mirror of
https://github.com/SHOGGOTH-SECTOR/sica-fondt.git
synced 2026-08-01 16:40:24 +00:00
24f816b6a3
Place useful parts of the surrounding repos into sica-fondt by layer, per the
body model (Ada = membrane; brain/endocrine/capabilities/knowledge non-Ada):
- brain/ LLM reasoning + providers (dapr, hermes, MoMoA)
- capabilities/ REPRAG sidecars: hermes tools/skills, dapr tools, parallel
dispatch, A51 channels, and the OSINT cluster
- knowledge/ LORAG corpus: 754 cyber-skills, agency personas, secure-coding,
MITRE ATT&CK data
- reference/ defensive threat-reference (C3, shhbruh doc) + AdaYaml parser
License handling: AGPL sources (worldosint, advanced_evolution, mercury,
Reticulum) and GPL DeTTECT are SPEC-only clean-room/port descriptions — no
copyleft code copied. MIT/Apache/data parts copied as working trees.
Safety: shhbruh escape/persistence material and C3 covert-C2 kept as reference
only, not wired into the running organism. See CONSOLIDATION.md.
https://claude.ai/code/session_01UehUqEXXJJCsHoA4voCU5c
2.1 KiB
2.1 KiB
AWS Credential Exposure Detection API Reference
TruffleHog CLI
# Scan local git repo
trufflehog git file:///path/to/repo --json
# Scan GitHub organization
trufflehog github --org my-org --token $GITHUB_TOKEN --json
# Scan GitHub repo
trufflehog git https://github.com/org/repo.git --json
# Scan filesystem (non-git)
trufflehog filesystem /path/to/dir --json
# Scan S3 bucket
trufflehog s3 --bucket my-bucket --json
# Only show verified credentials
trufflehog git file:///repo --only-verified --json
git-secrets CLI
# Install hooks in repo
git secrets --install
git secrets --register-aws
# Scan repo history
git secrets --scan-history
# Scan specific file
git secrets --scan /path/to/file
# Add custom pattern
git secrets --add 'PRIVATE KEY'
git secrets --add-provider -- cat /path/to/patterns.txt
AWS IAM CLI - Key Management
# Check key last used
aws iam get-access-key-last-used --access-key-id AKIAXXXXXXXXXXXXXXXX
# List access keys for user
aws iam list-access-keys --user-name jsmith
# Deactivate exposed key
aws iam update-access-key --access-key-id AKIAXXXXXXXXXXXXXXXX \
--user-name jsmith --status Inactive
# Delete key
aws iam delete-access-key --access-key-id AKIAXXXXXXXXXXXXXXXX \
--user-name jsmith
# Create new key (after rotation)
aws iam create-access-key --user-name jsmith
AWS Access Key Regex Patterns
Access Key ID: AKIA[A-Z0-9]{16}
Temp Key ID: ASIA[A-Z0-9]{16}
Secret Key: [A-Za-z0-9/+=]{40}
GuardDuty Credential Findings
| Finding Type | Description |
|---|---|
UnauthorizedAccess:IAMUser/InstanceCredentialExfiltration.OutsideAWS |
Instance creds used outside AWS |
UnauthorizedAccess:IAMUser/ConsoleLoginSuccess.B |
Console login from unusual IP |
Recon:IAMUser/MaliciousIPCaller.Custom |
API calls from threat intel IPs |
AWS CloudTrail - Credential Abuse Queries (Athena)
SELECT eventtime, useridentity.accesskeyid, sourceipaddress, eventname
FROM cloudtrail_logs
WHERE useridentity.accesskeyid = 'AKIAXXXXXXXXXXXXXXXX'
ORDER BY eventtime DESC
LIMIT 100;