Adds support for MITRE ATT&CK References

[cgranleese-r7]

This PR adds support for MITRE ATT&CK References in Metasploit modules, this will allow users to now search for MITRE ATT&CK techniques via our existing search functionality.

Metasploit Pro

I have verified this also work with Metasploit Pro. Links are rendered and clickable etc. The search functionality also works there as well 🚀

Verification

• CI goes green
• Code changes look sane

Requirements

• Can add MITRE technique IDs to module metadata using existing reference field structure
• Users can search for "T1190" and get relevant modules in results
• Technique IDs render as clickable links to MITRE ATT&CK website
• Search performance remains unchanged when including technique ID matching
• At least 10 existing modules successfully tagged with relevant technique IDs during testing

Manual testing

• Clickable links(info)
• Clickable links(info -d):
• Searchable(search att&ck:T1190)
• Searchable(search attack:T1190)
• Searching for the main technique ID should return sub-techniques (search att&ck:T1021 should return modules containing [ 'ATT&CK', 'T1021.001' ]).
• Try break it

[h00die]

I started adding these to all the updated persistence techniques. That PR will need to have these redone to the new format.
https://github.com/rapid7/metasploit-framework/pull/19815/files#diff-5156607c9d633cf8541aaa49486428ac5d8f9c5ea9f4aa808fccb4a3b7a63e50R55 #19815

[adfoster-r7]

Could we spike generating out ruby constants for the techniques so we can auto-complete values in our editors; past experience shows it's very easy for people to get magic values wrong

[adfoster-r7]

Looks like T1077 was consolidated into T1021.002 - so I think this is redundant 🤔

[cgranleese-r7]

Will look into this 👍

[adfoster-r7]

Do we have a plan for how payloads will impact the att&ck metadata here? As well as conditional techniques that are based on actions, or changing datastore values etc

[cgranleese-r7]

Hmm, good question - do you have any thoughts on this @smcintyre-r7

[smcintyre-r7]

We have the same issue for side effects. I think at this time, we can completely ignore what a payload is going to do otherwise everything capable of delivering a meterpreter payload would be tagged with everything meterpreter can do. At that point, we'll have diminishing returns on the content.

I'm happy to focus the tags on what the module does. There will need to be a judgement call in regards to tags that are only applicable for particular targets / actions. The precedence we've set in the past is that we add them to the side effects if any target or action uses it and we should probably continue to do that. Long term though, having a way to separate the tags for different targets and actions would enable us to better inform our users of what is going to happen based on their configuration. I'm guessing that'd be a much larger engineering effort and would be happy to leave that out of scope for this work item.

[cdelafuente-r7]

Would it be possible to add a rubocop rule to make sure ATT&CK reference key has no typo and automatically swap to the correct key word?

[adfoster-r7]

Suggested change

	output << ' module Technique'
	output << " # This file was auto-generated by #{__FILE__} please do not manually edit it"
	output << ' module Technique'