mirror of
https://github.com/SHOGGOTH-SECTOR/sica-fondt.git
synced 2026-08-01 16:40:24 +00:00
24f816b6a3
Place useful parts of the surrounding repos into sica-fondt by layer, per the
body model (Ada = membrane; brain/endocrine/capabilities/knowledge non-Ada):
- brain/ LLM reasoning + providers (dapr, hermes, MoMoA)
- capabilities/ REPRAG sidecars: hermes tools/skills, dapr tools, parallel
dispatch, A51 channels, and the OSINT cluster
- knowledge/ LORAG corpus: 754 cyber-skills, agency personas, secure-coding,
MITRE ATT&CK data
- reference/ defensive threat-reference (C3, shhbruh doc) + AdaYaml parser
License handling: AGPL sources (worldosint, advanced_evolution, mercury,
Reticulum) and GPL DeTTECT are SPEC-only clean-room/port descriptions — no
copyleft code copied. MIT/Apache/data parts copied as working trees.
Safety: shhbruh escape/persistence material and C3 covert-C2 kept as reference
only, not wired into the running organism. See CONSOLIDATION.md.
https://claude.ai/code/session_01UehUqEXXJJCsHoA4voCU5c
80 lines
2.0 KiB
Markdown
80 lines
2.0 KiB
Markdown
# API Reference: Collecting Volatile Evidence from Compromised Host
|
|
|
|
## RFC 3227 Order of Volatility
|
|
| Priority | Source | Persistence |
|
|
|----------|--------|------------|
|
|
| 1 | CPU registers, cache | Nanoseconds |
|
|
| 2 | Physical memory (RAM) | Power cycle |
|
|
| 3 | Network state | Seconds-minutes |
|
|
| 4 | Running processes | Minutes |
|
|
| 5 | Disk (filesystem) | Persistent |
|
|
| 6 | Remote logging / monitoring | Persistent |
|
|
| 7 | Physical configuration | Persistent |
|
|
| 8 | Archival media | Long-term |
|
|
|
|
## Memory Acquisition Tools
|
|
| Tool | Platform | Command |
|
|
|------|----------|---------|
|
|
| AVML | Linux | `avml /path/to/output.lime` |
|
|
| WinPmem | Windows | `winpmem_mini_x64.exe output.raw` |
|
|
| LiME | Linux | `insmod lime.ko "path=/tmp/mem.lime format=lime"` |
|
|
| Magnet RAM Capture | Windows | GUI-based acquisition |
|
|
|
|
## Linux Collection Commands
|
|
```bash
|
|
# Network connections
|
|
ss -tunap > /evidence/netstat.txt
|
|
|
|
# Process list with tree
|
|
ps auxwwf > /evidence/processes.txt
|
|
|
|
# Open files
|
|
lsof -nP > /evidence/open_files.txt
|
|
|
|
# Network config
|
|
ip addr show > /evidence/ifconfig.txt
|
|
ip route show > /evidence/routes.txt
|
|
ip neigh show > /evidence/arp.txt
|
|
|
|
# Logged-in users
|
|
w > /evidence/users.txt
|
|
last -50 > /evidence/last_logins.txt
|
|
|
|
# Cron jobs
|
|
crontab -l > /evidence/crontab.txt
|
|
ls -la /etc/cron.d/ >> /evidence/crontab.txt
|
|
```
|
|
|
|
## Windows Collection Commands
|
|
```cmd
|
|
:: Network connections
|
|
netstat -anob > C:\evidence\netstat.txt
|
|
|
|
:: Process list
|
|
tasklist /V /FO CSV > C:\evidence\processes.csv
|
|
wmic process get ProcessId,Name,CommandLine /format:csv > C:\evidence\wmic_procs.csv
|
|
|
|
:: Network config
|
|
ipconfig /all > C:\evidence\ipconfig.txt
|
|
route print > C:\evidence\routes.txt
|
|
arp -a > C:\evidence\arp.txt
|
|
|
|
:: DNS cache
|
|
ipconfig /displaydns > C:\evidence\dns_cache.txt
|
|
|
|
:: Scheduled tasks
|
|
schtasks /query /FO CSV /V > C:\evidence\schtasks.csv
|
|
|
|
:: Logged-in users
|
|
query user > C:\evidence\users.txt
|
|
```
|
|
|
|
## Evidence Integrity
|
|
```bash
|
|
# Hash collected files
|
|
sha256sum /evidence/*.txt > /evidence/checksums.sha256
|
|
|
|
# Verify later
|
|
sha256sum -c /evidence/checksums.sha256
|
|
```
|