From 9a2de4bf940a09e8e37c6c4d941223d2b92f5a45 Mon Sep 17 00:00:00 2001 From: Daniel Rosenthal Date: Sat, 31 Jan 2026 11:57:23 +0100 Subject: [PATCH] 2.5.0 --- CHANGELOG.md | 26 ++++ README.md | 7 +- demo.json | 376 +++++++++++++++++++++++++++++++++++++++++++++++++++ 3 files changed, 408 insertions(+), 1 deletion(-) create mode 100644 demo.json diff --git a/CHANGELOG.md b/CHANGELOG.md index a0218d9..72dcd38 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -6,6 +6,32 @@ This changelog also serves as a development context document for AI agents conti --- +## [2.5.0] - 2026-01-31 + +### Added +- Embedded Relationship Explorer view alongside the Kill Chain Editor with breadcrumbed tab navigation. +- Entity deep-linking for the explorer via URL parameters. +- Phase item action buttons (Explore, Edit, Remove) plus a detail modal for quick review. +- Metadata icon badges and a legend row for CVE, observables, links, comments, and confidence. +- Demo kill chain mapping with full-metadata coverage for import testing. + +### Changed +- Mitigation clicks now open the embedded explorer in the current tab to preserve editor state. +- Leave-site confirmation behavior is configurable via `CONFIG.navigation.confirmOnLeave`. +- Phase item layout updated to header/body/footer rows with improved truncation rules. +- Relationship view rendering now escapes IDs and names using safe helpers. + +### Fixed +- Metadata storage no longer double-encodes values on save. +- SVG icon hover state now follows `currentColor` for consistent theming. +- Import validation tests now align with the current metadata model and validate demo feature coverage. + +### Removed +- Group-by-CAPEC feature and related UI/state logic. +- Legacy Group-by-CAPEC test fixtures and export schema references. + +--- + ## [2.4.3] - 2026-01-31 ### Fixed - Import & Visual Corrections diff --git a/README.md b/README.md index 5e71b31..88248de 100644 --- a/README.md +++ b/README.md @@ -4,7 +4,7 @@ An editor for creating enriched Cyber Kill Chain assessments by mapping MITRE AT ### Work in progress -![Version](https://img.shields.io/badge/version-2.4.3-blue) +![Version](https://img.shields.io/badge/version-2.5.0-blue) ![License](https://img.shields.io/badge/license-Apache%202.0-green) ![Dependencies](https://img.shields.io/badge/dependencies-none-brightgreen) @@ -39,6 +39,11 @@ The Relationship Explorer is a second main view that lets you investigate ATT&CK 6. Use the header navigation to switch to Relationship Explorer 7. Export your attack chain as JSON or CSV +## Testing + +- **Demo kill chain**: Import [tests/demo.json](tests/demo.json) to exercise all metadata fields (CVE/CVSS, observables, links, confidence) and multi-phase coverage. +- **Import validation suite**: Open [tests/import-validation/test-runner.html](tests/import-validation/test-runner.html) in a browser to run validation, sanitization, and feature checks (includes the demo file). + ## Project Structure ``` diff --git a/demo.json b/demo.json new file mode 100644 index 0000000..9903130 --- /dev/null +++ b/demo.json @@ -0,0 +1,376 @@ +{ + "version": "2.4.3", + "schema": "killchain-export-lite", + "exportedAt": "2026-01-31T09:00:00.000Z", + "view": "killchain", + "activeTab": "attack", + "layers": { "attack": true, "capec": true, "cwe": true }, + "hideEmpty": false, + "assignments": { + "IN:reconnaissance": { + "techniques": [ + { + "id": "T1595", + "metadata": { + "score": "medium", + "confidence": 42, + "comments": "Active scanning against public-facing infrastructure consistent with an APT-style intrusion.", + "hyperlinks": [ + { "label": "Recon overview", "url": "https://example.com/advisory/recon" } + ], + "observables": [ + { "type": "ipv4-addr", "value": "192.0.2.10" }, + { "type": "domain-name", "value": "vpn-gateway.example.com" }, + { "type": "url", "value": "https://vpn-gateway.example.com/" } + ] + } + }, + { + "id": "T1592", + "metadata": { + "score": "low", + "confidence": 20, + "comments": "Harvested host information and exposed services from public sources.", + "observables": [ + { "type": "domain-name", "value": "docs.example.org" } + ] + } + } + ], + "capecs": [ + { + "id": "CAPEC-169", + "metadata": { + "score": "low", + "comments": "Reconnaissance and footprinting activity prior to initial access." + } + } + ], + "cwes": [] + }, + "IN:resource-development": { + "techniques": [ + { + "id": "T1583.001", + "metadata": { + "score": "medium", + "confidence": 35, + "comments": "Registered look-alike domains for staging and phishing.", + "observables": [ + { "type": "domain-name", "value": "login-update.example.net" } + ] + } + } + ], + "capecs": [], + "cwes": [] + }, + "IN:delivery": { + "techniques": [ + { + "id": "T1566.002", + "metadata": { + "score": "high", + "confidence": 70, + "comments": "Spearphishing link used to deliver a staged loader.", + "observables": [ + { "type": "email-addr", "value": "it-support@example.com" }, + { "type": "url", "value": "https://login-update.example.net/portal" } + ] + } + } + ], + "capecs": [ + { + "id": "CAPEC-98", + "metadata": { + "score": "medium", + "comments": "Phishing used for initial access and credential theft." + } + } + ], + "cwes": [] + }, + "IN:social-engineering": { + "techniques": [ + { + "id": "T1204.001", + "metadata": { + "score": "medium", + "confidence": 55, + "comments": "User execution of a malicious link disguised as an SSO update notice." + } + } + ], + "capecs": [], + "cwes": [] + }, + "IN:exploitation": { + "techniques": [ + { + "id": "T1190", + "metadata": { + "score": "critical", + "confidence": 88, + "cveId": "CVE-2021-44228", + "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", + "comments": "Public-facing app exploit for initial foothold (Log4Shell-style tradecraft).", + "observables": [ + { "type": "url", "value": "https://app.example.com/" } + ] + } + } + ], + "capecs": [ + { + "id": "CAPEC-242", + "metadata": { + "score": "high", + "comments": "Code injection technique aligned with exploitation of exposed services." + } + } + ], + "cwes": [ + { + "id": "CWE-78", + "metadata": { + "score": "high", + "comments": "OS command injection risk in exposed services." + } + } + ] + }, + "IN:persistence": { + "techniques": [ + { + "id": "T1053.005", + "metadata": { + "score": "high", + "confidence": 75, + "comments": "Scheduled task persists a loader across reboots.", + "observables": [ + { "type": "file-name", "value": "sysupdate.ps1" }, + { "type": "file-hash-sha256", "value": "d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2" } + ] + } + } + ], + "capecs": [], + "cwes": [] + }, + "IN:defense-evasion": { + "techniques": [ + { + "id": "T1070.004", + "metadata": { + "score": "medium", + "confidence": 60, + "comments": "Cleared log artifacts to reduce detection surface." + } + } + ], + "capecs": [], + "cwes": [] + }, + "IN:command-control": { + "techniques": [ + { + "id": "T1071.001", + "metadata": { + "score": "high", + "confidence": 80, + "comments": "C2 over HTTPS with domain-fronted infrastructure.", + "observables": [ + { "type": "domain-name", "value": "cdn-updates.example.com" }, + { "type": "url", "value": "https://cdn-updates.example.com/api" } + ] + } + } + ], + "capecs": [], + "cwes": [] + }, + "THROUGH:pivoting": { + "techniques": [ + { + "id": "T1090.003", + "metadata": { + "score": "medium", + "confidence": 50, + "comments": "Multi-hop proxying used to reach segmented environments." + } + } + ], + "capecs": [], + "cwes": [] + }, + "THROUGH:discovery": { + "techniques": [ + { + "id": "T1082", + "metadata": { + "score": "low", + "confidence": 35, + "comments": "System information discovery to map target assets." + } + } + ], + "capecs": [], + "cwes": [] + }, + "THROUGH:privilege-escalation": { + "techniques": [ + { + "id": "T1068", + "metadata": { + "score": "high", + "confidence": 72, + "cveId": "CVE-2021-34527", + "cvssVector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", + "comments": "Privilege escalation leveraging a known print spooler vulnerability." + } + } + ], + "capecs": [], + "cwes": [ + { + "id": "CWE-269", + "metadata": { + "score": "medium", + "comments": "Improper privilege management enabling escalation." + } + } + ] + }, + "THROUGH:execution": { + "techniques": [ + { + "id": "T1059.001", + "metadata": { + "score": "high", + "confidence": 78, + "comments": "PowerShell used to execute staging scripts.", + "observables": [ + { "type": "file-name", "value": "stage.ps1" }, + { "type": "file-hash-md5", "value": "1a2b3c4d5e6f78901a2b3c4d5e6f7890" } + ] + } + } + ], + "capecs": [], + "cwes": [] + }, + "THROUGH:credential-access": { + "techniques": [ + { + "id": "T1003.001", + "metadata": { + "score": "critical", + "confidence": 90, + "comments": "Credential dumping from LSASS memory." + } + } + ], + "capecs": [ + { + "id": "CAPEC-112", + "metadata": { + "score": "medium", + "comments": "Password guessing and credential access activity." + } + } + ], + "cwes": [ + { + "id": "CWE-522", + "metadata": { + "score": "low", + "comments": "Weak credential management noted in the environment." + } + } + ] + }, + "THROUGH:lateral-movement": { + "techniques": [ + { + "id": "T1021.001", + "metadata": { + "score": "high", + "confidence": 65, + "comments": "Remote services used to move laterally across hosts.", + "observables": [ + { "type": "ipv4-addr", "value": "198.51.100.25" } + ] + } + } + ], + "capecs": [], + "cwes": [] + }, + "OUT:collection": { + "techniques": [ + { + "id": "T1114.001", + "metadata": { + "score": "medium", + "confidence": 52, + "comments": "Email collection from local clients." + } + } + ], + "capecs": [], + "cwes": [] + }, + "OUT:exfiltration": { + "techniques": [ + { + "id": "T1041", + "metadata": { + "score": "high", + "confidence": 82, + "comments": "Exfiltration over the existing C2 channel.", + "observables": [ + { "type": "url", "value": "https://cdn-updates.example.com/exfil" } + ] + } + } + ], + "capecs": [], + "cwes": [] + }, + "OUT:impact": { + "techniques": [ + { + "id": "T1486", + "metadata": { + "score": "critical", + "confidence": 85, + "comments": "Ransomware encryption used to disrupt operations.", + "observables": [ + { "type": "file-name", "value": "README-RECOVER.txt" } + ] + } + } + ], + "capecs": [], + "cwes": [] + }, + "OUT:objectives": { + "techniques": [ + { + "id": "T1490", + "metadata": { + "score": "high", + "confidence": 70, + "comments": "Inhibited system recovery to pressure ransom payment.", + "observables": [ + { "type": "threat-actor", "value": "LockBit" } + ] + } + } + ], + "capecs": [], + "cwes": [] + } + } +}