mirror of
https://github.com/SHOGGOTH-SECTOR/sica-fondt.git
synced 2026-08-01 08:30:20 +00:00
24f816b6a3
Place useful parts of the surrounding repos into sica-fondt by layer, per the
body model (Ada = membrane; brain/endocrine/capabilities/knowledge non-Ada):
- brain/ LLM reasoning + providers (dapr, hermes, MoMoA)
- capabilities/ REPRAG sidecars: hermes tools/skills, dapr tools, parallel
dispatch, A51 channels, and the OSINT cluster
- knowledge/ LORAG corpus: 754 cyber-skills, agency personas, secure-coding,
MITRE ATT&CK data
- reference/ defensive threat-reference (C3, shhbruh doc) + AdaYaml parser
License handling: AGPL sources (worldosint, advanced_evolution, mercury,
Reticulum) and GPL DeTTECT are SPEC-only clean-room/port descriptions — no
copyleft code copied. MIT/Apache/data parts copied as working trees.
Safety: shhbruh escape/persistence material and C3 covert-C2 kept as reference
only, not wired into the running organism. See CONSOLIDATION.md.
https://claude.ai/code/session_01UehUqEXXJJCsHoA4voCU5c
56 lines
2.2 KiB
Python
56 lines
2.2 KiB
Python
#!/usr/bin/env python3
|
|
"""Fileless Attack Detector - Scans PowerShell logs for fileless attack indicators."""
|
|
|
|
import json, csv, re, sys, os
|
|
from collections import Counter
|
|
from datetime import datetime
|
|
|
|
FILELESS_PATTERNS = {
|
|
"encoded_command": r"(?i)(-enc\s|-e\s|-encodedcommand|frombase64string)",
|
|
"download_cradle": r"(?i)(downloadstring|invoke-webrequest|net\.webclient|wget\s|curl\s)",
|
|
"amsi_bypass": r"(?i)(amsiutils|amsiinitfailed|amsi\.dll)",
|
|
"reflection": r"(?i)(system\.reflection|loadassembly|gettype.*invoke)",
|
|
"wmi_abuse": r"(?i)(win32_process.*create|wmiclass|managementclass)",
|
|
"credential_access": r"(?i)(mimikatz|invoke-mimikatz|sekurlsa|logonpasswords)",
|
|
"invoke_expression": r"(?i)(iex\s|invoke-expression)",
|
|
}
|
|
|
|
|
|
def scan_powershell_logs(csv_path: str) -> list:
|
|
detections = []
|
|
with open(csv_path, "r", encoding="utf-8-sig") as f:
|
|
for row in csv.DictReader(f):
|
|
script = row.get("ScriptBlockText", row.get("Message", ""))
|
|
for pattern_name, pattern in FILELESS_PATTERNS.items():
|
|
if re.search(pattern, script):
|
|
detections.append({
|
|
"timestamp": row.get("TimeCreated", row.get("Date and Time", "")),
|
|
"host": row.get("Computer", row.get("MachineName", "")),
|
|
"technique": pattern_name,
|
|
"script_excerpt": script[:300],
|
|
})
|
|
break
|
|
return detections
|
|
|
|
|
|
def generate_report(detections: list, output_path: str) -> None:
|
|
by_technique = Counter(d["technique"] for d in detections)
|
|
report = {
|
|
"report_generated": datetime.utcnow().isoformat() + "Z",
|
|
"total_detections": len(detections),
|
|
"by_technique": dict(by_technique),
|
|
"detections": detections[:100],
|
|
}
|
|
with open(output_path, "w") as f:
|
|
json.dump(report, f, indent=2)
|
|
|
|
|
|
if __name__ == "__main__":
|
|
if len(sys.argv) < 2:
|
|
print("Usage: python process.py <powershell_logs.csv>")
|
|
sys.exit(1)
|
|
detections = scan_powershell_logs(sys.argv[1])
|
|
out = os.path.join(os.path.dirname(sys.argv[1]) or ".", "fileless_detection_report.json")
|
|
generate_report(detections, out)
|
|
print(f"Detections: {len(detections)}")
|