mirror of
https://github.com/SHOGGOTH-SECTOR/sica-fondt.git
synced 2026-08-01 16:40:24 +00:00
24f816b6a3
Place useful parts of the surrounding repos into sica-fondt by layer, per the
body model (Ada = membrane; brain/endocrine/capabilities/knowledge non-Ada):
- brain/ LLM reasoning + providers (dapr, hermes, MoMoA)
- capabilities/ REPRAG sidecars: hermes tools/skills, dapr tools, parallel
dispatch, A51 channels, and the OSINT cluster
- knowledge/ LORAG corpus: 754 cyber-skills, agency personas, secure-coding,
MITRE ATT&CK data
- reference/ defensive threat-reference (C3, shhbruh doc) + AdaYaml parser
License handling: AGPL sources (worldosint, advanced_evolution, mercury,
Reticulum) and GPL DeTTECT are SPEC-only clean-room/port descriptions — no
copyleft code copied. MIT/Apache/data parts copied as working trees.
Safety: shhbruh escape/persistence material and C3 covert-C2 kept as reference
only, not wired into the running organism. See CONSOLIDATION.md.
https://claude.ai/code/session_01UehUqEXXJJCsHoA4voCU5c
105 lines
2.6 KiB
Markdown
105 lines
2.6 KiB
Markdown
# Pass-the-Ticket Detection API Reference
|
|
|
|
## Windows Security Event IDs
|
|
|
|
### Event ID 4768 - TGT Requested
|
|
```
|
|
Key Fields:
|
|
TargetUserName - Account requesting TGT
|
|
TargetDomainName - Domain of account
|
|
IpAddress - Source IP of request
|
|
TicketEncryptionType - 0x12 (AES256), 0x17 (RC4-HMAC)
|
|
PreAuthType - 15 (PA-ENC-TIMESTAMP)
|
|
```
|
|
|
|
### Event ID 4769 - TGS Requested
|
|
```
|
|
Key Fields:
|
|
TargetUserName - Account using the ticket
|
|
ServiceName - SPN of requested service
|
|
IpAddress - Source IP
|
|
TicketEncryptionType - 0x17 indicates RC4 downgrade
|
|
TicketOptions - Kerberos ticket flags
|
|
```
|
|
|
|
### Event ID 4771 - Kerberos Pre-Authentication Failed
|
|
```
|
|
Key Fields:
|
|
TargetUserName - Account that failed
|
|
IpAddress - Source of failure
|
|
Status - 0x18 (wrong password), 0x12 (expired)
|
|
```
|
|
|
|
## Splunk SPL Queries
|
|
|
|
### RC4 Encryption Downgrade Detection
|
|
```spl
|
|
index=wineventlog sourcetype="WinEventLog:Security" EventCode=4769
|
|
TicketEncryptionType=0x17
|
|
| stats count by TargetUserName, IpAddress, ServiceName
|
|
| where count > 3
|
|
```
|
|
|
|
### Cross-Host Ticket Reuse
|
|
```spl
|
|
index=wineventlog EventCode=4769
|
|
| stats dc(IpAddress) as ip_count, values(IpAddress) as ips
|
|
by TargetUserName
|
|
| where ip_count > 1
|
|
| sort -ip_count
|
|
```
|
|
|
|
### TGS Volume Anomaly
|
|
```spl
|
|
index=wineventlog EventCode=4769
|
|
| bin _time span=1h
|
|
| stats count by TargetUserName, _time
|
|
| eventstats avg(count) as avg_count, stdev(count) as sd by TargetUserName
|
|
| where count > avg_count + (3 * sd)
|
|
```
|
|
|
|
## Elastic / KQL Queries
|
|
|
|
### RC4 Downgrade in Elastic
|
|
```kql
|
|
event.code: "4769" AND winlog.event_data.TicketEncryptionType: "0x17"
|
|
```
|
|
|
|
### Cross-Host Reuse in Elastic
|
|
```json
|
|
POST security-*/_search
|
|
{
|
|
"size": 0,
|
|
"query": { "term": { "event.code": "4769" } },
|
|
"aggs": {
|
|
"by_user": {
|
|
"terms": { "field": "winlog.event_data.TargetUserName" },
|
|
"aggs": {
|
|
"unique_ips": { "cardinality": { "field": "source.ip" } }
|
|
}
|
|
}
|
|
}
|
|
}
|
|
```
|
|
|
|
## MITRE ATT&CK Mapping
|
|
|
|
| Technique | ID | Detection |
|
|
|---|---|---|
|
|
| Use Alternate Authentication Material: Pass the Ticket | T1550.003 | RC4 downgrade, cross-host reuse |
|
|
| Steal or Forge Kerberos Tickets: Kerberoasting | T1558.003 | High TGS volume for SPNs |
|
|
| Brute Force: Password Spraying | T1110.003 | Pre-auth failure spikes |
|
|
|
|
## CLI Usage
|
|
|
|
```bash
|
|
# Parse exported event log XML and detect PtT indicators
|
|
python agent.py --evtx-xml security_events.xml --output report.json
|
|
|
|
# Show Splunk detection queries
|
|
python agent.py --show-splunk
|
|
|
|
# Custom thresholds
|
|
python agent.py --evtx-xml events.xml --tgs-threshold 30 --preauth-threshold 5
|
|
```
|