mirror of
https://github.com/SHOGGOTH-SECTOR/sica-fondt.git
synced 2026-08-01 16:40:24 +00:00
24f816b6a3
Place useful parts of the surrounding repos into sica-fondt by layer, per the
body model (Ada = membrane; brain/endocrine/capabilities/knowledge non-Ada):
- brain/ LLM reasoning + providers (dapr, hermes, MoMoA)
- capabilities/ REPRAG sidecars: hermes tools/skills, dapr tools, parallel
dispatch, A51 channels, and the OSINT cluster
- knowledge/ LORAG corpus: 754 cyber-skills, agency personas, secure-coding,
MITRE ATT&CK data
- reference/ defensive threat-reference (C3, shhbruh doc) + AdaYaml parser
License handling: AGPL sources (worldosint, advanced_evolution, mercury,
Reticulum) and GPL DeTTECT are SPEC-only clean-room/port descriptions — no
copyleft code copied. MIT/Apache/data parts copied as working trees.
Safety: shhbruh escape/persistence material and C3 covert-C2 kept as reference
only, not wired into the running organism. See CONSOLIDATION.md.
https://claude.ai/code/session_01UehUqEXXJJCsHoA4voCU5c
2.6 KiB
2.6 KiB
Pass-the-Ticket Detection API Reference
Windows Security Event IDs
Event ID 4768 - TGT Requested
Key Fields:
TargetUserName - Account requesting TGT
TargetDomainName - Domain of account
IpAddress - Source IP of request
TicketEncryptionType - 0x12 (AES256), 0x17 (RC4-HMAC)
PreAuthType - 15 (PA-ENC-TIMESTAMP)
Event ID 4769 - TGS Requested
Key Fields:
TargetUserName - Account using the ticket
ServiceName - SPN of requested service
IpAddress - Source IP
TicketEncryptionType - 0x17 indicates RC4 downgrade
TicketOptions - Kerberos ticket flags
Event ID 4771 - Kerberos Pre-Authentication Failed
Key Fields:
TargetUserName - Account that failed
IpAddress - Source of failure
Status - 0x18 (wrong password), 0x12 (expired)
Splunk SPL Queries
RC4 Encryption Downgrade Detection
index=wineventlog sourcetype="WinEventLog:Security" EventCode=4769
TicketEncryptionType=0x17
| stats count by TargetUserName, IpAddress, ServiceName
| where count > 3
Cross-Host Ticket Reuse
index=wineventlog EventCode=4769
| stats dc(IpAddress) as ip_count, values(IpAddress) as ips
by TargetUserName
| where ip_count > 1
| sort -ip_count
TGS Volume Anomaly
index=wineventlog EventCode=4769
| bin _time span=1h
| stats count by TargetUserName, _time
| eventstats avg(count) as avg_count, stdev(count) as sd by TargetUserName
| where count > avg_count + (3 * sd)
Elastic / KQL Queries
RC4 Downgrade in Elastic
event.code: "4769" AND winlog.event_data.TicketEncryptionType: "0x17"
Cross-Host Reuse in Elastic
POST security-*/_search
{
"size": 0,
"query": { "term": { "event.code": "4769" } },
"aggs": {
"by_user": {
"terms": { "field": "winlog.event_data.TargetUserName" },
"aggs": {
"unique_ips": { "cardinality": { "field": "source.ip" } }
}
}
}
}
MITRE ATT&CK Mapping
| Technique | ID | Detection |
|---|---|---|
| Use Alternate Authentication Material: Pass the Ticket | T1550.003 | RC4 downgrade, cross-host reuse |
| Steal or Forge Kerberos Tickets: Kerberoasting | T1558.003 | High TGS volume for SPNs |
| Brute Force: Password Spraying | T1110.003 | Pre-auth failure spikes |
CLI Usage
# Parse exported event log XML and detect PtT indicators
python agent.py --evtx-xml security_events.xml --output report.json
# Show Splunk detection queries
python agent.py --show-splunk
# Custom thresholds
python agent.py --evtx-xml events.xml --tgs-threshold 30 --preauth-threshold 5