Skip to content

Create include_powershell_profiles.xml #56

Create include_powershell_profiles.xml

Create include_powershell_profiles.xml #56

Workflow file for this run

name: Build Attack Matrix
on:
push:
branches:
- "*"
pull_request:
branches: [ master ]
jobs:
generate-matrix:
runs-on: ubuntu-latest
steps:
- name: Checkout repo
uses: actions/checkout@v3
- name: Run matrix update code
run: |
tmpfile=$(mktemp)
grep -Po "(technique_id=T\d+(?:\.\d+)?)" sysmonconfig.xml | sort | uniq -c | sed -E 's/^\s*([0-9]+)\s+technique_id=(\S+)/{"score": \1, "technique_id": "\2"}/' | jq -s 'map({techniqueID: .technique_id, score: .score})' > "$tmpfile"
jq --argfile techniques "$tmpfile" '.techniques = $techniques' ./attack_matrix/Sysmon-modular.json > attack_matrix.json
rm "$tmpfile"
- uses: actions/upload-artifact@v3
with:
name: matrix
path: attack_matrix.json