MITRE ATT&CK Integration¶

Stentor includes a built-in MITRE ATT&CK knowledge base with 85 technique definitions (62 official MITRE techniques + 23 custom internal techniques). The knowledge base powers technique-aware reporting, OPSEC guidance, and CNA scripting functions.

Knowledge Base¶

Technique definitions are stored as YAML files in server/knowledge_base/techniques/. Each file contains:

• Technique ID (MITRE or internal)
• Name and description
• Tactic mapping (comma-separated for multi-tactic techniques)
• Execution methods with parameter schemas
• OPSEC guidance -- risk level, detection indicators, and mitigations
• Expected forensic artifacts -- event log sources, event IDs, and descriptions
• Related techniques

Coverage¶

The knowledge base covers techniques across all major ATT&CK tactics:

CNA Scripting Functions¶

Six attack_* functions provide programmatic access to the knowledge base:

Examples¶

# Look up a technique
println("Name: " . attack_name("T1003.001"));
# → OS Credential Dumping: LSASS Memory

println("URL: " . attack_url("T1003.001"));
# → https://attack.mitre.org/techniques/T1003/001/

# Get detection guidance
println("Detection:\n" . attack_detect("T1003.001"));
# → Suspicious API calls detected
# → Unusual memory allocation patterns

# Get associated tactics
@tactics = attack_tactics("T1003.001");
println("Tactics: " . join(", ", @tactics));
# → Tactics: credential-access

# Use in a custom report
report("TTP Analysis");
page("Technique Details");
h2(attack_name("T1055.003"));
p(attack_describe("T1055.003"));
h3("Detection Guidance");
p(attack_detect("T1055.003"));
report_save("/tmp/ttp-analysis.pdf");

Lookup Methods¶

Techniques can be looked up by either their MITRE ID or internal ID:

# By MITRE ID
attack_name("T1003.001");    # → "OS Credential Dumping: LSASS Memory"

# By internal ID
attack_name("BOF_EXECUTE");  # → "BOF Execution (Native API)"

Automatic TTP Tracking¶

When beacons execute tasks, the activity timeline report automatically maps known task types to MITRE ATT&CK technique IDs:

This mapping feeds into the TTP Report (type=ttp), which provides tactic-level statistics and per-technique usage counts.

Artifact Tracking¶

Stentor automatically records artifacts generated during operations. Every beacon task, payload generation, and post-exploitation action creates an artifact record with its associated MITRE ATT&CK technique.

How It Works¶

The ArtifactRecorderInterface (defined in server/internal/c2/) records artifacts in real-time:

1. Inference: When a task is executed, the recorder infers the MITRE technique from the task type using the taskTypeToMitre mapping table above
2. Recording: Artifact records are written via non-blocking goroutines with batch INSERT for performance
3. Payload tracking: Build-time artifacts (e.g., "Code Mutation" when mutation is enabled) are recorded alongside runtime artifacts

Artifact Record Fields¶

Querying Artifacts¶

REST API:

# List all artifacts (paginated)
curl -s "https://stentor.app/api/v1/artifacts?page=1&per_page=50" \
  -H "Authorization: Bearer $TOKEN"

# Filter by technique
curl -s "https://stentor.app/api/v1/artifacts?technique=T1055.003" \
  -H "Authorization: Bearer $TOKEN"

# Filter by task type
curl -s "https://stentor.app/api/v1/artifacts?type=inject" \
  -H "Authorization: Bearer $TOKEN"

ATT&CK Navigator Export¶

Export your operation's technique coverage as an ATT&CK Navigator layer JSON file. The Navigator layer provides a visual heatmap of techniques used during an engagement, with color intensity based on usage frequency.

Export Endpoint¶

GET /api/v1/artifacts/navigator

# Download Navigator layer JSON
curl -s "https://stentor.app/api/v1/artifacts/navigator" \
  -H "Authorization: Bearer $TOKEN" \
  --output navigator-layer.json

# Preview in browser (no Content-Disposition header)
curl -s "https://stentor.app/api/v1/artifacts/navigator?preview=true" \
  -H "Authorization: Bearer $TOKEN"

Filtering¶

Color Mapping¶

The Navigator layer uses color interpolation (white to red) based on technique usage frequency:

Using with ATT&CK Navigator¶

1. Export the layer JSON from Stentor
2. Open ATT&CK Navigator in a browser
3. Click "Open Existing Layer" and upload the JSON file
4. The heatmap shows which techniques were used and their frequency

This is valuable for engagement reports -- it provides a visual summary of the operation's technique coverage that maps directly to the MITRE ATT&CK framework.

UI Access¶

The Navigator export is also available from the Stentor UI:

1. Navigate to Reporting > Artifacts
2. Apply type/technique filters as needed (select "all" to clear filters)
3. Click Export Navigator Layer
4. The JSON file downloads automatically

The UI uses server-side filtering -- switching type or technique filters refreshes the entire query.