mirror of
https://github.com/SHOGGOTH-SECTOR/sica-fondt.git
synced 2026-08-01 16:40:24 +00:00
24f816b6a3
Place useful parts of the surrounding repos into sica-fondt by layer, per the
body model (Ada = membrane; brain/endocrine/capabilities/knowledge non-Ada):
- brain/ LLM reasoning + providers (dapr, hermes, MoMoA)
- capabilities/ REPRAG sidecars: hermes tools/skills, dapr tools, parallel
dispatch, A51 channels, and the OSINT cluster
- knowledge/ LORAG corpus: 754 cyber-skills, agency personas, secure-coding,
MITRE ATT&CK data
- reference/ defensive threat-reference (C3, shhbruh doc) + AdaYaml parser
License handling: AGPL sources (worldosint, advanced_evolution, mercury,
Reticulum) and GPL DeTTECT are SPEC-only clean-room/port descriptions — no
copyleft code copied. MIT/Apache/data parts copied as working trees.
Safety: shhbruh escape/persistence material and C3 covert-C2 kept as reference
only, not wired into the running organism. See CONSOLIDATION.md.
https://claude.ai/code/session_01UehUqEXXJJCsHoA4voCU5c
91 lines
2.3 KiB
Markdown
91 lines
2.3 KiB
Markdown
# Workflows: Detecting Business Email Compromise
|
|
|
|
## Workflow 1: BEC Detection Pipeline
|
|
|
|
```
|
|
Inbound email arrives
|
|
|
|
|
v
|
|
[Check: Does display name match VIP list?]
|
|
+-- YES + external domain --> HIGH ALERT: Possible CEO fraud
|
|
+-- NO --> Continue standard checks
|
|
|
|
|
v
|
|
[Check: Financial keywords present?]
|
|
+-- "wire transfer", "payment", "invoice", "bank details" detected
|
|
+-- Combined with urgency: "urgent", "confidential", "today"
|
|
+-- YES --> ELEVATED: Flag for finance team review
|
|
|
|
|
v
|
|
[Check: Reply-To mismatch?]
|
|
+-- Reply-To domain differs from From domain
|
|
+-- YES --> HIGH: Likely BEC attempt
|
|
|
|
|
v
|
|
[Check: Communication pattern anomaly?]
|
|
+-- First-time sender to finance/HR staff
|
|
+-- Unusual time of day for this sender
|
|
+-- YES --> MEDIUM: Requires verification
|
|
|
|
|
v
|
|
[Decision]
|
|
+-- BLOCK: High-confidence BEC
|
|
+-- QUARANTINE: Moderate confidence
|
|
+-- TAG: Warning banner for recipient
|
|
+-- DELIVER: Low risk
|
|
```
|
|
|
|
## Workflow 2: BEC Incident Response
|
|
|
|
```
|
|
BEC attempt detected or reported
|
|
|
|
|
v
|
|
[Immediate actions (first 30 minutes)]
|
|
+-- Quarantine the email
|
|
+-- Search for similar messages to other recipients
|
|
+-- Alert affected users not to comply with request
|
|
|
|
|
v
|
|
[Investigation (next 2 hours)]
|
|
+-- Analyze email headers for true origin
|
|
+-- Check if any user already complied (check sent folders)
|
|
+-- If payment was made: Initiate bank recall immediately
|
|
+-- Search for compromised accounts (forwarding rules, login anomalies)
|
|
|
|
|
v
|
|
[Containment]
|
|
+-- Block sender domain/IP
|
|
+-- If account compromised: Force password reset, revoke sessions
|
|
+-- Remove malicious forwarding rules
|
|
+-- Notify finance to halt pending payments
|
|
|
|
|
v
|
|
[Recovery]
|
|
+-- Work with bank for fund recovery
|
|
+-- File FBI IC3 report (ic3.gov)
|
|
+-- Notify affected parties
|
|
+-- Update detection rules
|
|
+-- Targeted training for affected employees
|
|
```
|
|
|
|
## Workflow 3: Vendor Payment Change Verification
|
|
|
|
```
|
|
Vendor requests payment detail change
|
|
|
|
|
v
|
|
[Do NOT use contact info from the email]
|
|
|
|
|
v
|
|
[Look up vendor contact from existing records]
|
|
|
|
|
v
|
|
[Call vendor using known phone number]
|
|
+-- Verify the payment change request is legitimate
|
|
|
|
|
+-- CONFIRMED --> Process change with dual authorization
|
|
+-- NOT CONFIRMED --> Report as BEC attempt, block sender
|
|
+-- UNABLE TO REACH --> Hold payment, escalate
|
|
```
|