Adversary Capability Assessment

"""
Adversary Capability Assessment Scoring.
Evaluates adversary sophistication across multiple dimensions
based on observed behavior in the deception environment.
"""
from dataclasses import dataclass
from typing import List, Optional
import json

@dataclass
class CapabilityDimension:
    name: str
    score: int          # 1-10
    evidence: List[str]
    notes: str

def assess_adversary(observations: dict) -> dict:
    """Score adversary capability based on deception observations."""
    dimensions = []

    # Technical Skill
    custom_tools = observations.get("used_custom_tools", False)
    basic_enumeration_only = observations.get("basic_enumeration_only", True)
    dimensions.append(CapabilityDimension(
        name="Technical Skill",
        score=8 if custom_tools else (4 if basic_enumeration_only else 6),
        evidence=observations.get("tools_observed", []),
        notes="Custom tooling suggests dedicated development resources"
              if custom_tools else "Used publicly available tools only",
    ))

    # Operational Security
    cleared_logs = observations.get("attempted_log_clearing", False)
    used_encryption = observations.get("encrypted_c2", False)
    dimensions.append(CapabilityDimension(
        name="Operational Security",
        score=7 if (cleared_logs and used_encryption) else
              (4 if cleared_logs else 2),
        evidence=[
            f"Log clearing: {'Yes' if cleared_logs else 'No'}",
            f"Encrypted C2: {'Yes' if used_encryption else 'No'}",
        ],
        notes="Anti-forensics awareness indicates experienced operator",
    ))

    # Target Awareness
    targeted_crown_jewels = observations.get("targeted_high_value", False)
    random_scanning = observations.get("random_scanning", True)
    dimensions.append(CapabilityDimension(
        name="Target Awareness",
        score=8 if targeted_crown_jewels else (3 if random_scanning else 5),
        evidence=observations.get("targets_prioritized", []),
        notes="Targeted approach suggests prior reconnaissance "
              "or insider knowledge" if targeted_crown_jewels
              else "Opportunistic scanning pattern",
    ))

    # Speed and Efficiency
    dwell_minutes = observations.get("total_dwell_minutes", 0)
    dimensions.append(CapabilityDimension(
        name="Speed & Efficiency",
        score=min(9, max(1, 10 - (dwell_minutes // 30))),
        evidence=[f"Total dwell time: {dwell_minutes} minutes"],
        notes="Fast operators know what they are looking for",
    ))

    overall_score = sum(d.score for d in dimensions) / len(dimensions)
    threat_level = (
        "APT / State-Sponsored" if overall_score >= 7.5 else
        "Organized Cybercrime" if overall_score >= 5 else
        "Opportunistic / Script Kiddie"
    )

    return {
        "assessment_type": "adversary_capability",
        "overall_score": round(overall_score, 1),
        "threat_level": threat_level,
        "dimensions": [
            {
                "name": d.name,
                "score": d.score,
                "evidence": d.evidence,
                "notes": d.notes,
            }
            for d in dimensions
        ],
    }

if __name__ == "__main__":
    # Example from a deception engagement
    result = assess_adversary({
        "used_custom_tools": True,
        "tools_observed": ["custom-lsass-dumper", "modified-mimikatz"],
        "attempted_log_clearing": True,
        "encrypted_c2": True,
        "targeted_high_value": True,
        "targets_prioritized": ["database-servers", "domain-controllers"],
        "total_dwell_minutes": 45,
    })
    print(json.dumps(result, indent=2))