mirror of
https://github.com/SHOGGOTH-SECTOR/sica-fondt.git
synced 2026-08-01 08:30:20 +00:00
24f816b6a3
Place useful parts of the surrounding repos into sica-fondt by layer, per the
body model (Ada = membrane; brain/endocrine/capabilities/knowledge non-Ada):
- brain/ LLM reasoning + providers (dapr, hermes, MoMoA)
- capabilities/ REPRAG sidecars: hermes tools/skills, dapr tools, parallel
dispatch, A51 channels, and the OSINT cluster
- knowledge/ LORAG corpus: 754 cyber-skills, agency personas, secure-coding,
MITRE ATT&CK data
- reference/ defensive threat-reference (C3, shhbruh doc) + AdaYaml parser
License handling: AGPL sources (worldosint, advanced_evolution, mercury,
Reticulum) and GPL DeTTECT are SPEC-only clean-room/port descriptions — no
copyleft code copied. MIT/Apache/data parts copied as working trees.
Safety: shhbruh escape/persistence material and C3 covert-C2 kept as reference
only, not wired into the running organism. See CONSOLIDATION.md.
https://claude.ai/code/session_01UehUqEXXJJCsHoA4voCU5c
2.0 KiB
2.0 KiB
API Reference: Analyzing Windows Event Logs in Splunk
splunk-sdk Connection
import splunklib.client as client
service = client.connect(host="splunk", port=8089, username="admin", password="pass")
Key Windows Security Event IDs
| EventCode | Description | ATT&CK Technique |
|---|---|---|
| 4624 | Successful logon | T1078 |
| 4625 | Failed logon | T1110 |
| 4648 | Explicit credential logon | T1078 |
| 4672 | Special privileges assigned | T1134 |
| 4688 | New process created | T1059 |
| 4698 | Scheduled task created | T1053.005 |
| 4720 | User account created | T1136.001 |
| 4732 | Member added to security group | T1098 |
| 4768 | Kerberos TGT requested | T1558 |
| 4769 | Kerberos service ticket | T1558.003 |
Key Sysmon Event IDs
| EventCode | Description |
|---|---|
| 1 | Process creation (full command line, hashes) |
| 3 | Network connection |
| 7 | Image loaded (DLL) |
| 10 | Process access (LSASS credential dumping) |
| 11 | File creation |
| 13 | Registry value set |
| 22 | DNS query |
Logon Types
| Type | Description | Context |
|---|---|---|
| 2 | Interactive | Local console logon |
| 3 | Network | SMB, WMI, PowerShell Remoting |
| 7 | Unlock | Workstation unlock |
| 9 | NewCredentials | runas /netonly |
| 10 | RemoteInteractive | RDP logon |
SPL Detection Patterns
# Brute force detection
index=wineventlog EventCode=4625 | stats count by src_ip | where count > 20
# Kerberoasting (T1558.003)
index=wineventlog EventCode=4769 Ticket_Encryption_Type=0x17
| where ServiceName != "krbtgt"
# DCSync detection (T1003.006)
index=wineventlog EventCode=4662
| where ObjectType="*domainDNS*"
| search Properties="*Replicating Directory Changes*"
References
- splunk-sdk: https://pypi.org/project/splunk-sdk/
- Splunk CIM: https://docs.splunk.com/Documentation/CIM/latest/User/Overview
- Windows Security Log Encyclopedia: https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/