mirror of
https://github.com/SHOGGOTH-SECTOR/sica-fondt.git
synced 2026-08-01 08:30:20 +00:00
24f816b6a3
Place useful parts of the surrounding repos into sica-fondt by layer, per the
body model (Ada = membrane; brain/endocrine/capabilities/knowledge non-Ada):
- brain/ LLM reasoning + providers (dapr, hermes, MoMoA)
- capabilities/ REPRAG sidecars: hermes tools/skills, dapr tools, parallel
dispatch, A51 channels, and the OSINT cluster
- knowledge/ LORAG corpus: 754 cyber-skills, agency personas, secure-coding,
MITRE ATT&CK data
- reference/ defensive threat-reference (C3, shhbruh doc) + AdaYaml parser
License handling: AGPL sources (worldosint, advanced_evolution, mercury,
Reticulum) and GPL DeTTECT are SPEC-only clean-room/port descriptions — no
copyleft code copied. MIT/Apache/data parts copied as working trees.
Safety: shhbruh escape/persistence material and C3 covert-C2 kept as reference
only, not wired into the running organism. See CONSOLIDATION.md.
https://claude.ai/code/session_01UehUqEXXJJCsHoA4voCU5c
88 lines
2.5 KiB
Markdown
88 lines
2.5 KiB
Markdown
# API Reference: Network Covert Channel Detection
|
|
|
|
## Scapy - Packet Analysis
|
|
|
|
### DNS Tunneling Detection
|
|
```python
|
|
from scapy.all import rdpcap, DNS, DNSQR, IP
|
|
|
|
packets = rdpcap("capture.pcap")
|
|
for pkt in packets:
|
|
if pkt.haslayer(DNSQR):
|
|
qname = pkt[DNSQR].qname.decode().rstrip(".")
|
|
src = pkt[IP].src
|
|
qtype = pkt[DNSQR].qtype # 1=A, 16=TXT, 28=AAAA
|
|
```
|
|
|
|
### ICMP Payload Extraction
|
|
```python
|
|
from scapy.all import ICMP, Raw
|
|
|
|
for pkt in packets:
|
|
if pkt.haslayer(ICMP) and pkt.haslayer(Raw):
|
|
payload = bytes(pkt[Raw].load)
|
|
icmp_type = pkt[ICMP].type # 8=echo-request, 0=echo-reply
|
|
```
|
|
|
|
## Zeek - Covert Channel Detection
|
|
|
|
### DNS Tunneling Indicators
|
|
```zeek
|
|
@load base/protocols/dns
|
|
event dns_request(c: connection, msg: dns_msg, query: string, qtype: count) {
|
|
if (|query| > 60)
|
|
print fmt("Long DNS query: %s from %s", query, c$id$orig_h);
|
|
}
|
|
```
|
|
|
|
### Configuration
|
|
```bash
|
|
zeek -r capture.pcap local
|
|
# Outputs: dns.log, conn.log, weird.log
|
|
```
|
|
|
|
## tshark - Protocol Filtering
|
|
|
|
### DNS Analysis
|
|
```bash
|
|
tshark -r capture.pcap -Y "dns" -T fields \
|
|
-e ip.src -e dns.qry.name -e dns.qry.type -e frame.len
|
|
|
|
# Filter long DNS queries
|
|
tshark -r capture.pcap -Y "dns.qry.name matches \"^.{60,}\"" -T fields -e dns.qry.name
|
|
```
|
|
|
|
### ICMP Payload Analysis
|
|
```bash
|
|
tshark -r capture.pcap -Y "icmp && data.len > 64" -T fields \
|
|
-e ip.src -e ip.dst -e icmp.type -e data.len -e data.data
|
|
```
|
|
|
|
## DNS Tunneling Tools
|
|
|
|
| Tool | Technique | Detection Method |
|
|
|------|-----------|-----------------|
|
|
| iodine | TXT/NULL/CNAME records | High entropy subdomains |
|
|
| dns2tcp | TXT records | Encoded query names |
|
|
| dnscat2 | TXT/CNAME/MX/A records | Base32/Base64 subdomain patterns |
|
|
| DNSExfiltrator | TXT records | High query volume to single domain |
|
|
|
|
## Entropy Thresholds
|
|
|
|
| Range | Interpretation |
|
|
|-------|---------------|
|
|
| < 2.0 | Normal domain labels (English words) |
|
|
| 2.0-3.5 | Possibly encoded but may be legitimate |
|
|
| 3.5-5.0 | Likely Base32/Base64 encoded (tunneling) |
|
|
| > 5.0 | Encrypted/random data (strong tunneling indicator) |
|
|
|
|
## Covert Channel Categories
|
|
|
|
| Channel Type | Protocol | Detection Method |
|
|
|-------------|----------|-----------------|
|
|
| DNS Tunneling | DNS (53/udp) | Subdomain entropy, query volume |
|
|
| ICMP Tunnel | ICMP (type 8/0) | Payload size, entropy, volume |
|
|
| HTTP Header | HTTP (80/tcp) | Cookie size, custom header entropy |
|
|
| Protocol Abuse | IP options, GRE | Unusual protocol numbers |
|
|
| Timing Channel | TCP | Inter-packet timing analysis |
|