mirror of
https://github.com/SHOGGOTH-SECTOR/sica-fondt.git
synced 2026-08-01 08:30:20 +00:00
24f816b6a3
Place useful parts of the surrounding repos into sica-fondt by layer, per the
body model (Ada = membrane; brain/endocrine/capabilities/knowledge non-Ada):
- brain/ LLM reasoning + providers (dapr, hermes, MoMoA)
- capabilities/ REPRAG sidecars: hermes tools/skills, dapr tools, parallel
dispatch, A51 channels, and the OSINT cluster
- knowledge/ LORAG corpus: 754 cyber-skills, agency personas, secure-coding,
MITRE ATT&CK data
- reference/ defensive threat-reference (C3, shhbruh doc) + AdaYaml parser
License handling: AGPL sources (worldosint, advanced_evolution, mercury,
Reticulum) and GPL DeTTECT are SPEC-only clean-room/port descriptions — no
copyleft code copied. MIT/Apache/data parts copied as working trees.
Safety: shhbruh escape/persistence material and C3 covert-C2 kept as reference
only, not wired into the running organism. See CONSOLIDATION.md.
https://claude.ai/code/session_01UehUqEXXJJCsHoA4voCU5c
89 lines
2.8 KiB
Markdown
89 lines
2.8 KiB
Markdown
# MITRE ATT&CK Navigator Layer - Anthropic Cybersecurity Skills
|
|
|
|
This directory contains a MITRE ATT&CK Navigator layer file that maps the coverage of the Anthropic Cybersecurity Skills repository against the ATT&CK Enterprise matrix.
|
|
|
|
## Files
|
|
|
|
| File | Description |
|
|
|------|-------------|
|
|
| `attack-navigator-layer.json` | ATT&CK Navigator layer (v4.5 format, Enterprise ATT&CK v14) |
|
|
|
|
## How to View
|
|
|
|
1. Open the [MITRE ATT&CK Navigator](https://mitre-attack.github.io/attack-navigator/)
|
|
2. Click **Open Existing Layer**
|
|
3. Select **Upload from local** and choose `attack-navigator-layer.json`
|
|
4. The matrix will display with blue-shaded techniques indicating coverage
|
|
|
|
Alternatively, paste the raw JSON URL into the Navigator's "Load from URL" option if this file is hosted publicly.
|
|
|
|
## Coverage Statistics
|
|
|
|
| Metric | Value |
|
|
|--------|-------|
|
|
| Total skills scanned | 742 |
|
|
| Unique ATT&CK techniques referenced | 218 |
|
|
| Parent techniques | 94 |
|
|
| Sub-techniques | 124 |
|
|
| Tactics with coverage | 14/14 |
|
|
|
|
## Coverage by Tactic
|
|
|
|
| Tactic | Techniques Covered |
|
|
|--------|-------------------|
|
|
| Defense Evasion | 36 |
|
|
| Credential Access | 33 |
|
|
| Persistence | 29 |
|
|
| Initial Access | 17 |
|
|
| Command and Control | 17 |
|
|
| Privilege Escalation | 13 |
|
|
| Discovery | 12 |
|
|
| Exfiltration | 12 |
|
|
| Reconnaissance | 11 |
|
|
| Collection | 10 |
|
|
| Lateral Movement | 9 |
|
|
| Execution | 8 |
|
|
| Resource Development | 6 |
|
|
| Impact | 5 |
|
|
|
|
## Color Scale
|
|
|
|
The layer uses a blue gradient to indicate coverage depth:
|
|
|
|
- **Light blue** (`#cfe2f3`): 1-2 skills reference this technique
|
|
- **Medium blue** (`#6fa8dc`): 3-5 skills reference this technique
|
|
- **Dark blue** (`#3d85c6`): 6-10 skills reference this technique
|
|
- **Deep blue** (`#1155cc`): 11+ skills reference this technique
|
|
|
|
## Top 10 Most Covered Techniques
|
|
|
|
| Technique | Name | Skills |
|
|
|-----------|------|--------|
|
|
| T1059.001 | PowerShell | 26 |
|
|
| T1055 | Process Injection | 17 |
|
|
| T1053.005 | Scheduled Task | 16 |
|
|
| T1566.001 | Spearphishing Attachment | 15 |
|
|
| T1558.003 | Kerberoasting | 14 |
|
|
| T1547.001 | Registry Run Keys / Startup Folder | 13 |
|
|
| T1078 | Valid Accounts | 13 |
|
|
| T1003.006 | DCSync | 13 |
|
|
| T1071.001 | Web Protocols | 12 |
|
|
| T1021.002 | SMB/Windows Admin Shares | 12 |
|
|
|
|
## Methodology
|
|
|
|
Techniques were extracted by scanning all `SKILL.md` files in the repository for ATT&CK technique ID patterns (`T1XXX` and `T1XXX.XXX`). Each technique's score is proportional to the number of distinct skills that reference it, normalized to a 1-100 scale.
|
|
|
|
## Layer Format
|
|
|
|
- **Format version**: 4.5
|
|
- **ATT&CK version**: 14 (Enterprise)
|
|
- **Navigator version**: 4.9.1
|
|
- **Domain**: enterprise-attack
|
|
|
|
## Related Links
|
|
|
|
- [MITRE ATT&CK Framework](https://attack.mitre.org/)
|
|
- [ATT&CK Navigator](https://mitre-attack.github.io/attack-navigator/)
|
|
- [ATT&CK Navigator GitHub](https://github.com/mitre-attack/attack-navigator)
|