mirror of
https://github.com/SHOGGOTH-SECTOR/sica-fondt.git
synced 2026-08-01 08:30:20 +00:00
24f816b6a3
Place useful parts of the surrounding repos into sica-fondt by layer, per the
body model (Ada = membrane; brain/endocrine/capabilities/knowledge non-Ada):
- brain/ LLM reasoning + providers (dapr, hermes, MoMoA)
- capabilities/ REPRAG sidecars: hermes tools/skills, dapr tools, parallel
dispatch, A51 channels, and the OSINT cluster
- knowledge/ LORAG corpus: 754 cyber-skills, agency personas, secure-coding,
MITRE ATT&CK data
- reference/ defensive threat-reference (C3, shhbruh doc) + AdaYaml parser
License handling: AGPL sources (worldosint, advanced_evolution, mercury,
Reticulum) and GPL DeTTECT are SPEC-only clean-room/port descriptions — no
copyleft code copied. MIT/Apache/data parts copied as working trees.
Safety: shhbruh escape/persistence material and C3 covert-C2 kept as reference
only, not wired into the running organism. See CONSOLIDATION.md.
https://claude.ai/code/session_01UehUqEXXJJCsHoA4voCU5c
107 lines
2.6 KiB
Markdown
107 lines
2.6 KiB
Markdown
# API Reference: Detecting Ransomware Encryption Behavior
|
|
|
|
## Shannon Entropy
|
|
|
|
Formula: H(X) = -Sum p(x) log2(p(x)). For byte data range is 0.0 to 8.0.
|
|
|
|
### Python Implementation
|
|
|
|
```python
|
|
import math
|
|
from collections import Counter
|
|
|
|
def shannon_entropy(data):
|
|
freq = Counter(data)
|
|
length = len(data)
|
|
return -sum((c / length) * math.log2(c / length) for c in freq.values())
|
|
```
|
|
|
|
### Entropy Thresholds
|
|
|
|
| Range | Interpretation | Example |
|
|
|-------|---------------|--------|
|
|
| 0.0-1.0 | Nearly uniform | Null files |
|
|
| 1.0-4.0 | Low entropy | Plain text |
|
|
| 4.0-6.0 | Mixed content | Office docs |
|
|
| 6.0-7.0 | Compressed | PDF |
|
|
| 7.0-7.5 | Highly compressed | ZIP JPEG |
|
|
| 7.5-7.9 | Block cipher encrypted | AES-CBC |
|
|
| 7.9-8.0 | Stream cipher encrypted | AES-CTR ChaCha20 |
|
|
|
|
## psutil Process IO Monitoring
|
|
|
|
```python
|
|
import psutil
|
|
proc = psutil.Process(pid)
|
|
io = proc.io_counters()
|
|
# Fields: read_bytes write_bytes read_count write_count
|
|
```
|
|
|
|
## Sysmon Event IDs
|
|
|
|
| Event ID | Event | Relevance |
|
|
|----------|-------|----------|
|
|
| 1 | Process Create | Identify encrypting process |
|
|
| 2 | File time changed | Timestomping |
|
|
| 11 | FileCreate | Ransom notes |
|
|
| 15 | FileCreateStreamHash | ADS usage |
|
|
| 23 | FileDelete | Shadow copy deletion |
|
|
| 26 | FileDeleteDetected | File deletion |
|
|
|
|
## Windows ETW Providers
|
|
|
|
Microsoft-Windows-Kernel-File GUID: EDD08927-9CC4-4E65-B970-C2560FB5C289
|
|
|
|
| Event ID | Description |
|
|
|----------|------------|
|
|
| 10 | Create (open) |
|
|
| 11 | Close |
|
|
| 12 | Read |
|
|
| 14 | Write |
|
|
| 15 | SetInformation |
|
|
|
|
## Behavioral Scoring
|
|
|
|
| Signal | Weight | Threshold |
|
|
|--------|--------|-----------|
|
|
| Files modified per min | 30 pts | Over 50 |
|
|
| Entropy delta | 30 pts | Over 3.0 |
|
|
| Extension changes | 20 pts | Over 10 |
|
|
| Ransom note creation | 20 pts | Any |
|
|
|
|
### Score Interpretation
|
|
|
|
| Score | Severity | Action |
|
|
|-------|----------|--------|
|
|
| 0-25 | INFO | Log |
|
|
| 25-50 | LOW | Alert SOC |
|
|
| 50-75 | HIGH | Suspend process |
|
|
| 75-100 | CRITICAL | Kill and isolate |
|
|
|
|
## Shadow Copy Deletion
|
|
|
|
| Command | Method |
|
|
|---------|--------|
|
|
| vssadmin delete shadows /all /quiet | VSS Admin |
|
|
| wmic shadowcopy delete | WMI |
|
|
| bcdedit /set recoveryenabled no | Disable recovery |
|
|
| wbadmin delete catalog -quiet | Delete backup |
|
|
|
|
## watchdog Library
|
|
|
|
| Method | Trigger |
|
|
|--------|--------|
|
|
| on_created | File created |
|
|
| on_modified | File modified |
|
|
| on_deleted | File deleted |
|
|
| on_moved | File renamed |
|
|
|
|
## Double Extension Detection
|
|
|
|
```python
|
|
parts = filename.rsplit(".", 2)
|
|
if len(parts) >= 3:
|
|
original_ext = "." + parts[-2]
|
|
appended_ext = "." + parts[-1]
|
|
```
|