap.map['TA0006'].count | Should -Be 17
$mitreMap.map['TA0007'].count | Should -Be 31
$mitreMap.map['TA0008'].count | Should -Be 9
$mitreMap.map['TA0009'].count | Should -Be 17
$mitreMap.map['TA0011'].count | Should -Be 16
$mitreMap.map['TA0010'].count | Should -Be 9
$mitreMap.map['TA0040'].count | Should -Be 13
}
It 'tests some values' {
$mitreMap = [MitreMap]::new()
$mitreMap.map['TA0043'].ContainsKey('T1597') | Should -Be $true
$mitreMap.map['TA0001'].ContainsKey('T1200') | Should -Be $true
$mitreMap.map['TA0043'].ContainsKey('T1037') | Should -Be $false
$mitreMap.map['TA0006'].ContainsKey('T1612') | Should -Be $false
}
}
}
InModuleScope ATAPHtmlReport {
Describe 'testing functions of the class MitreMap' {
It 'tests with an example report' {
#Dummy-Data
$AuditInfos =
@{
Id = "1.1.4"
Status = [AuditInfoStatus]::False
},
@{
Id = "1.2.3"
Status = [AuditInfoStatus]::True
},
@{
Id = "1.2.5"
Status = [AuditInfoStatus]::False
},
@{
Id = "1.4.5"
Status = [AuditInfoStatus]::True
}
$Subsection = @{AuditInfos = $AuditInfos }
$Section1 = @{Title = "Cis Benchmarks"
SubSections = $Subsection
}
$mitreMap = $Section1 | Where-Object { $_.Title -eq "CIS Benchmarks" } | ForEach-Object { return $_.SubSections } | ForEach-Object { return $_.AuditInfos } | Merge-CisAuditsToMitreMap
#$mitreMap.Print()
#Tests
$mitreMap.GetType() | Should -Be "MitreMap"
$mitreMap.Map["TA0001"]["T1078"]["1.1.4"].GetType() | Should -Be 'AuditInfoStatus'
$mitreMap.Map["TA0001"]["T1078"]["1.1.4"] | Should -Be False
$mitreMap.Map["TA0006"]["T1110"]["1.2.3"] | Should -Be True
$failedIDs = @()
foreach ($tactic in $mitreMap.Map.Keys) {
foreach ($technique in $mitreMap.Map[$tactic].Keys) {
$mitreMap.Map[$tactic][$technique].Keys |
Where-Object {$mitreMap.Map[$tactic][$technique][$_] -eq [AuditInfoStatus]::False} |
ForEach-Object {
if($failedIDs -notcontains $_){
$failedIDs += $_
}
}
}
}
$CISAMedigations = @()
$json = Get-Content -Raw "$PSScriptRoot\..\resources\CISToAttackMappingData.json" | ConvertFrom-Json
foreach($i in $failedIDs) {
if($null -ne $json.'CISAttackMapping'.$i.'Mitigation1' -and $CISAMedigations -notcontains $json.'CISAttackMapping'.$i.'Mitigation1'){
$CISAMedigations += $json.'CISAttackMapping'.$i.'Mitigation1'
}
if($null -ne $json.'CISAttackMapping'.$i.'Mitigation2' -and $CISAMedigations -notcontains $json.'CISAttackMapping'.$i.'Mitigation2'){
$CISAMedigations += $json.'CISAttackMapping'.$i.'Mitigation2'
}
}
foreach($i in $CISAMedigations) {
Write-Host $i
}
}
}
}
@@ -0,0 +1,43 @@
#Import-Module
& "$PSScriptRoot\updateATAP.ps1"
InModuleScope ATAPHtmlReport {
Describe 'testing tactic order in MitreMap' {
It 'tests with an example report' {
#Dummy-Data
$AuditInfos =
@{
Id = "1.1.4"
Status = [AuditInfoStatus]::False
},
@{
Id = "1.2.3"
Status = [AuditInfoStatus]::True
},
@{
Id = "1.2.5"
Status = [AuditInfoStatus]::False
},
@{
Id = "1.4.5"
Status = [AuditInfoStatus]::True
}
$Subsection = @{AuditInfos = $AuditInfos }
$Section1 = @{Title = "Cis Benchmarks"
SubSections = $Subsection
}
$mitreMap = $Section1 | Where-Object { $_.Title -eq "CIS Benchmarks" } | ForEach-Object { return $_.SubSections } | ForEach-Object { return $_.AuditInfos } | Merge-CisAuditsToMitreMap
$mitreMap.Print()
$tactics = (Get-Content -Raw "$PSScriptRoot\..\resources\MitreTactics.json" | ConvertFrom-Json).psobject.properties.name
#check order
$i = 0
foreach ($tactic in $mitreMap.Map.Keys) {
$tactic | Should -Be $tactics[$i]
$i++
}
}
}
}
@@ -0,0 +1,24 @@
#Import-Module
& "$PSScriptRoot\updateATAP.ps1"
InModuleScope ATAPHtmlReport {
Describe 'Testing Check-CompatibleMitreReport' {
It 'Testing with diffrent Reports' {
$Title = "Windows 10 Report"
$os = [System.Environment]::OSVersion.Platform
Test-CompatibleMitreReport -Title $Title -os $os | Should -Be $true
$Title = "Windows 11 Report"
Test-CompatibleMitreReport -Title $Title -os $os | Should -Be $true
$Title = "Windows Server 2019 Audit Report"
Test-CompatibleMitreReport -Title $Title -os $os | Should -Be $true
$Title = "Windows Server 2022 Audit Report"
Test-CompatibleMitreReport -Title $Title -os $os | Should -Be $true
$Title = "Windows 7 Report"
Test-CompatibleMitreReport -Title $Title -os $os | Should -Be $false
}
}
}
@@ -0,0 +1,20 @@
#Import-Module
& "$PSScriptRoot\updateATAP.ps1"
InModuleScope ATAPHtmlReport {
Describe 'Testing get-MitreLink' {
It 'tests for tactics' {
get-MitreLink -type tactics -id 'TA0001' | Should -Be 'https://attack.mitre.org/tactics/TA0001/'
get-MitreLink -type tactics -id 'TA0008' | Should -Be 'https://attack.mitre.org/tactics/TA0008/'
}
It 'tests for techniques' {
get-MitreLink -type techniques -id 'T1548' | Should -Be 'https://attack.mitre.org/techniques/T1548/'
get-MitreLink -type techniques -id 'T1119' | Should -Be 'https://attack.mitre.org/techniques/T1119/'
}
It 'tests for techniques' {
get-MitreLink -type mitigations -id 'M1047' | Should -Be 'https://attack.mitre.org/mitigations/M1047/'
}
}
}
@@ -0,0 +1,73 @@
#Import-Module
& "$PSScriptRoot\updateATAP.ps1"
InModuleScope ATAPHtmlReport {
Describe 'Testing MitreMap' {
It 'tests correct amount of techniques per tacitc' {
$mitreMap = [MitreMap]::new()
$mitreMap.Print()
$mitreMap.map['TA0043'].count | Should -Be 10
$mitreMap.map['TA0042'].count | Should -Be 8
$mitreMap.map['TA0001'].count | Should -Be 9
$mitreMap.map['TA0002'].count | Should -Be 14
$mitreMap.map['TA0003'].count | Should -Be 19
$mitreMap.map['TA0004'].count | Should -Be 13
$mitreMap.map['TA0005'].count | Should -Be 42
$mitreMap.map['TA0006'].count | Should -Be 17
$mitreMap.map['TA0007'].count | Should -Be 31
$mitreMap.map['TA0008'].count | Should -Be 9
$mitreMap.map['TA0009'].count | Should -Be 17
$mitreMap.map['TA0011'].count | Should -Be 16
$mitreMap.map['TA0010'].count | Should -Be 9
$mitreMap.map['TA0040'].count | Should -Be 13
}
It 'tests some values' {
$mitreMap = [MitreMap]::new()
$mitreMap.map['TA0043'].ContainsKey('T1597') | Should -Be $true
$mitreMap.map['TA0001'].ContainsKey('T1200') | Should -Be $true
$mitreMap.map['TA0043'].ContainsKey('T1037') | Should -Be $false
$mitreMap.map['TA0006'].ContainsKey('T1612') | Should -Be $false
}
}
}
InModuleScope ATAPHtmlReport {
Describe 'testing read from json' {
It 'tests if json file is read in correctly' {
$AuditInfos =
@{
Id = "1.1.4"
Status = [AuditInfoStatus]::False
},
@{
Id = "1.2.3"
Status = [AuditInfoStatus]::True
},
@{
Id = "1.2.5"
Status = [AuditInfoStatus]::False
},
@{
Id = "1.4.5"
Status = [AuditInfoStatus]::True
}
$Subsection = @{AuditInfos = $AuditInfos }
$Section1 = @{Title = "Cis Benchmarks"
SubSections = $Subsection
}
$mitreMap = $Section1 | Where-Object { $_.Title -eq "CIS Benchmarks" } | ForEach-Object { return $_.SubSections } | ForEach-Object { return $_.AuditInfos } | Merge-CisAuditsToMitreMap
$mitreMap.Print()
#Tests
$mitreMap.GetType() | Should -Be "MitreMap"
$mitreMap.Map["TA0001"]["T1078"]["1.1.4"].GetType() | Should -Be 'AuditInfoStatus'
$mitreMap.Map["TA0001"]["T1078"]["1.1.4"] | Should -Be False
$mitreMap.Map["TA0006"]["T1110"]["1.2.3"] | Should -Be True
}
}
}
+16
View File
@@ -0,0 +1,16 @@
#set the directory where you are programming
$dev_directory = "$PSScriptRoot\..\.."
#deletes the old modules, if they exist
if(Test-Path "C:\Program Files\WindowsPowerShell\Modules\ATAPAuditor") {
Remove-Item -Path "C:\Program Files\WindowsPowerShell\Modules\ATAPAuditor" -recurse
}
if(Test-Path "C:\Program Files\WindowsPowerShell\Modules\ATAPHtmlReport") {
Remove-Item -Path "C:\Program Files\WindowsPowerShell\Modules\ATAPHtmlReport" -recurse
}
#copys the new modules to the module path of powershell
Copy-Item ($dev_directory + "\ATAPAuditor") -Destination "C:\Program Files\WindowsPowerShell\Modules" -recurse
Copy-Item ($dev_directory + "\ATAPHtmlReport") -Destination "C:\Program Files\WindowsPowerShell\Modules" -recurse
#imports ATAPAuditor and ATAPHtmlReport
Import-Module ATAPAuditor -Force
Import-Module ATAPHtmlReport -Force