mirror of
https://github.com/SHOGGOTH-SECTOR/sica-fondt.git
synced 2026-08-01 08:30:20 +00:00
24f816b6a3
Place useful parts of the surrounding repos into sica-fondt by layer, per the
body model (Ada = membrane; brain/endocrine/capabilities/knowledge non-Ada):
- brain/ LLM reasoning + providers (dapr, hermes, MoMoA)
- capabilities/ REPRAG sidecars: hermes tools/skills, dapr tools, parallel
dispatch, A51 channels, and the OSINT cluster
- knowledge/ LORAG corpus: 754 cyber-skills, agency personas, secure-coding,
MITRE ATT&CK data
- reference/ defensive threat-reference (C3, shhbruh doc) + AdaYaml parser
License handling: AGPL sources (worldosint, advanced_evolution, mercury,
Reticulum) and GPL DeTTECT are SPEC-only clean-room/port descriptions — no
copyleft code copied. MIT/Apache/data parts copied as working trees.
Safety: shhbruh escape/persistence material and C3 covert-C2 kept as reference
only, not wired into the running organism. See CONSOLIDATION.md.
https://claude.ai/code/session_01UehUqEXXJJCsHoA4voCU5c
68 lines
2.0 KiB
Markdown
68 lines
2.0 KiB
Markdown
# API Reference: Analyzing Windows Event Logs in Splunk
|
|
|
|
## splunk-sdk Connection
|
|
|
|
```python
|
|
import splunklib.client as client
|
|
service = client.connect(host="splunk", port=8089, username="admin", password="pass")
|
|
```
|
|
|
|
## Key Windows Security Event IDs
|
|
|
|
| EventCode | Description | ATT&CK Technique |
|
|
|-----------|-------------|-------------------|
|
|
| 4624 | Successful logon | T1078 |
|
|
| 4625 | Failed logon | T1110 |
|
|
| 4648 | Explicit credential logon | T1078 |
|
|
| 4672 | Special privileges assigned | T1134 |
|
|
| 4688 | New process created | T1059 |
|
|
| 4698 | Scheduled task created | T1053.005 |
|
|
| 4720 | User account created | T1136.001 |
|
|
| 4732 | Member added to security group | T1098 |
|
|
| 4768 | Kerberos TGT requested | T1558 |
|
|
| 4769 | Kerberos service ticket | T1558.003 |
|
|
|
|
## Key Sysmon Event IDs
|
|
|
|
| EventCode | Description |
|
|
|-----------|-------------|
|
|
| 1 | Process creation (full command line, hashes) |
|
|
| 3 | Network connection |
|
|
| 7 | Image loaded (DLL) |
|
|
| 10 | Process access (LSASS credential dumping) |
|
|
| 11 | File creation |
|
|
| 13 | Registry value set |
|
|
| 22 | DNS query |
|
|
|
|
## Logon Types
|
|
|
|
| Type | Description | Context |
|
|
|------|-------------|---------|
|
|
| 2 | Interactive | Local console logon |
|
|
| 3 | Network | SMB, WMI, PowerShell Remoting |
|
|
| 7 | Unlock | Workstation unlock |
|
|
| 9 | NewCredentials | runas /netonly |
|
|
| 10 | RemoteInteractive | RDP logon |
|
|
|
|
## SPL Detection Patterns
|
|
|
|
```spl
|
|
# Brute force detection
|
|
index=wineventlog EventCode=4625 | stats count by src_ip | where count > 20
|
|
|
|
# Kerberoasting (T1558.003)
|
|
index=wineventlog EventCode=4769 Ticket_Encryption_Type=0x17
|
|
| where ServiceName != "krbtgt"
|
|
|
|
# DCSync detection (T1003.006)
|
|
index=wineventlog EventCode=4662
|
|
| where ObjectType="*domainDNS*"
|
|
| search Properties="*Replicating Directory Changes*"
|
|
```
|
|
|
|
### References
|
|
|
|
- splunk-sdk: https://pypi.org/project/splunk-sdk/
|
|
- Splunk CIM: https://docs.splunk.com/Documentation/CIM/latest/User/Overview
|
|
- Windows Security Log Encyclopedia: https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/
|