{"id":27122223,"url":"https://github.com/vmapps/attack2neo","last_synced_at":"2025-06-29T08:32:52.414Z","repository":{"id":53470690,"uuid":"217729644","full_name":"vmapps/attack2neo","owner":"vmapps","description":"Import Mitre Att\u0026ck into Neo4j database","archived":false,"fork":false,"pushed_at":"2022-12-08T06:46:43.000Z","size":2841,"stargazers_count":36,"open_issues_count":5,"forks_count":15,"subscribers_count":2,"default_branch":"master","last_synced_at":"2025-06-19T14:51:13.531Z","etag":null,"topics":["cypher","mitre-attack","neo4j","py2neo"],"latest_commit_sha":null,"homepage":null,"language":"Python","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":null,"status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/vmapps.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":null,"code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null}},"created_at":"2019-10-26T15:33:09.000Z","updated_at":"2025-05-11T17:38:07.000Z","dependencies_parsed_at":"2023-01-24T17:45:25.627Z","dependency_job_id":null,"html_url":"https://github.com/vmapps/attack2neo","commit_stats":null,"previous_names":[],"tags_count":1,"template":false,"template_full_name":null,"purl":"pkg:github/vmapps/attack2neo","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/vmapps%2Fattack2neo","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/vmapps%2Fattack2neo/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/vmapps%2Fattack2neo/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/vmapps%2Fattack2neo/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/vmapps","download_url":"https://codeload.github.com/vmapps/attack2neo/tar.gz/refs/heads/master","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/vmapps%2Fattack2neo/sbom","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":262564558,"owners_count":23329521,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["cypher","mitre-attack","neo4j","py2neo"],"created_at":"2025-04-07T11:26:19.514Z","updated_at":"2025-06-29T08:32:52.392Z","avatar_url":"https://github.com/vmapps.png","language":"Python","funding_links":[],"categories":[],"sub_categories":[],"readme":"# attack2neo\nImport Mitre Entreprise Att\u0026amp;ck data into Neo4j database\n\n## Purpose \nPurpose of this very simple tool is to :\n- read JSON data from Mitre Att\u0026amp;ck - https://attack.mitre.org/\n- import data into Neo4j database - https://neo4j.com/\n\nThis small project has been first been developed to easily \nquery Mitre Att\u0026amp;ck data using Cypher Query Language.\n\n## Requirements\nFollowing python modules are required :\n- [py2neo v4](https://py2neo.org/v4/)\n\nModules could be installed using following commands:\n```\n$ pip install -r requirements.txt\n```\n## Configuration\nSettings have to be defined directly into python script :\n```\n# open graph connection\ngraph_bolt = \"bolt://127.0.0.1:7687\"\ngraph_auth = (\"neo4j\",\"test\")\n```\nCustom settings according to your Neo4j installation:\n- `graph_bolt` contains connection details provided using URIs such as `bolt://\u003cip_address\u003e:\u003cport\u003e`\n- `graph_auth` contains a 2-tuple of (`\u003cuser\u003e`,`\u003cpassword\u003e`) to connect to Neo4j database\n\n## Usage\n```\nusage: attack2neo.py [-h] [-d] -f \u003cfilename\u003e [-g] [-s] [-o] [-t] [-r]\n\noptional arguments:\n  -h, --help        show this help message and exit\n  -d, --debug       enter debug mode\n  -f \u003cfilename\u003e     input file name\n  -g, --groups      import Groups objects (type:intrusion-set)\n  -s, --softwares   import Softwares objects (type:malware)\n  -o, --tools       import Tools objects (type:tool)\n  -t, --techniques  import Techniques objects (type:attack-pattern and\n                    type:course-of-action)\n  -r, --relations   import Relations objects (type:relationship)\n```\nwhere \u003cfilename\u003e contains JSON data from Mitre Att\u0026amp;ck\n\n## Mitre Att\u0026amp;ck database\nThe Mitre Entreprise Atta\u0026amp;ck database in JSON format could be\nfound out at [Mitre CTI Github](https://github.com/mitre/cti/blob/master/enterprise-attack/enterprise-attack.json)\n\n## Sample\nLet's first import data from Mitre Entreprise Att\u0026amp;ck:\n```\n$ ./attack2neo.py --debug -f mitre-enterprise-attack.json --groups --softwares --tools --relations\n[...]\nGroup: \"Dragonfly 2.0\" -[alias]-\u003e \"Berserk Bear\"\nGroup: \"Dust Storm\"\nGroup: \"Elderwood\" -[alias]-\u003e \"Elderwood Gang\" -[alias]-\u003e \"Beijing Group\" -[alias]-\u003e \"Sneaky Panda\"\n[...]\nSoftware: \"BUBBLEWRAP\" -[alias]-\u003e \"Backdoor.APT.FakeWinHTTPHelper\"\nSoftware: \"BabyShark\"\nSoftware: \"Backdoor.Oldrea\" -[alias]-\u003e \"Havex\"\n[...]\nTool: \"Pass-The-Hash Toolkit\"\nTool: \"Ping\" -[alias]-\u003e \"ping.exe\"\nTool: \"PoshC2\"\n[...]\nRelation: \"FIN5\" -[uses]-\u003e \"PsExec\"\nRelation: \"DarkHydrus\" -[uses]-\u003e \"Cobalt Strike\"\nRelation: \"Leviathan\" -[uses]-\u003e \"BITSAdmin\"\n[...]\n```\n\nThen, we can query Neo4j database using Neo4j Browser:\n\n![attack2neo](samples/attack2neo.png)\n\n## Visualization\nUnder `visualization` folder, there are files `attack2neo.html` and `attack2neo.js` to provide simple HTML tool to visualize your Neo4j Cypher queries using [neovis.js](https://github.com/neo4j-contrib/neovis.js) library.\n\nSettings have to be defined directly into javascript file :\n```\nserver_url: \"bolt://localhost:7687\",\nserver_user: \"neo4j\",\nserver_password: \"test\",\ninitial_cypher: \"MATCH (n)-[r]-(m) RETURN n,r,m\"\n```\nCustom settings according to your Neo4j installation:\n- `server_url` contains connection details provided using URIs such as `bolt://\u003cip_address\u003e:\u003cport\u003e`\n- `server_user` contains user value to connect to Neo4j database\n- `server_password` contains password value to connect to Neo4j database\n- `initial_cypher` contains Cypher query to be run\n\n![attack2neo](visualization/attack2neo.png)\n\n## Queries samples\nFind aliases for group \"APT18\":\n```\nMATCH (g:Group {name:\"APT18\"}) \nWITH g MATCH (g) - [:alias] -\u003e (a:Alias)\nRETURN g.name AS Name, a AS Alias\n\n╒═══════╤════════════════════════════╕\n│\"Name\" │\"Alias\"                     │\n╞═══════╪════════════════════════════╡\n│\"APT18\"│{\"name\":\"Threat Group-0416\"}│\n├───────┼────────────────────────────┤\n│\"APT18\"│{\"name\":\"Dynamite Panda\"}   │\n├───────┼────────────────────────────┤\n│\"APT18\"│{\"name\":\"TG-0416\"}          │\n└───────┴────────────────────────────┘\n```\nFind groups who are using software \"ASPXSpy\":\n```\nMATCH (s:Software)\nWHERE s.name = \"ASPXSpy\" \nWITH s MATCH (s) \u003c- [:uses] - (g:Group)\nRETURN s.name AS Software, g.name AS Group\n\n╒══════════╤═══════════════════╕\n│\"Software\"│\"Group\"            │\n╞══════════╪═══════════════════╡\n│\"ASPXSpy\" │\"APT41\"            │\n├──────────┼───────────────────┤\n│\"ASPXSpy\" │\"APT39\"            │\n├──────────┼───────────────────┤\n│\"ASPXSpy\" │\"Night Dragon\"     │\n├──────────┼───────────────────┤\n│\"ASPXSpy\" │\"Threat Group-3390\"│\n└──────────┴───────────────────┘\n```\n\nFind groups - and their aliases - who are using software \"BISCUIT\":\n```\nMATCH (s:Software {name:\"BISCUIT\"}) \u003c-[*1..2]-\u003e (g:Group)\nRETURN s.name AS Software, g.name AS Group\n\n╒══════════╤═══════════════╕\n│\"Software\"│\"Group\"        │\n╞══════════╪═══════════════╡\n│\"BISCUIT\" │\"APT1\"         │\n├──────────┼───────────────┤\n│\"BISCUIT\" │\"Comment Crew\" │\n├──────────┼───────────────┤\n│\"BISCUIT\" │\"Comment Group\"│\n├──────────┼───────────────┤\n│\"BISCUIT\" │\"Comment Panda\"│\n└──────────┴───────────────┘\n```\n\nFind all about a specifc group:\n```\nMATCH (n)-[r]-(m)\nWHERE n.name='APT1'\nRETURN n.name, TYPE(r), LABELS(m), m.name\n\n╒════════╤═════════╤═════════════════╤═══════════════════════╕\n│\"n.name\"│\"TYPE(r)\"│\"LABELS(m)\"      │\"m.name\"               │\n╞════════╪═════════╪═════════════════╪═══════════════════════╡\n│\"APT1\"  │\"uses\"   │[\"Software\"]     │\"Seasalt\"              │\n├────────┼─────────┼─────────────────┼───────────────────────┤\n│\"APT1\"  │\"uses\"   │[\"Software\"]     │\"PoisonIvy\"            │\n├────────┼─────────┼─────────────────┼───────────────────────┤\n│\"APT1\"  │\"uses\"   │[\"Tool\"]         │\"xCmd\"                 │\n├────────┼─────────┼─────────────────┼───────────────────────┤\n│\"APT1\"  │\"uses\"   │[\"Software\"]     │\"WEBC2\"                │\n├────────┼─────────┼─────────────────┼───────────────────────┤\n│\"APT1\"  │\"uses\"   │[\"Tool\"]         │\"Cachedump\"            │\n├────────┼─────────┼─────────────────┼───────────────────────┤\n│\"APT1\"  │\"uses\"   │[\"Tool\"]         │\"Pass-The-Hash Toolkit\"│\n├────────┼─────────┼─────────────────┼───────────────────────┤\n│\"APT1\"  │\"uses\"   │[\"Tool\"]         │\"PsExec\"               │\n├────────┼─────────┼─────────────────┼───────────────────────┤\n│\"APT1\"  │\"uses\"   │[\"Tool\"]         │\"Net\"                  │\n├────────┼─────────┼─────────────────┼───────────────────────┤\n│\"APT1\"  │\"uses\"   │[\"Tool\"]         │\"gsecdump\"             │\n├────────┼─────────┼─────────────────┼───────────────────────┤\n│\"APT1\"  │\"uses\"   │[\"Software\"]     │\"BISCUIT\"              │\n├────────┼─────────┼─────────────────┼───────────────────────┤\n│\"APT1\"  │\"uses\"   │[\"Tool\"]         │\"Lslsass\"              │\n├────────┼─────────┼─────────────────┼───────────────────────┤\n│\"APT1\"  │\"uses\"   │[\"Tool\"]         │\"Mimikatz\"             │\n├────────┼─────────┼─────────────────┼───────────────────────┤\n│\"APT1\"  │\"uses\"   │[\"Tool\"]         │\"ipconfig\"             │\n├────────┼─────────┼─────────────────┼───────────────────────┤\n│\"APT1\"  │\"uses\"   │[\"Tool\"]         │\"Tasklist\"             │\n├────────┼─────────┼─────────────────┼───────────────────────┤\n│\"APT1\"  │\"uses\"   │[\"Software\"]     │\"GLOOXMAIL\"            │\n├────────┼─────────┼─────────────────┼───────────────────────┤\n│\"APT1\"  │\"uses\"   │[\"Tool\"]         │\"pwdump\"               │\n├────────┼─────────┼─────────────────┼───────────────────────┤\n│\"APT1\"  │\"uses\"   │[\"Software\"]     │\"CALENDAR\"             │\n├────────┼─────────┼─────────────────┼───────────────────────┤\n│\"APT1\"  │\"alias\"  │[\"Alias\",\"Group\"]│\"Comment Panda\"        │\n├────────┼─────────┼─────────────────┼───────────────────────┤\n│\"APT1\"  │\"alias\"  │[\"Alias\",\"Group\"]│\"Comment Group\"        │\n├────────┼─────────┼─────────────────┼───────────────────────┤\n│\"APT1\"  │\"alias\"  │[\"Alias\",\"Group\"]│\"Comment Crew\"         │\n└────────┴─────────┴─────────────────┴───────────────────────┘\n```\n\nSee [Neo4j's Cypher queries cheatsheet](https://gist.github.com/DaniSancas/1d5265fc159a95ff457b940fc5046887) to get some Neo4j and Cypher fundamentals.\n\n\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fvmapps%2Fattack2neo","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fvmapps%2Fattack2neo","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fvmapps%2Fattack2neo/lists"}