Cymulate v2

This Integration is part of the Cymulate Pack.#

Supported versions

Supported Cortex XSOAR versions: 6.0.0 and later.

Multi-Vector Cyber Attack, Breach and Attack Simulation. This integration was integrated and tested with API version 1 of cymulate

This is the default integration for this content pack when configured by the Data Onboarder in Cortex XSIAM.

Configure cymulate_v2 on Cortex XSOAR#

Navigate to Settings > Integrations > Servers & Services.
Search for cymulate_v2.

Click Add instance to create and configure a new integration instance.

Parameter	Description	Required
API token		True
Base URL		False
Fetch incidents		False
Fetch category	Choose one or more categories to fetch.	False
Incident type		False
First fetch timestamp (<number> <time unit>, e.g., 12 hours, 7 days)		False
Max Fetch	Maximal number of incidents to fetch. Max value can be no grater than 35.	False
Trust any certificate (not secure)		False
Use system proxy settings		False

Click Test to validate the URLs, token, and connection.

Commands#

You can execute these commands from the Cortex XSOAR CLI, as part of an automation, or in a playbook. After you successfully execute a command, a DBot message appears in the War Room with the command details.

Fetch Incidents command#

Retrieves new incidents every interval (default is 1 minute). The fetch incident command will retrieve incidents from all selected modules chosen in the configuration page by the user. The next run will be calculated by the latest timestamp of all modules, to avoid duplications. NOTE: We fetch only one module per fetch call.

cymulate-exfiltration-template-list#

Retrieve the exfiltration template list.

Base Command#

cymulate-exfiltration-template-list

Input#

There are no input arguments for this command.

Context Output#

Path	Type	Description
Cymulate.Exfiltration.Template.id	String	Template ID.
Cymulate.Exfiltration.Template.name	String	Template name.

Command Example#

!cymulate-exfiltration-template-list

Context Example#

{
    "Cymulate": {
        "Exfiltration": {
            "Templates": [
                {
                    "id": "5df0e79b85a00138dc648e75",
                    "name": "Cymulate Best Practice"
                },
                {
                    "id": "5df0e7d585a00138dc648e8f",
                    "name": "Cloud Services"
                },
                {
                    "id": "5df0e80885a00138dc648ea7",
                    "name": "Network Protocols"
                },
                {
                    "id": "5df0e82e85a00138dc648ebb",
                    "name": "Email"
                },
                {
                    "id": "5df25b3696fa2af420a379b9",
                    "name": "Physical"
                }
            ]
        }
    }
}

Human Readable Output#

Exfiltration templates list:#
id name
5df0e79b85a00138dc648e75 Cymulate Best Practice
5df0e7d585a00138dc648e8f Cloud Services
5df0e80885a00138dc648ea7 Network Protocols
5df0e82e85a00138dc648ebb Email
5df25b3696fa2af420a379b9 Physical

id	name
5df0e79b85a00138dc648e75	Cymulate Best Practice
5df0e7d585a00138dc648e8f	Cloud Services
5df0e80885a00138dc648ea7	Network Protocols
5df0e82e85a00138dc648ebb	Email
5df25b3696fa2af420a379b9	Physical

cymulate-exfiltration-start#

Create a new exfiltration assessment.

Base Command#

cymulate-exfiltration-start

Input#

Argument Name	Description	Required
template_id	The ID of the template to run the exfiltration Assessment with. Can be retrieved using Cymulate's UI, or using cymulate-exfiltration-template-list command.	Required
agent_name	agent name to run simulation attacks.	Required
schedule	whether to schedule the automated assessment periodically. Possible values are: true, false.	Required
schedule_loop	Loop size of the scheduled agent. For example: to run the agent only once, use the value 'one-time'. Possible values are: one-time, daily, weekly, monthly.	Required
agent_profile_name	agent profile name to run simulation attacks.	Optional

Context Output#

Path	Type	Description
Cymulate.Exfiltration.id	String	New exfiltration assessment creation ID.
Cymulate.Exfiltration.success	Boolean	New exfiltration assessment creation success status.

Command Example#

!cymulate-exfiltration-start template_id="5df0e79b85a00138dc648e75" agent_name="Cymulate_agent" schedule="false" schedule_loop="one-time"

Context Example#

{
    "Cymulate": {
        "Exfiltration": {
            "id": "id_1",
            "success": true
        }
    }
}

Human Readable Output#

Starting exfiltration assessment:#
id success
id_1 true

id	success
id_1	true

cymulate-exfiltration-stop#

Stop a running exfiltration assessment.

Base Command#

cymulate-exfiltration-stop

Input#

There are no input arguments for this command.

Context Output#

Path	Type	Description
Cymulate.Exfiltration.data	String	New exfiltration assessment stopping data.
Cymulate.Exfiltration.success	Boolean	New exfiltration assessment stopping success status.

Command Example#

!cymulate-exfiltration-stop

Context Example#

{
    "Cymulate": {
        "Exfiltration": {
            "data": "ok",
            "success": true
        }
    }
}

Human Readable Output#

Stopping exfiltration assessment:#
data success
ok true

data	success
ok	true

cymulate-exfiltration-status#

Get exfiltration assessment status.

Base Command#

cymulate-exfiltration-status

Input#

Argument Name	Description	Required
assessment_id	Assessment ID.	Required

Context Output#

Path	Type	Description
Cymulate.Exfiltration.id	String	New exfiltration assessment stop ID.
Cymulate.Exfiltration.inProgress	Boolean	Whether the assessment is in progress.
Cymulate.Exfiltration.progress	Number	Percentage of the progress of the assessment.
Cymulate.Exfiltration.categories	String	Categories.

Command Example#

!cymulate-exfiltration-status assessment_id="id_2"

Context Example#

{
    "Cymulate": {
        "Exfiltration": {
            "categories": [
                "http",
                "https",
                "dns",
                "dns-tunneling",
                "icmp",
                "outlook",
                "device",
                "telnet",
                "sftp",
                "slack",
                "googledrive",
                "onedrive",
                "port_scanning",
                "msteams",
                "gmail",
                "gitlab",
                "azure_blob",
                "aws_s3_bucket",
                "github",
                "googlestorage",
                "browsinghttps",
                "browsinghttp"
            ],
            "id": "id_2",
            "inProgress": false,
            "progress": 0
        }
    }
}

Human Readable Output#

Exfiltration assessment status:#
categories id inProgress progress
http,
https,
dns,
dns-tunneling,
icmp,
outlook,
device,
telnet,
sftp,
slack,
googledrive,
onedrive,
port_scanning,
msteams,
gmail,
gitlab,
azure_blob,
aws_s3_bucket,
github,
googlestorage,
browsinghttps,
browsinghttp id_2 false 0

categories	id	inProgress	progress
http, https, dns, dns-tunneling, icmp, outlook, device, telnet, sftp, slack, googledrive, onedrive, port_scanning, msteams, gmail, gitlab, azure_blob, aws_s3_bucket, github, googlestorage, browsinghttps, browsinghttp	id_2	false	0

cymulate-email-gateway-template-list#

Retrieve the email gateway template list.

Base Command#

cymulate-email-gateway-template-list

Input#

There are no input arguments for this command.

Context Output#

Path	Type	Description
Cymulate.EmailGateway.Template.id	String	Template ID.
Cymulate.EmailGateway.Template.name	String	Template name.

Command Example#

!cymulate-email-gateway-template-list

Context Example#

{
    "Cymulate": {
        "EmailGateway": {
            "Templates": [
                {
                    "id": "5c6920853659191ccf6858fc",
                    "name": "free assessment"
                },
                {
                    "id": "5c6920853659191ccf6858fb",
                    "name": "cymulate best practice"
                },
                {
                    "id": "5db5ab6e79a0bf2feedaf9a7",
                    "name": "cymulate best practice - high risk"
                },
                {
                    "id": "5c6968e43659191ccf685929",
                    "name": "office payloads"
                },
                {
                    "id": "5c6968ec3659191ccf68592a",
                    "name": "executables payloads"
                },
                {
                    "id": "5c73b2ce3febfc300976c6e3",
                    "name": "exploits"
                },
                {
                    "id": "5c7f96963febfc300976c7be",
                    "name": "malwares"
                },
                {
                    "id": "5c7f977bc9545f79ea8b03c0",
                    "name": "ransomwares"
                }
            ]
        }
    }
}

Human Readable Output#

Email gateway templates list:#
id name
5c6920853659191ccf6858fc free assessment
5c6920853659191ccf6858fb cymulate best practice
5db5ab6e79a0bf2feedaf9a7 cymulate best practice - high risk
5c6968e43659191ccf685929 office payloads
5c6968ec3659191ccf68592a executables payloads
5c73b2ce3febfc300976c6e3 exploits
5c7f96963febfc300976c7be malwares
5c7f977bc9545f79ea8b03c0 ransomwares

id	name
5c6920853659191ccf6858fc	free assessment
5c6920853659191ccf6858fb	cymulate best practice
5db5ab6e79a0bf2feedaf9a7	cymulate best practice - high risk
5c6968e43659191ccf685929	office payloads
5c6968ec3659191ccf68592a	executables payloads
5c73b2ce3febfc300976c6e3	exploits
5c7f96963febfc300976c7be	malwares
5c7f977bc9545f79ea8b03c0	ransomwares

cymulate-email-gateway-start#

Create a new email gateway assessment.

Base Command#

cymulate-email-gateway-start

Input#

Argument Name	Description	Required
template_id	The ID of the template to run the email gateway assessment with. Can be retrieved using Cymulate's UI, or using cymulate-email-gateway-template-list command.	Required
agent_email	agent email.	Required
schedule	whether to schedule the automated assessment periodically. Possible values are: true, false.	Required
schedule_loop	Loop size of the scheduled agent. For example: to run the agent only once, use the value 'one-time'. Possible values are: one-time, daily, weekly, monthly.	Required

Context Output#

Path	Type	Description
Cymulate.EmailGateway.id	String	New email gateway assessment creation ID.
Cymulate.EmailGateway.success	Boolean	New email gateway assessment creation success status.

Command Example#

!cymulate-email-gateway-start template_id="5c6920853659191ccf6858fc" agent_email="test@cymulate.com" schedule="false" schedule_loop="one-time"

Context Example#

{
    "Cymulate": {
        "EmailGateway": {
            "id": "id_3",
            "success": true
        }
    }
}

Human Readable Output#

Starting email gateway assessment:#
id success
id_3 true

id	success
id_3	true

cymulate-email-gateway-stop#

Stop a running exfiltration assessment.

Base Command#

cymulate-email-gateway-stop

Input#

There are no input arguments for this command.

Context Output#

Path	Type	Description
Cymulate.EmailGateway.data	String	Email gateway assessment stopping data.
Cymulate.EmailGateway.success	Boolean	Email gateway assessment stopping success status.

Command Example#

!cymulate-email-gateway-stop

Context Example#

{
    "Cymulate": {
        "EmailGateway": {
            "data": "ok",
            "success": true
        }
    }
}

Human Readable Output#

Stopping email gateway assessment:#
data success
ok true

data	success
ok	true

cymulate-email-gateway-status#

Get the email gateway assessment status.

Base Command#

cymulate-email-gateway-status

Input#

Argument Name	Description	Required
assessment_id	Assessment ID.	Required

Context Output#

Path	Type	Description
Cymulate.EmailGateway.id	String	Email gateway assessment ID.
Cymulate.EmailGateway.success	Boolean	Whether the assessment was successful.
Cymulate.EmailGateway.inProgress	Boolean	Whether the assessment is in progress.
Cymulate.EmailGateway.progress	Number	Percentage of the progress of the assessment.
Cymulate.EmailGateway.addresses	String	Addresses connected to the assessment.

Command Example#

!cymulate-email-gateway-status assessment_id="id_4"

Context Example#

{
    "Cymulate": {
        "EmailGateway": {
            "addresses": [
                "test@cymulate.com"
            ],
            "categories": [
                "worm"
            ],
            "id": "id_4",
            "inProgress": false,
            "progress": 0
        }
    }
}

Human Readable Output#

Email gateway assessment status:#
addresses categories id inProgress progress
test@cymulate.com worm id_4 false 0

addresses	categories	id	inProgress	progress
test@cymulate.com	worm	id_4	false	0

cymulate-endpoint-security-template-list#

Retrieve the endpoint security template list.

Base Command#

cymulate-endpoint-security-template-list

Input#

There are no input arguments for this command.

Context Output#

Path	Type	Description
Cymulate.EndpointSecurity.Template.id	String	Template ID.
Cymulate.EndpointSecurity.Template.name	String	Template name.

Command Example#

!cymulate-endpoint-security-template-list

Context Example#

{
    "Cymulate": {
        "EndpointSecurity": {
            "Templates": [
                {
                    "id": "5c87a26f548a3c7c4c184a5e",
                    "name": "Free Assessment"
                },
                {
                    "id": "5c97a50c5727c58a295d0459",
                    "name": "Cymulate Best Practice"
                },
                {
                    "id": "5e98461d312a740ee4839700",
                    "name": "DLL Side loading"
                },
                {
                    "id": "5c87a314548a3c7c4c184a5f",
                    "name": "Cymulate Behavior-based"
                },
                {
                    "id": "5c87a314548a3c7c4c184a60",
                    "name": "Cymulate Signature-based"
                }
            ]
        }
    }
}

Human Readable Output#

Endpoint security templates list:#
id name
5c87a26f548a3c7c4c184a5e Free Assessment
5c97a50c5727c58a295d0459 Cymulate Best Practice
5e98461d312a740ee4839700 DLL Side loading
5c87a314548a3c7c4c184a5f Cymulate Behavior-based
5c87a314548a3c7c4c184a60 Cymulate Signature-based

id	name
5c87a26f548a3c7c4c184a5e	Free Assessment
5c97a50c5727c58a295d0459	Cymulate Best Practice
5e98461d312a740ee4839700	DLL Side loading
5c87a314548a3c7c4c184a5f	Cymulate Behavior-based
5c87a314548a3c7c4c184a60	Cymulate Signature-based

cymulate-endpoint-security-start#

Create a new endpoint security assessment.

Base Command#

cymulate-endpoint-security-start

Input#

Argument Name	Description	Required
template_id	The ID of the template to run the endpoint security assessment with. Can be retrieved using Cymulate's UI, or using cymulate-endpoint-security-template-list command.	Required
agent_name	agent name.	Required
schedule	whether to schedule the automated assessment periodically. Possible values are: true, false.	Required
schedule_loop	Loop size of the scheduled agent. For example: to run the agent only once, use the value 'one-time'. Possible values are: one-time, daily, weekly, monthly.	Required
agent_profile_name	Agent profile name.	Optional

Context Output#

Path	Type	Description
Cymulate.EndpointSecurity.id	String	New endpoint security assessment creation ID.
Cymulate.EndpointSecurity.success	Boolean	New endpoint security assessment creation success status.

Command Example#

!cymulate-endpoint-security-start template_id="5e98461d312a740ee4839700" agent_name="Cymulate_agent" schedule="false" schedule_loop="one-time"

Context Example#

{
    "Cymulate": {
        "EndpointSecurity": {
            "id": "id_5",
            "success": true
        }
    }
}

Human Readable Output#

Starting endpoint security assessment:#
id success
id_5 true

id	success
id_5	true

cymulate-endpoint-security-stop#

Stop a running endpoint security assessment.

Base Command#

cymulate-endpoint-security-stop

Input#

There are no input arguments for this command.

Context Output#

Path	Type	Description
Cymulate.EndpointSecurity.data	String	Endpoint security assessment stopping data.
Cymulate.EndpointSecurity.success	Boolean	Endpoint Security assessment stopping success status.

Command Example#

!cymulate-endpoint-security-stop

Context Example#

{
    "Cymulate": {
        "EndpointSecurity": {
            "data": "ok",
            "success": true
        }
    }
}

Human Readable Output#

Stopping endpoint security assessment:#
data success
ok true

data	success
ok	true

cymulate-endpoint-security-status#

Get the endpoint security assessment status.

Base Command#

cymulate-endpoint-security-status

Input#

Argument Name	Description	Required
assessment_id	Assessment ID.	Required

Context Output#

Path	Type	Description
Cymulate.EndpointSecurity.id	String	Endpoint security assessment ID.
Cymulate.EndpointSecurity.inProgress	Boolean	Whether the assessment is in progress.
Cymulate.EndpointSecurity.progress	Number	Percentage of the progress of the assessment.
Cymulate.EndpointSecurity.categories	String	Assessment categories.

Command Example#

!cymulate-endpoint-security-status assessment_id="id_6"

Context Example#

{
    "Cymulate": {
        "EndpointSecurity": {
            "categories": [
                "ransomware"
            ],
            "id": "id_6",
            "inProgress": true,
            "progress": 90
        }
    }
}

Human Readable Output#

Endpoint security assessment status:#
categories id inProgress progress
ransomware id_6 false 0

categories	id	inProgress	progress
ransomware	id_6	false	0

cymulate-waf-template-list#

Retrieve the WAF template list.

Base Command#

cymulate-waf-template-list

Input#

There are no input arguments for this command.

Context Output#

Path	Type	Description
Cymulate.WAF.Template.id	String	Template ID.
Cymulate.WAF.Template.name	String	Template name.

Command Example#

!cymulate-waf-template-list

Context Example#

{
    "Cymulate": {
        "WAF": {
            "Templates": [
                {
                    "id": "5edf7ddfef621bbc252498f3",
                    "name": "free assessment"
                },
                {
                    "id": "5edf7547ef621bbc25248d97",
                    "name": "Cymulate Best Practice"
                },
                {
                    "id": "5ee0726cef621bbc25251d7a",
                    "name": "SQL Injection"
                },
                {
                    "id": "5ee0726cef621bbc25251d7d",
                    "name": "XSS"
                },
                {
                    "id": "5eea1fb754b285889325b818",
                    "name": "Command Injection"
                },
                {
                    "id": "5eea1fb754b285889325b81b",
                    "name": "File Inclusion"
                },
                {
                    "id": "5fb65327f6ce656dbc7f9cf1",
                    "name": "SSRF"
                },
                {
                    "id": "600d258cbd15e73c5882b306",
                    "name": "david test"
                }
            ]
        }
    }
}

Human Readable Output#

WAF templates list:#
id name
5edf7ddfef621bbc252498f3 free assessment
5edf7547ef621bbc25248d97 Cymulate Best Practice
5ee0726cef621bbc25251d7a SQL Injection
5ee0726cef621bbc25251d7d XSS
5eea1fb754b285889325b818 Command Injection
5eea1fb754b285889325b81b File Inclusion
5fb65327f6ce656dbc7f9cf1 SSRF
600d258cbd15e73c5882b306 david test

id	name
5edf7ddfef621bbc252498f3	free assessment
5edf7547ef621bbc25248d97	Cymulate Best Practice
5ee0726cef621bbc25251d7a	SQL Injection
5ee0726cef621bbc25251d7d	XSS
5eea1fb754b285889325b818	Command Injection
5eea1fb754b285889325b81b	File Inclusion
5fb65327f6ce656dbc7f9cf1	SSRF
600d258cbd15e73c5882b306	david test

cymulate-waf-start#

Create a new web application firewall assessment.

Base Command#

cymulate-waf-start

Input#

Argument Name	Description	Required
template_id	The ID of the template to run the WAF assessment with. Can be retrieved using Cymulate's UI, or using cymulate-waf-template-list command.	Required
sites	Websites to run the assessment on. Can be a single website URL or a list of URLs.	Required
schedule	whether to schedule the automated assessment periodically. Possible values are: true, false.	Required
schedule_loop	Loop size of the scheduled agent. For example: to run the agent only once, use the value 'one-time'. Possible values are: one-time, daily, weekly, monthly.	Required

Context Output#

Path	Type	Description
Cymulate.WAF.id	String	Web application firewall assessment creation ID.
Cymulate.WAF.success	Boolean	Web application firewall assessment creation success status.

Command Example#

!cymulate-waf-start template_id="5ee0726cef621bbc25251d7a" sites="http://cymulatelabs.com" schedule="false" schedule_loop="one-time"

Context Example#

{
    "Cymulate": {
        "WAF": {
            "id": "604630cbb9eb930a0fa86ab5",
            "success": true
        }
    }
}

Human Readable Output#

Starting WAF assessment:#
id success
604630cbb9eb930a0fa86ab5 true

id	success
604630cbb9eb930a0fa86ab5	true

cymulate-waf-stop#

Stop a running web application firewall assessment.

Base Command#

cymulate-waf-stop

Input#

There are no input arguments for this command.

Context Output#

Path	Type	Description
Cymulate.WAF.data	String	Web application firewall assessment stopping data.
Cymulate.WAF.success	Boolean	Web application firewall assessment stopping success status.

Command Example#

!cymulate-waf-stop

Context Example#

{
    "Cymulate": {
        "WAF": {
            "data": "no running attack",
            "success": true
        }
    }
}

Human Readable Output#

Stopping WAF assessment:#
data success
no running attack true

data	success
no running attack	true

cymulate-waf-status#

Get the web application firewall assessment status.

Base Command#

cymulate-waf-status

Input#

Argument Name	Description	Required
assessment_id	Assessment ID.	Required

Context Output#

Path	Type	Description
Cymulate.WAF.id	String	Web application firewall assessment ID.
Cymulate.WAF.inProgress	Boolean	Whether the assessment is in progress.
Cymulate.WAF.progress	Number	Percentage of the progress of the assessment.
Cymulate.WAF.categories	String	Assessment categories.

Command Example#

!cymulate-waf-status assessment_id="5ff31ef451647c20338bd235"

Context Example#

{
    "Cymulate": {
        "WAF": {
            "categories": [
                "XML Injection",
                "Command Injection",
                "File Inclusion",
                "XSS",
                "XML Injection",
                "SQL Injection"
            ],
            "id": "5ff31ef451647c20338bd235",
            "inProgress": false,
            "progress": 0
        }
    }
}

Human Readable Output#

WAF assessment status:#
categories id inProgress progress
XML Injection,
Command Injection,
File Inclusion,
XSS,
XML Injection,
SQL Injection 5ff31ef451647c20338bd235 false 0

categories	id	inProgress	progress
XML Injection, Command Injection, File Inclusion, XSS, XML Injection, SQL Injection	5ff31ef451647c20338bd235	false	0

cymulate-immediate-threat-start#

Create a new immediate threats assessment.

Base Command#

cymulate-immediate-threat-start

Input#

Argument Name	Description	Required
browsing_address	Browsing address.	Optional
mail_address	Agent email address.	Optional
edr_address	EDR address.	Optional
template_id	The ID of the template to run the immediate threat assessment with. Can be retrieved using Cymulate's UI.	Required
browsing_address_profile_name	Browsing Agent profile name to run the assessment with.	Optional
edr_address_profile_name	EDR Agent profile name to run the assessment with.	Optional

Context Output#

Path	Type	Description
Cymulate.ImmediateThreats.id	String	Immediate threats assessment creation ID.
Cymulate.ImmediateThreats.success	String	New exfiltration assessment creation success status.

Command Example#

!cymulate-immediate-threat-start edr_address="Cymulate_agent" template_id="603270ce63aa15930631b938"

Context Example#

{
    "Cymulate": {
        "ImmediateThreats": {
            "id": [
                "id_7"
            ],
            "success": true
        }
    }
}

Human Readable Output#

Starting immediate-threats assessment:#
id success
id_7 true

id	success
id_7	true

cymulate-immediate-threat-stop#

Stop a running immediate threats assessment.

Base Command#

cymulate-immediate-threat-stop

Input#

There are no input arguments for this command.

Context Output#

Path	Type	Description
Cymulate.ImmediateThreats.data	String	Immediate threats assessment stopping data.
Cymulate.ImmediateThreats.success	String	Immediate threats assessment stopping success status.

Command Example#

!cymulate-immediate-threat-stop

Context Example#

{
    "Cymulate": {
        "ImmediateThreats": {
            "data": "ok",
            "success": true
        }
    }
}

Human Readable Output#

Stop immediate-threats assessment:#
data success
ok true

data	success
ok	true

cymulate-immediate-threat-status#

Get immediate threats assessment status.

Base Command#

cymulate-immediate-threat-status

Input#

Argument Name	Description	Required
assessment_id	Assessment ID.	Required

Context Output#

Path	Type	Description
Cymulate.ImmediateThreats.id	String	Web application firewall assessment ID.
Cymulate.ImmediateThreats.categories	String	Assessment categories.
Cymulate.ImmediateThreats.inProgress	Boolean	Whether the assessment is in progress.
Cymulate.ImmediateThreats.progress	Number	Percentage of the progress of the assessment.

Command Example#

!cymulate-immediate-threat-status assessment_id="id_8"

Context Example#

{
    "Cymulate": {
        "ImmediateThreats": {
            "categories": [
                "antivirus"
            ],
            "id": "id_8",
            "inProgress": true,
            "progress": 90
        }
    }
}

Human Readable Output#

Immediate-threats assessment status:#
categories id inProgress progress
antivirus id_8 true 90

categories	id	inProgress	progress
antivirus	id_8	true	90

cymulate-phishing-awareness-contacts-group-list#

Get a list of contact groups.

Base Command#

cymulate-phishing-awareness-contacts-group-list

Input#

There are no input arguments for this command.

Context Output#

Path	Type	Description
Cymulate.Phishing.Groups.id	String	The ID of the phishing content group.
Cymulate.Phishing.Groups.name	String	Name of the phishing content group.
Cymulate.Phishing.Groups.client	String	The client of the phishing content group.
Cymulate.Phishing.Groups.canDelete	Boolean	Whether this group can be deleted.

Command Example#

!cymulate-phishing-awareness-contacts-group-list

Context Example#

{
    "Cymulate": {
        "Phishing": {
            "Groups": [
                {
                    "__v": 0,
                    "canDelete": true,
                    "client": "Cymulate",
                    "id": "id_a",
                    "name": "qmasters_01"
                },
                {
                    "__v": 0,
                    "canDelete": true,
                    "client": "Cymulate",
                    "id": "id_b",
                    "name": "qmasters_02"
                },
                {
                    "__v": 0,
                    "canDelete": true,
                    "client": "Cymulate",
                    "id": "id_c",
                    "name": "qmasters_03"
                },
                {
                    "__v": 0,
                    "canDelete": true,
                    "client": "Cymulate",
                    "id": "id_d",
                    "name": "new_group_01"
                },
                {
                    "__v": 0,
                    "canDelete": true,
                    "client": "Cymulate",
                    "id": "id_e",
                    "name": "test_group_02"
                }
            ]
        }
    }
}

Human Readable Output#

Phishing awareness contact groups:#
__v canDelete client id name
0 true Cymulate id_a qmasters_01
0 true Cymulate id_b qmasters_02
0 true Cymulate id_c qmasters_03
0 true Cymulate id_d new_group_01
0 true Cymulate id_e test_group_02

cymulate-phishing-awareness-contacts-group-create#

Create new contacts group.

Base Command#

cymulate-phishing-awareness-contacts-group-create

Input#

Argument Name	Description	Required
group_name	The name of the new group to create.	Required

Context Output#

Path	Type	Description
Cymulate.Phishing.Groups.success	Boolean	Whether the creation of the new group was successful.
Cymulate.Phishing.Groups.id	String	The ID of the new phishing content group.

Command Example#

!cymulate-phishing-awareness-contacts-group-create group_name="test_group_01"

Context Example#

{
    "Cymulate": {
        "Phishing": {
            "Groups": {
                "id": "id_9",
                "success": true
            }
        }
    }
}

Human Readable Output#

Phishing awareness contact group created:#
id success
id_9 true

cymulate-phishing-awareness-contacts-get#

Get contacts group using a group ID.

Base Command#

cymulate-phishing-awareness-contacts-get

Input#

Argument Name	Description	Required
group_id	Group ID.	Required

Context Output#

Path	Type	Description
Cymulate.Phishing.Groups.id	String	The ID of the phishing content group.
Cymulate.Phishing.Groups.name	String	Name of the phishing content group.
Cymulate.Phishing.Groups.client	String	The client of the phishing content group.
Cymulate.Phishing.Groups.canDelete	Boolean	Whether this group can be deleted.

Command Example#

!cymulate-phishing-awareness-contacts-get group_id="id_abcd"

Context Example#

{
    "Cymulate": {
        "Phishing": {
            "Groups": [
                {
                    "address": "jamesb@cymulate.com",
                    "color": "#ffbb00",
                    "firstName": "James",
                    "id": "id_1a",
                    "lastName": "Bond"
                },
                {
                    "address": "Billg@cymulate.com",
                    "color": "#34a853",
                    "firstName": "Bill",
                    "id": "id_a2",
                    "lastName": "Gates"
                },
                {
                    "address": "davidb@cymulate.com",
                    "color": "#00a1f1",
                    "firstName": "David ",
                    "id": "id_a3",
                    "lastName": "Ben-Gurion"
                }
            ]
        }
    }
}

Human Readable Output#

Phishing awareness contact groups:#
address color firstName id lastName
jamesb@cymulate.com #ffbb00 James id_1a Bond
Billg@cymulate.com #34a853 Bill id_a2 Gates
davidb@cymulate.com #00a1f1 David id_a3 Ben-Gurion

cymulate-lateral-movement-template-list#

Retrieve lateral movement template list.

Base Command#

cymulate-lateral-movement-template-list

Input#

There are no input arguments for this command.

Context Output#

Path	Type	Description
Cymulate.LateralMovement.Template.id	String	Template ID.
Cymulate.LateralMovement.Template.name	String	Template name.

Command Example#

!cymulate-lateral-movement-template-list

Context Example#

{
    "Cymulate": {
        "LateralMovement": {
            "Templates": [
                {
                    "id": "5e2f0c1054d53d6b115eefa7",
                    "name": "SMB Pass The Hash"
                },
                {
                    "id": "5e2f0c5f54d53d6b115ef0a1",
                    "name": "Kerberoasting and Cracking on DCOM and WMI"
                },
                {
                    "id": "5e2f0c9754d53d6b115ef190",
                    "name": "LLMNR Poisoning on SMB"
                },
                {
                    "id": "5e2f0d2c54d53d6b115ef345",
                    "name": "SMB And Credentials Harvesting"
                },
                {
                    "id": "5e41746171895006ef394607",
                    "name": "test1"
                },
                {
                    "id": "5e44020d3f46e106e9ec706c",
                    "name": "Prueba completa"
                },
                {
                    "id": "5e4a5792b1bdb606ed1f9407",
                    "name": "lab1"
                }
            ]
        }
    }
}

Human Readable Output#

Lateral movement templates list:#
id name
5e2f0c1054d53d6b115eefa7 SMB Pass The Hash
5e2f0c5f54d53d6b115ef0a1 Kerberoasting and Cracking on DCOM and WMI
5e2f0c9754d53d6b115ef190 LLMNR Poisoning on SMB
5e2f0d2c54d53d6b115ef345 SMB And Credentials Harvesting
5e41746171895006ef394607 test1
5e44020d3f46e106e9ec706c Prueba completa
5e4a5792b1bdb606ed1f9407 lab1

cymulate-lateral-movement-start#

Create a new lateral movement assessment.

Base Command#

cymulate-lateral-movement-start

Input#

Argument Name	Description	Required
agent_name	Agent name to run the assessment with.	Required
template_id	The ID of the template to run the lateral movement with. Can be retrieved using Cymulate's UI, or using cymulate-lateral-movement-template-list command.	Required
upload_to_cymulate	Whether to upload the result to Cymulate. Possible values are: true, false. Default is false.	Required
schedule	Whether to schedule the automated assessment periodically. Possible values are: true, false.	Required
schedule_loop	Loop size of the scheduled agent. For example: to run the agent only once, use the value 'one-time'. Possible values are: one-time, daily, weekly, monthly.	Required
agent_profile_name	Agent profile name to run the assessment with.	Optional

Context Output#

Path	Type	Description
Cymulate.LateralMovement.id	String	Lateral movement assessment creation ID.
Cymulate.LateralMovement.success	Boolean	New exfiltration assessment creation success status.

Command Example#

!cymulate-lateral-movement-start agent_name="Cymulate_agent" template_id="5e41746171895006ef394607" upload_to_cymulate="false" schedule="false" schedule_loop="one-time"

Context Example#

{
    "Cymulate": {
        "LateralMovement": {
            "id": "id_987",
            "success": true
        }
    }
}

Human Readable Output#

Starting lateral movement assessment:#
id success
id_987 true

cymulate-lateral-movement-stop#

Stop a running lateral movement assessment.

Base Command#

cymulate-lateral-movement-stop

Input#

There are no input arguments for this command.

Context Output#

Path	Type	Description
Cymulate.LateralMovement.data	String	Lateral movement assessment stopping data.
Cymulate.LateralMovement.success	Boolean	Lateral Movement assessment creation success status.

Command Example#

!cymulate-lateral-movement-stop

Context Example#

{
    "Cymulate": {
        "LateralMovement": {
            "data": "ok",
            "success": true
        }
    }
}

Human Readable Output#

Stopping lateral movement assessment:#
data success
ok true

cymulate-lateral-movement-status#

Get lateral movement assessment status.

Base Command#

cymulate-lateral-movement-status

Input#

Argument Name	Description	Required
assessment_id	Assessment ID.	Required

Context Output#

Path	Type	Description
Cymulate.LateralMovement.id	String	Lateral movement assessment ID.
Cymulate.LateralMovement.inProgress	Boolean	Indicates whether the assessment is in progress.

Command Example#

!cymulate-lateral-movement-status assessment_id="id_876"

Context Example#

{
    "Cymulate": {
        "LateralMovement": {
            "id": "id_876",
            "inProgress": false
        }
    }
}

Human Readable Output#

Lateral movement assessment status:#
id inProgress
id_876 false

cymulate-agent-list#

Retrieve all agents.

Base Command#

cymulate-agent-list

Input#

There are no input arguments for this command.

Context Output#

Path	Type	Description
Cymulate.Agent.agentAddress	String	The agent's address.
Cymulate.Agent.agentMethod	String	The agent's methods.
Cymulate.Agent.agentName	String	Agent name.
Cymulate.Agent.comment	String	Comments.

Command Example#

!cymulate-agent-list

Context Example#

{
    "Cymulate": {
        "Agent": [
            {
                "agentAddress": "test@cymulate.com",
                "agentMethod": "smtp",
                "comment": ""
            },
            {
                "agentAddress": "Cymulate_agent ",
                "agentMethod": "http",
                "agentName": "Cymulate_agent",
                "comment": ""
            }
        ]
    }
}

Human Readable Output#

Agents list:#
agentAddress agentMethod agentName
test@cymulate.com smtp
Cymulate_agent http Cymulate_agent

cymulate-simulations-list#

Retrieve a list of all simulations by ID.

Base Command#

cymulate-simulations-list

Input#

Argument Name	Description	Required
module	Module to retrieve events to. Possible values are: web-gateway, exfiltration, email-gateway, endpoint-security, waf, kill-chain, immediate-threats, phishing-awareness, lateral-movement.	Required
attack_id	Attack ID. Can be retrieved using cymulate-simulations-id-list command.	Required

Context Output#

Path	Type	Description
Cymulate.Simulations.Attack_Type	String	Attack payload
Cymulate.Simulations.Classification	String	Attack classification.
Cymulate.Simulations.Content_Type	String	Content type.
Cymulate.Simulations.Module	String	Event's module.
Cymulate.Simulations.Phrase	String	Attack description.
Cymulate.Simulations.Phrase_Title	String	Attack name.
Cymulate.Simulations.Status	String	Attack status
Cymulate.Simulations.PrevStatus	String	Attack Previous status
Cymulate.Simulations.Risk	String	Attack risk level.
Cymulate.Simulations.Source	String	Attack Source
Cymulate.Simulations.User	String	User committed the attack ot was attacked.
Cymulate.Simulations.Attack_Vector	String	Attack vector
Cymulate.Simulations.Source_Email_Address	String	Source email address.
Cymulate.Simulations.Md5	String	MD5 attached to the attack.
Cymulate.Simulations.Sha256	String	Sha256 attached to the attack.
Cymulate.Simulations.Sha1	String	Sha1 attached to the attack.
Cymulate.Simulations.Mitigation	String	Mitigation details.
Cymulate.Simulations.Mitigation_Details	String	Mitigation details.
Cymulate.Simulations.Description	String	Attack description
Cymulate.Simulations.Id	String	Attack ID.

Command Example#

!cymulate-simulations-list module="waf" attack_id="id_001"

Context Example#

{
    "Cymulate": {
        "Simulations": {
            "Action": " http://Google.com/",
            "Category": "SQL Injection",
            "Database": "DB Agnostic",
            "Display_Url": " http://Google.com/",
            "FullRequest": "N/A",
            "Id": "id_001",
            "Input": "password",
            "Method": "post",
            "Mitigation": "Create a WAF Security rule to block incoming requests that contains. Validate that the specific input url is protected with the MSSQL Blind signature pack (SQL Injection)",
            "Module": "Web Application Firewall",
            "Payload": "This is a payload",
            "Platform": "OS Agnostic",
            "PrevStatus": "blocked",
            "Risk": "high",
            "Source": " http://Google.com",
            "Status": "blocked",
            "SubCategoryType": "MSSQL Blind",
            "Timestamp": "2021-02-28 16:33:41",
            "Url": " http://Google.com/",
            "date": "2021-02-28T14:33:41.559Z"
        }
    }
}

Human Readable Output#

Displaying 20/193 simulations:#
Action Category Database Display_Url FullRequest Id Input Method Mitigation Module Payload Platform PrevStatus Risk Source Status SubCategoryType Timestamp Url date
http://Google.com/signup SQL Injection DB Agnostic http://Google.com/signup N/A id_001 password post Create a WAF Security rule to block incoming requests that contains. Validate that the specific input/url is protected with the Oracle SQL Injection signature pack (SQL Injection) Web Application Firewall AND 1=utl_inaddr.get_host_address((SELECT DISTINCT(table_name) FROM (SELECT DISTINCT(table_name), ROWNUM AS LIMIT FROM sys.all_tables) WHERE LIMIT=3)) AND 'i'='i OS Agnostic blocked high http://Google.com blocked Oracle SQL Injection 2021-02-28 16:33:41 http://Google.com/signup 2021-02-28T14:33:41.475Z
http://Google.com/team/dudi SQL Injection DB Agnostic http://Google.com/team/dudi N/A id_001 password post Create a WAF Security rule to block incoming requests that contains.. The rule could be a Regular expression that needs to be implemented or an update of your WAF.Validate that the specific input url is protected with the Generic Blind Injection signature pack (SQL Injection) Web Application Firewall 1) or benchmark(10000000,MD5(1))# OS Agnostic blocked high http://Google.com blocked Generic Blind Injection 2021-02-28 16:33:41 http://Google.com/team/dudi 2021-02-28T14:33:41.476Z
http://Google.com/ SQL Injection DB Agnostic http://Google.com/ N/A id_001 tel post Create a WAF Security rule to block incoming requests that contains:1.The rule could be a Regular expression that needs to be implemented or an update of your WAF.Validate that the specific input/url is protected with the General SQL Injection signature pack (SQL Injection) Web Application Firewall 1' and non_existant_table = '1 OS Agnostic blocked high http://Google.com blocked General SQL Injection 2021-02-28 16:33:41 http://Google.com/ 2021-02-28T14:33:41.478Z
http://Google.com/team/%d7%94%d7%9e%d7%a8%d7%a4%d7%90%d7%95%d7%aa-%d7%a9%d7%9c%d7%a0%d7%95 SQL Injection DB Agnostic http://Google.com/team/%d7%94%d7%9e%d7%a8%d7%a4%d7%90%d7%95%d7%aa-%d7%a9%d7%9c%d7%a0%d7%95 N/A id_001 password post Create a WAF Security rule to block incoming requests that contains:..The rule could be a Regular expression that needs to be implemented or an update of your WAF.Validate that the specific input/url is protected with the Passive SQL Injection signature pack (SQL Injection) Web Application Firewall ' or 1=1 / OS Agnostic blocked high http://Google.com blocked Passive SQL Injection 2021-02-28 16:33:41 http://Google.com/team/%d7%94%d7%9e%d7%a8%d7%a4%d7%90%d7%95%d7%aa-%d7%a9%d7%9c%d7%a0%d7%95 2021-02-28T14:33:41.478Z
http://Google.com/contact SQL Injection DB Agnostic http://Google.com/contact N/A id_001 password post Create a WAF Security rule to block incoming requests that contains..The rule could be a Regular expression that needs to be implemented or an update of your WAF.Validate that the specific input/url is protected with the Passive SQL Injection signature pack (SQL Injection) Web Application Firewall ' group by userid having 1=1-- OS Agnostic blocked high http://Google.com blocked Passive SQL Injection 2021-02-28 16:33:41 http://Google.com/contact 2021-02-28T14:33:41.476Z
http://Google.com/ SQL Injection DB Agnostic http://Google.com/ N/A id_001 tel post Create a WAF Security rule to block incoming requests that contains.The rule could be a Regular expression that needs to be implemented or an update of your WAF.Validate that the specific input/url is protected with the MSSQL Injection signature pack (SQL Injection) Web Application Firewall ) waitfor delay '0:0:20' OS Agnostic blocked high http://Google.com blocked MSSQL Injection 2021-02-28 16:33:41 http://Google.com/ 2021-02-28T14:33:41.479Z
http://Google.com/team/%d7%94%d7%9e%d7%a8%d7%a4%d7%90%d7%95%d7%aa-%d7%a9%d7%9c%d7%a0%d7%95 SQL Injection DB Agnostic http://Google.com/team/%d7%94%d7%9e%d7%a8%d7%a4%d7%90%d7%95%d7%aa-%d7%a9%d7%9c%d7%a0%d7%95 N/A id_001 password post Create a WAF Security rule to block incoming requests that contains.Validate that the specific input/url is protected with the Passive SQL Injection signature pack (SQL Injection) Web Application Firewall ' or 1=1-- OS Agnostic blocked high http://Google.com blocked Passive SQL Injection 2021-02-28 16:33:41 http://Google.com/team/%d7%94%d7%9e%d7%a8%d7%a4%d7%90%d7%95%d7%aa-%d7%a9%d7%9c%d7%a0%d7%95 2021-02-28T14:33:41.481Z
http://Google.com/ SQL Injection DB Agnostic http://Google.com/ N/A id_001 hidden post Create a WAF Security rule to block incoming requests that contains:.Validate that the specific input/url is protected with the Passive SQL Injection signature pack (SQL Injection) Web Application Firewall ' OR 'something' like 'some%' OS Agnostic blocked high http://Google.com blocked Passive SQL Injection 2021-02-28 16:33:41 http://Google.com/ 2021-02-28T14:33:41.480Z
http://Google.com/team/ruba SQL Injection DB Agnostic http://Google.com/team/ruba N/A id_001 password post Create a WAF Security rule to block incoming requests that contains.The rule could be a Regular expression that needs to be implemented or an update of your WAF.Validate that the specific input/url is protected with the Passive SQL Injection signature pack (SQL Injection) Web Application Firewall ' union select from users where login = char(114,111,111,116); OS Agnostic blocked high http://Google.com blocked Passive SQL Injection 2021-02-28 16:33:41 http://Google.com/team/ruba 2021-02-28T14:33:41.481Z
http://Google.com/team/ruba SQL Injection DB Agnostic http://Google.com/team/ruba N/A id_001 password post Create a WAF Security rule to block incoming requests that contains. The rule could be a Regular expression that needs to be implemented or an update of your WAF.Validate that the specific input/url is protected with the General SQL Injection signature pack (SQL Injection) Web Application Firewall ' AND 1=utl_inaddr.get_host_address((SELECT SYS.DATABASE_NAME FROM DUAL)) AND 'i'='i OS Agnostic blocked high http://Google.com blocked General SQL Injection 2021-02-28 16:33:41 http://Google.com/team/ruba 2021-02-28T14:33:41.479Z
http://Google.com/contact SQL Injection DB Agnostic http://Google.com/contact N/A id_001 password post Create a WAF Security rule to block incoming requests that contains.Validate that the specific input/url is protected with the Generic Blind Injection signature pack (SQL Injection) Web Application Firewall ;waitfor delay '0:0:TIME'-- OS Agnostic blocked high http://Google.com blocked Generic Blind Injection 2021-02-28 16:33:41 http://Google.com/contact 2021-02-28T14:33:41.480Z
http://Google.com/team/%d7%94%d7%9e%d7%a8%d7%a4%d7%90%d7%95%d7%aa-%d7%a9%d7%9c%d7%a0%d7%95 SQL Injection DB Agnostic http://Google.com/team/%d7%94%d7%9e%d7%a8%d7%a4%d7%90%d7%95%d7%aa-%d7%a9%d7%9c%d7%a0%d7%95 N/A id_001 password post Create a WAF Security rule to block incoming requests that contains. The rule could be a Regular expression that needs to be implemented or an update of your WAF.Validate that the specific input/url is protected with the MSSQL Injection signature pack (SQL Injection) Web Application Firewall waitfor delay '0:0:20' / OS Agnostic blocked high http://Google.com blocked MSSQL Injection 2021-02-28 16:33:41 http://Google.com/team/%d7%94%d7%9e%d7%a8%d7%a4%d7%90%d7%95%d7%aa-%d7%a9%d7%9c%d7%a0%d7%95 2021-02-28T14:33:41.481Z
http://Google.com/team/dudi SQL Injection DB Agnostic http://Google.com/team/dudi N/A id_001 password post Create a WAF Security rule to block incoming requests that contains:.Validate that the specific input/url is protected with the Mysql Injection signature pack (SQL Injection) Web Application Firewall 1or1=1 OS Agnostic blocked high http://Google.com blocked Mysql Injection 2021-02-28 16:33:41 http://Google.com/team/dudi 2021-02-28T14:33:41.483Z
http://Google.com/team/dudi SQL Injection DB Agnostic http://Google.com/team/dudi N/A id_001 password post Create a WAF Security rule to block incoming requests that contains.Validate that the specific input/url is protected with the Generic Blind Injection signature pack (SQL Injection) Web Application Firewall ) or sleep(TIME)=' OS Agnostic blocked high http://Google.com blocked Generic Blind Injection 2021-02-28 16:33:41 http://Google.com/team/dudi 2021-02-28T14:33:41.483Z
http://Google.com/team/%d7%94%d7%9e%d7%a8%d7%a4%d7%90%d7%95%d7%aa-%d7%a9%d7%9c%d7%a0%d7%95 SQL Injection DB Agnostic http://Google.com/team/%d7%94%d7%9e%d7%a8%d7%a4%d7%90%d7%95%d7%aa-%d7%a9%d7%9c%d7%a0%d7%95 N/A id_001 password post Create a WAF Security rule to block incoming requests that contains.Validate that the specific input/url is protected with the Passive SQL Injection signature pack (SQL Injection) Web Application Firewall @var select @var as var into temp end -- OS Agnostic blocked high http://Google.com blocked Passive SQL Injection 2021-02-28 16:33:41 http://Google.com/team/%d7%94%d7%9e%d7%a8%d7%a4%d7%90%d7%95%d7%aa-%d7%a9%d7%9c%d7%a0%d7%95 2021-02-28T14:33:41.485Z
http://Google.com/team/ruba SQL Injection DB Agnostic http://Google.com/team/ruba N/A id_001 password post Create a WAF Security rule to block incoming requests that contains.Validate that the specific input/url is protected with the Oracle SQL Injection signature pack (SQL Injection) Web Application Firewall AND 1=utl_inaddr.get_host_address((SELECT DISTINCT(granted_role) FROM (SELECT DISTINCT(granted_role), ROWNUM AS LIMIT FROM dba_role_privs WHERE GRANTEE=SYS.LOGINUSER) WHERE LIMIT=1)) AND 'i'='i OS Agnostic blocked high http://Google.com blocked Oracle SQL Injection 2021-02-28 16:33:41 http://Google.com/team/ruba 2021-02-28T14:33:41.482Z
http://Google.com/signup SQL Injection DB Agnostic http://Google.com/signup N/A id_001 password post Create a WAF Security rule to block incoming requests that contains.Validate that the specific input/url is protected with the Mysql Injection signature pack (SQL Injection) Web Application Firewall create table myfile (input TEXT); load data infile filepath into table myfile OS Agnostic blocked high http://Google.com blocked Mysql Injection 2021-02-28 16:33:41 http://Google.com/signup 2021-02-28T14:33:41.484Z
http://Google.com/contact SQL Injection DB Agnostic http://Google.com/contact N/A id_001 password post Create a WAF Security rule to block incoming requests that contains. The rule could be a Regular expression that needs to be implemented or an update of your WAF.Validate that the specific input/url is protected with the MSSQL Injection signature pack (SQL Injection) Web Application Firewall and 0=benchmark OS Agnostic blocked high http://Google.com blocked MSSQL Injection 2021-02-28 16:33:41 http://Google.com/contact 2021-02-28T14:33:41.486Z
http://Google.com/ SQL Injection DB Agnostic http://Google.com/ N/A id_001 tel post Create a WAF Security rule to block incoming requests that contains.Validate that the specific input/url is protected with the MSSQL Injection signature pack (SQL Injection) Web Application Firewall ; exec master..xp_cmdshell 'ping 1.2.3.4'-- OS Agnostic blocked high http://Google.com blocked MSSQL Injection 2021-02-28 16:33:41 http://Google.com/ 2021-02-28T14:33:41.485Z
http://Google.com/signup SQL Injection DB Agnostic http://Google.com/signup N/A id_001 password post Create a WAF Security rule to block incoming requests that contains.Validate that the specific input/url is protected with the MSSQL Injection signature pack (SQL Injection) Web Application Firewall insert into mysql.user (user, host, password) values ('name', 'localhost', password('pass123')) -- OS Agnostic N/A high http://Google.com blocked MSSQL Injection 2021-02-28 16:33:41 http://Google.com/signup 2021-02-28T14:33:41.487Z

cymulate-simulations-id-list#

Retrieve a list of all simulations IDs.

Base Command#

cymulate-simulations-id-list

Input#

Argument Name	Description	Required
module	Module to retrieve simulations IDs to. Possible values are: web-gateway, exfiltration, email-gateway, endpoint-security, waf, kill-chain, immediate-threats, phishing-awareness, lateral-movement.	Required
from_date	From which date to fetch data. Format: YYYY-MM-DD, for example: March 1st 2021 should be written: 2021-03-01. .	Required
to_date	End date to fetch data. Format: YYYY-MM-DD, for example: March 1st 2021 should be written: 2021-03-01. If no argument is given, default is now.	Optional

Context Output#

Path	Type	Description
Cymulate.Simulations.ID	String	Attack ID.
Cymulate.Simulations.Timestamp	String	Attack timestamp
Cymulate.Simulations.Agent	String	Agent connected to the attack.
Cymulate.Simulations.Template	String	Attack template.

Command Example#

!cymulate-simulations-id-list module="kill-chain" from_date="2021-01-01"

Context Example#

{
    "Cymulate": {
        "Simulations": [
            {
                "Agent": "Cymulate_agent_2",
                "ID": "id_b1",
                "Template": "Cobalt Group",
                "Timestamp": "2021-03-01 10:15:58.230000"
            },
            {
                "Agent": "Cymulate_agent_2",
                "ID": "id_b2",
                "Template": "Cobalt Group",
                "Timestamp": "2021-02-25 16:56:33.871000"
            },
            {
                "Agent": "info@cymulate.com",
                "ID": "id_b3",
                "Template": "Cobalt Group",
                "Timestamp": "2021-02-23 11:00:50.988000"
            }
        ]
    }
}

Human Readable Output#

Displaying 3/3 Attack IDs:#
Agent ID Template Timestamp
Cymulate_agent_2 id_b1 Cobalt Group 2021-03-01 10:15:58.230000
Cymulate_agent_2 id_b2 Cobalt Group 2021-02-25 16:56:33.871000
info@cymulate.com id_b3 Cobalt Group 2021-02-23 11:00:50.988000

canDelete	client	id	name
true	Cymulate	id_a	qmasters_01
true	Cymulate	id_b	qmasters_02
true	Cymulate	id_c	qmasters_03
true	Cymulate	id_d	new_group_01
true	Cymulate	id_e	test_group_02

address	color	firstName	id	lastName
jamesb@cymulate.com	#ffbb00	James	id_1a	Bond
Billg@cymulate.com	#34a853	Bill	id_a2	Gates
davidb@cymulate.com	#00a1f1	David	id_a3	Ben-Gurion

id	name
5e2f0c1054d53d6b115eefa7	SMB Pass The Hash
5e2f0c5f54d53d6b115ef0a1	Kerberoasting and Cracking on DCOM and WMI
5e2f0c9754d53d6b115ef190	LLMNR Poisoning on SMB
5e2f0d2c54d53d6b115ef345	SMB And Credentials Harvesting
5e41746171895006ef394607	test1
5e44020d3f46e106e9ec706c	Prueba completa
5e4a5792b1bdb606ed1f9407	lab1

Action	Category	Database	Display_Url	FullRequest	Id	Input	Method	Mitigation	Module	Payload	Platform	PrevStatus	Risk	Source	Status	SubCategoryType	Timestamp	Url	date
http://Google.com/signup	SQL Injection	DB Agnostic	http://Google.com/signup	N/A	id_001	password	post	Create a WAF Security rule to block incoming requests that contains. Validate that the specific input/url is protected with the Oracle SQL Injection signature pack (SQL Injection)	Web Application Firewall	AND 1=utl_inaddr.get_host_address((SELECT DISTINCT(table_name) FROM (SELECT DISTINCT(table_name), ROWNUM AS LIMIT FROM sys.all_tables) WHERE LIMIT=3)) AND 'i'='i	OS Agnostic	blocked	high	http://Google.com	blocked	Oracle SQL Injection	2021-02-28 16:33:41	http://Google.com/signup	2021-02-28T14:33:41.475Z
http://Google.com/team/dudi	SQL Injection	DB Agnostic	http://Google.com/team/dudi	N/A	id_001	password	post	Create a WAF Security rule to block incoming requests that contains.. The rule could be a Regular expression that needs to be implemented or an update of your WAF.Validate that the specific input url is protected with the Generic Blind Injection signature pack (SQL Injection)	Web Application Firewall	1) or benchmark(10000000,MD5(1))#	OS Agnostic	blocked	high	http://Google.com	blocked	Generic Blind Injection	2021-02-28 16:33:41	http://Google.com/team/dudi	2021-02-28T14:33:41.476Z
http://Google.com/	SQL Injection	DB Agnostic	http://Google.com/	N/A	id_001	tel	post	Create a WAF Security rule to block incoming requests that contains:1.The rule could be a Regular expression that needs to be implemented or an update of your WAF.Validate that the specific input/url is protected with the General SQL Injection signature pack (SQL Injection)	Web Application Firewall	1' and non_existant_table = '1	OS Agnostic	blocked	high	http://Google.com	blocked	General SQL Injection	2021-02-28 16:33:41	http://Google.com/	2021-02-28T14:33:41.478Z
http://Google.com/team/%d7%94%d7%9e%d7%a8%d7%a4%d7%90%d7%95%d7%aa-%d7%a9%d7%9c%d7%a0%d7%95	SQL Injection	DB Agnostic	http://Google.com/team/%d7%94%d7%9e%d7%a8%d7%a4%d7%90%d7%95%d7%aa-%d7%a9%d7%9c%d7%a0%d7%95	N/A	id_001	password	post	Create a WAF Security rule to block incoming requests that contains:..The rule could be a Regular expression that needs to be implemented or an update of your WAF.Validate that the specific input/url is protected with the Passive SQL Injection signature pack (SQL Injection)	Web Application Firewall	' or 1=1 /	OS Agnostic	blocked	high	http://Google.com	blocked	Passive SQL Injection	2021-02-28 16:33:41	http://Google.com/team/%d7%94%d7%9e%d7%a8%d7%a4%d7%90%d7%95%d7%aa-%d7%a9%d7%9c%d7%a0%d7%95	2021-02-28T14:33:41.478Z
http://Google.com/contact	SQL Injection	DB Agnostic	http://Google.com/contact	N/A	id_001	password	post	Create a WAF Security rule to block incoming requests that contains..The rule could be a Regular expression that needs to be implemented or an update of your WAF.Validate that the specific input/url is protected with the Passive SQL Injection signature pack (SQL Injection)	Web Application Firewall	' group by userid having 1=1--	OS Agnostic	blocked	high	http://Google.com	blocked	Passive SQL Injection	2021-02-28 16:33:41	http://Google.com/contact	2021-02-28T14:33:41.476Z
http://Google.com/	SQL Injection	DB Agnostic	http://Google.com/	N/A	id_001	tel	post	Create a WAF Security rule to block incoming requests that contains.The rule could be a Regular expression that needs to be implemented or an update of your WAF.Validate that the specific input/url is protected with the MSSQL Injection signature pack (SQL Injection)	Web Application Firewall	) waitfor delay '0:0:20'	OS Agnostic	blocked	high	http://Google.com	blocked	MSSQL Injection	2021-02-28 16:33:41	http://Google.com/	2021-02-28T14:33:41.479Z
http://Google.com/team/%d7%94%d7%9e%d7%a8%d7%a4%d7%90%d7%95%d7%aa-%d7%a9%d7%9c%d7%a0%d7%95	SQL Injection	DB Agnostic	http://Google.com/team/%d7%94%d7%9e%d7%a8%d7%a4%d7%90%d7%95%d7%aa-%d7%a9%d7%9c%d7%a0%d7%95	N/A	id_001	password	post	Create a WAF Security rule to block incoming requests that contains.Validate that the specific input/url is protected with the Passive SQL Injection signature pack (SQL Injection)	Web Application Firewall	' or 1=1--	OS Agnostic	blocked	high	http://Google.com	blocked	Passive SQL Injection	2021-02-28 16:33:41	http://Google.com/team/%d7%94%d7%9e%d7%a8%d7%a4%d7%90%d7%95%d7%aa-%d7%a9%d7%9c%d7%a0%d7%95	2021-02-28T14:33:41.481Z
http://Google.com/	SQL Injection	DB Agnostic	http://Google.com/	N/A	id_001	hidden	post	Create a WAF Security rule to block incoming requests that contains:.Validate that the specific input/url is protected with the Passive SQL Injection signature pack (SQL Injection)	Web Application Firewall	' OR 'something' like 'some%'	OS Agnostic	blocked	high	http://Google.com	blocked	Passive SQL Injection	2021-02-28 16:33:41	http://Google.com/	2021-02-28T14:33:41.480Z
http://Google.com/team/ruba	SQL Injection	DB Agnostic	http://Google.com/team/ruba	N/A	id_001	password	post	Create a WAF Security rule to block incoming requests that contains.The rule could be a Regular expression that needs to be implemented or an update of your WAF.Validate that the specific input/url is protected with the Passive SQL Injection signature pack (SQL Injection)	Web Application Firewall	' union select from users where login = char(114,111,111,116);	OS Agnostic	blocked	high	http://Google.com	blocked	Passive SQL Injection	2021-02-28 16:33:41	http://Google.com/team/ruba	2021-02-28T14:33:41.481Z
http://Google.com/team/ruba	SQL Injection	DB Agnostic	http://Google.com/team/ruba	N/A	id_001	password	post	Create a WAF Security rule to block incoming requests that contains. The rule could be a Regular expression that needs to be implemented or an update of your WAF.Validate that the specific input/url is protected with the General SQL Injection signature pack (SQL Injection)	Web Application Firewall	' AND 1=utl_inaddr.get_host_address((SELECT SYS.DATABASE_NAME FROM DUAL)) AND 'i'='i	OS Agnostic	blocked	high	http://Google.com	blocked	General SQL Injection	2021-02-28 16:33:41	http://Google.com/team/ruba	2021-02-28T14:33:41.479Z
http://Google.com/contact	SQL Injection	DB Agnostic	http://Google.com/contact	N/A	id_001	password	post	Create a WAF Security rule to block incoming requests that contains.Validate that the specific input/url is protected with the Generic Blind Injection signature pack (SQL Injection)	Web Application Firewall	;waitfor delay '0:0:TIME'--	OS Agnostic	blocked	high	http://Google.com	blocked	Generic Blind Injection	2021-02-28 16:33:41	http://Google.com/contact	2021-02-28T14:33:41.480Z
http://Google.com/team/%d7%94%d7%9e%d7%a8%d7%a4%d7%90%d7%95%d7%aa-%d7%a9%d7%9c%d7%a0%d7%95	SQL Injection	DB Agnostic	http://Google.com/team/%d7%94%d7%9e%d7%a8%d7%a4%d7%90%d7%95%d7%aa-%d7%a9%d7%9c%d7%a0%d7%95	N/A	id_001	password	post	Create a WAF Security rule to block incoming requests that contains. The rule could be a Regular expression that needs to be implemented or an update of your WAF.Validate that the specific input/url is protected with the MSSQL Injection signature pack (SQL Injection)	Web Application Firewall	waitfor delay '0:0:20' /	OS Agnostic	blocked	high	http://Google.com	blocked	MSSQL Injection	2021-02-28 16:33:41	http://Google.com/team/%d7%94%d7%9e%d7%a8%d7%a4%d7%90%d7%95%d7%aa-%d7%a9%d7%9c%d7%a0%d7%95	2021-02-28T14:33:41.481Z
http://Google.com/team/dudi	SQL Injection	DB Agnostic	http://Google.com/team/dudi	N/A	id_001	password	post	Create a WAF Security rule to block incoming requests that contains:.Validate that the specific input/url is protected with the Mysql Injection signature pack (SQL Injection)	Web Application Firewall	1or1=1	OS Agnostic	blocked	high	http://Google.com	blocked	Mysql Injection	2021-02-28 16:33:41	http://Google.com/team/dudi	2021-02-28T14:33:41.483Z
http://Google.com/team/dudi	SQL Injection	DB Agnostic	http://Google.com/team/dudi	N/A	id_001	password	post	Create a WAF Security rule to block incoming requests that contains.Validate that the specific input/url is protected with the Generic Blind Injection signature pack (SQL Injection)	Web Application Firewall	) or sleep(TIME)='	OS Agnostic	blocked	high	http://Google.com	blocked	Generic Blind Injection	2021-02-28 16:33:41	http://Google.com/team/dudi	2021-02-28T14:33:41.483Z
http://Google.com/team/%d7%94%d7%9e%d7%a8%d7%a4%d7%90%d7%95%d7%aa-%d7%a9%d7%9c%d7%a0%d7%95	SQL Injection	DB Agnostic	http://Google.com/team/%d7%94%d7%9e%d7%a8%d7%a4%d7%90%d7%95%d7%aa-%d7%a9%d7%9c%d7%a0%d7%95	N/A	id_001	password	post	Create a WAF Security rule to block incoming requests that contains.Validate that the specific input/url is protected with the Passive SQL Injection signature pack (SQL Injection)	Web Application Firewall	@var select @var as var into temp end --	OS Agnostic	blocked	high	http://Google.com	blocked	Passive SQL Injection	2021-02-28 16:33:41	http://Google.com/team/%d7%94%d7%9e%d7%a8%d7%a4%d7%90%d7%95%d7%aa-%d7%a9%d7%9c%d7%a0%d7%95	2021-02-28T14:33:41.485Z
http://Google.com/team/ruba	SQL Injection	DB Agnostic	http://Google.com/team/ruba	N/A	id_001	password	post	Create a WAF Security rule to block incoming requests that contains.Validate that the specific input/url is protected with the Oracle SQL Injection signature pack (SQL Injection)	Web Application Firewall	AND 1=utl_inaddr.get_host_address((SELECT DISTINCT(granted_role) FROM (SELECT DISTINCT(granted_role), ROWNUM AS LIMIT FROM dba_role_privs WHERE GRANTEE=SYS.LOGINUSER) WHERE LIMIT=1)) AND 'i'='i	OS Agnostic	blocked	high	http://Google.com	blocked	Oracle SQL Injection	2021-02-28 16:33:41	http://Google.com/team/ruba	2021-02-28T14:33:41.482Z
http://Google.com/signup	SQL Injection	DB Agnostic	http://Google.com/signup	N/A	id_001	password	post	Create a WAF Security rule to block incoming requests that contains.Validate that the specific input/url is protected with the Mysql Injection signature pack (SQL Injection)	Web Application Firewall	create table myfile (input TEXT); load data infile filepath into table myfile	OS Agnostic	blocked	high	http://Google.com	blocked	Mysql Injection	2021-02-28 16:33:41	http://Google.com/signup	2021-02-28T14:33:41.484Z
http://Google.com/contact	SQL Injection	DB Agnostic	http://Google.com/contact	N/A	id_001	password	post	Create a WAF Security rule to block incoming requests that contains. The rule could be a Regular expression that needs to be implemented or an update of your WAF.Validate that the specific input/url is protected with the MSSQL Injection signature pack (SQL Injection)	Web Application Firewall	and 0=benchmark	OS Agnostic	blocked	high	http://Google.com	blocked	MSSQL Injection	2021-02-28 16:33:41	http://Google.com/contact	2021-02-28T14:33:41.486Z
http://Google.com/	SQL Injection	DB Agnostic	http://Google.com/	N/A	id_001	tel	post	Create a WAF Security rule to block incoming requests that contains.Validate that the specific input/url is protected with the MSSQL Injection signature pack (SQL Injection)	Web Application Firewall	; exec master..xp_cmdshell 'ping 1.2.3.4'--	OS Agnostic	blocked	high	http://Google.com	blocked	MSSQL Injection	2021-02-28 16:33:41	http://Google.com/	2021-02-28T14:33:41.485Z
http://Google.com/signup	SQL Injection	DB Agnostic	http://Google.com/signup	N/A	id_001	password	post	Create a WAF Security rule to block incoming requests that contains.Validate that the specific input/url is protected with the MSSQL Injection signature pack (SQL Injection)	Web Application Firewall	insert into mysql.user (user, host, password) values ('name', 'localhost', password('pass123')) --	OS Agnostic	N/A	high	http://Google.com	blocked	MSSQL Injection	2021-02-28 16:33:41	http://Google.com/signup	2021-02-28T14:33:41.487Z

Agent	ID	Template	Timestamp
Cymulate_agent_2	id_b1	Cobalt Group	2021-03-01 10:15:58.230000
Cymulate_agent_2	id_b2	Cobalt Group	2021-02-25 16:56:33.871000
info@cymulate.com	id_b3	Cobalt Group	2021-02-23 11:00:50.988000