mirror of
https://github.com/SHOGGOTH-SECTOR/sica-fondt.git
synced 2026-08-01 08:30:20 +00:00
24f816b6a3
Place useful parts of the surrounding repos into sica-fondt by layer, per the
body model (Ada = membrane; brain/endocrine/capabilities/knowledge non-Ada):
- brain/ LLM reasoning + providers (dapr, hermes, MoMoA)
- capabilities/ REPRAG sidecars: hermes tools/skills, dapr tools, parallel
dispatch, A51 channels, and the OSINT cluster
- knowledge/ LORAG corpus: 754 cyber-skills, agency personas, secure-coding,
MITRE ATT&CK data
- reference/ defensive threat-reference (C3, shhbruh doc) + AdaYaml parser
License handling: AGPL sources (worldosint, advanced_evolution, mercury,
Reticulum) and GPL DeTTECT are SPEC-only clean-room/port descriptions — no
copyleft code copied. MIT/Apache/data parts copied as working trees.
Safety: shhbruh escape/persistence material and C3 covert-C2 kept as reference
only, not wired into the running organism. See CONSOLIDATION.md.
https://claude.ai/code/session_01UehUqEXXJJCsHoA4voCU5c
39 lines
1.5 KiB
Python
39 lines
1.5 KiB
Python
#!/usr/bin/env python3
|
|
"""Shellbag Forensic Analyzer - Parses SBECmd CSV output for investigation."""
|
|
import csv, json, os, sys
|
|
from datetime import datetime
|
|
from collections import defaultdict
|
|
|
|
def analyze_shellbags(csv_path: str, output_dir: str) -> str:
|
|
os.makedirs(output_dir, exist_ok=True)
|
|
entries = []
|
|
usb_access = []
|
|
network_access = []
|
|
with open(csv_path, "r", encoding="utf-8-sig") as f:
|
|
for row in csv.DictReader(f):
|
|
entries.append(row)
|
|
path = row.get("AbsolutePath", "")
|
|
if any(d in path for d in ["E:\\", "F:\\", "G:\\", "H:\\"]):
|
|
usb_access.append(row)
|
|
if path.startswith("\\\\"):
|
|
network_access.append(row)
|
|
report = {
|
|
"analysis_timestamp": datetime.now().isoformat(),
|
|
"total_entries": len(entries),
|
|
"usb_access_entries": len(usb_access),
|
|
"network_access_entries": len(network_access),
|
|
"usb_paths": [r.get("AbsolutePath", "") for r in usb_access],
|
|
"network_paths": [r.get("AbsolutePath", "") for r in network_access],
|
|
}
|
|
report_path = os.path.join(output_dir, "shellbag_analysis.json")
|
|
with open(report_path, "w") as f:
|
|
json.dump(report, f, indent=2)
|
|
print(f"[*] Total entries: {len(entries)}, USB: {len(usb_access)}, Network: {len(network_access)}")
|
|
return report_path
|
|
|
|
if __name__ == "__main__":
|
|
if len(sys.argv) < 3:
|
|
print("Usage: python process.py <shellbag_csv> <output_dir>")
|
|
sys.exit(1)
|
|
analyze_shellbags(sys.argv[1], sys.argv[2])
|