mirror of
https://github.com/SHOGGOTH-SECTOR/sica-fondt.git
synced 2026-08-01 08:30:20 +00:00
24f816b6a3
Place useful parts of the surrounding repos into sica-fondt by layer, per the
body model (Ada = membrane; brain/endocrine/capabilities/knowledge non-Ada):
- brain/ LLM reasoning + providers (dapr, hermes, MoMoA)
- capabilities/ REPRAG sidecars: hermes tools/skills, dapr tools, parallel
dispatch, A51 channels, and the OSINT cluster
- knowledge/ LORAG corpus: 754 cyber-skills, agency personas, secure-coding,
MITRE ATT&CK data
- reference/ defensive threat-reference (C3, shhbruh doc) + AdaYaml parser
License handling: AGPL sources (worldosint, advanced_evolution, mercury,
Reticulum) and GPL DeTTECT are SPEC-only clean-room/port descriptions — no
copyleft code copied. MIT/Apache/data parts copied as working trees.
Safety: shhbruh escape/persistence material and C3 covert-C2 kept as reference
only, not wired into the running organism. See CONSOLIDATION.md.
https://claude.ai/code/session_01UehUqEXXJJCsHoA4voCU5c
88 lines
2.2 KiB
Markdown
88 lines
2.2 KiB
Markdown
# Threat Actor TTP Analysis Report Template
|
|
|
|
## Report Metadata
|
|
| Field | Value |
|
|
|-------|-------|
|
|
| Report ID | TTP-YYYY-NNNN |
|
|
| Date | YYYY-MM-DD |
|
|
| Threat Actor | [Group Name] |
|
|
| ATT&CK ID | G[NNNN] |
|
|
| Classification | TLP:AMBER |
|
|
| Analyst | [Name] |
|
|
|
|
## Threat Actor Profile
|
|
|
|
| Attribute | Detail |
|
|
|-----------|--------|
|
|
| Name | |
|
|
| Aliases | |
|
|
| Suspected Origin | |
|
|
| Motivation | Espionage / Financial / Disruption |
|
|
| Active Since | |
|
|
| Targeted Sectors | |
|
|
| Targeted Regions | |
|
|
| Associated Malware | |
|
|
|
|
## TTP Summary
|
|
|
|
| Tactic | Technique Count | Key Techniques |
|
|
|--------|----------------|----------------|
|
|
| Reconnaissance | | |
|
|
| Resource Development | | |
|
|
| Initial Access | | |
|
|
| Execution | | |
|
|
| Persistence | | |
|
|
| Privilege Escalation | | |
|
|
| Defense Evasion | | |
|
|
| Credential Access | | |
|
|
| Discovery | | |
|
|
| Lateral Movement | | |
|
|
| Collection | | |
|
|
| Command and Control | | |
|
|
| Exfiltration | | |
|
|
| Impact | | |
|
|
|
|
## Detailed Technique Mapping
|
|
|
|
### [Tactic Name]
|
|
|
|
| ATT&CK ID | Technique | Sub-technique | Procedure Example |
|
|
|-----------|-----------|---------------|-------------------|
|
|
| T1566.001 | Phishing | Spearphishing Attachment | Actor sends macro-enabled documents |
|
|
| | | | |
|
|
|
|
## Detection Coverage
|
|
|
|
| Status | Count | Percentage |
|
|
|--------|-------|-----------|
|
|
| Detected | | % |
|
|
| Partial Detection | | % |
|
|
| No Detection (Gap) | | % |
|
|
|
|
## Detection Gaps (Priority Order)
|
|
|
|
| Priority | ATT&CK ID | Technique | Required Data Source | Effort |
|
|
|----------|-----------|-----------|---------------------|--------|
|
|
| 1 | | | | Low/Med/High |
|
|
| 2 | | | | |
|
|
|
|
## Recommended Data Sources
|
|
|
|
| Data Source | Techniques Covered | Current Status |
|
|
|------------|-------------------|----------------|
|
|
| Process Creation | X techniques | Collecting/Not Collecting |
|
|
| Network Traffic Flow | X techniques | |
|
|
| File Monitoring | X techniques | |
|
|
|
|
## ATT&CK Navigator Layer
|
|
|
|
Layer file: `[group]_navigator_layer.json`
|
|
|
|
Load at: https://mitre-attack.github.io/attack-navigator/
|
|
|
|
## Recommendations
|
|
|
|
1. **Immediate**: Deploy detections for [top 3 gap techniques]
|
|
2. **Short-term**: Enable [data source] collection to cover N techniques
|
|
3. **Long-term**: Build behavioral analytics for [tactic] coverage
|