mirror of
https://github.com/SHOGGOTH-SECTOR/sica-fondt.git
synced 2026-08-01 16:40:24 +00:00
24f816b6a3
Place useful parts of the surrounding repos into sica-fondt by layer, per the
body model (Ada = membrane; brain/endocrine/capabilities/knowledge non-Ada):
- brain/ LLM reasoning + providers (dapr, hermes, MoMoA)
- capabilities/ REPRAG sidecars: hermes tools/skills, dapr tools, parallel
dispatch, A51 channels, and the OSINT cluster
- knowledge/ LORAG corpus: 754 cyber-skills, agency personas, secure-coding,
MITRE ATT&CK data
- reference/ defensive threat-reference (C3, shhbruh doc) + AdaYaml parser
License handling: AGPL sources (worldosint, advanced_evolution, mercury,
Reticulum) and GPL DeTTECT are SPEC-only clean-room/port descriptions — no
copyleft code copied. MIT/Apache/data parts copied as working trees.
Safety: shhbruh escape/persistence material and C3 covert-C2 kept as reference
only, not wired into the running organism. See CONSOLIDATION.md.
https://claude.ai/code/session_01UehUqEXXJJCsHoA4voCU5c
2.4 KiB
2.4 KiB
Standards & References: Detecting Spearphishing with Email Gateway
MITRE ATT&CK References
- T1566.001: Phishing: Spearphishing Attachment
- T1566.002: Phishing: Spearphishing Link
- T1566.003: Phishing: Spearphishing via Service
- T1598.002: Phishing for Information: Spearphishing Attachment
- T1598.003: Phishing for Information: Spearphishing Link
- T1534: Internal Spearphishing
NIST Guidelines
- NIST SP 800-177 Rev.1: Trustworthy Email
- NIST SP 800-53 Rev.5: SI-8 Spam Protection, SI-3 Malicious Code Protection
- NIST CSF: PR.AT (Awareness & Training), DE.CM (Security Continuous Monitoring)
CIS Controls v8
- CIS Control 9: Email and Web Browser Protections
- 9.1: Ensure only approved browsers and email clients are used
- 9.2: Use DNS filtering services
- 9.3: Maintain and enforce network-based URL filters
- 9.6: Block unnecessary file types
- 9.7: Deploy and maintain email server anti-malware protections
Email Gateway Feature Matrix
| Feature | Microsoft Defender | Proofpoint | Mimecast | Barracuda |
|---|---|---|---|---|
| Impersonation detection | Anti-phishing policy | Impostor Classifier | Brand Exploit Protect | Impersonation Protection |
| URL detonation | Safe Links | URL Defense | URL Protect | Link Protection |
| Attachment sandbox | Safe Attachments | Targeted Attack Protection | Attachment Protect | Advanced Threat Protection |
| DMARC enforcement | Built-in | Built-in | DMARC Analyzer | Built-in |
| AI/ML detection | Yes (multiple models) | NexusAI | Yes | Yes |
| User reporting | Report Message add-in | PhishAlarm | Built-in | Phishline |
| SIEM integration | Microsoft Sentinel | Splunk, QRadar | Splunk, Sentinel | Various |
| Auto-remediation (ZAP) | Yes | CLEAR | Yes | Yes |
Detection Indicators for Spearphishing
| Indicator | Weight | Description |
|---|---|---|
| Display name spoofing VIP | High | From name matches protected user but different email |
| Lookalike domain | High | Domain differs by 1-2 characters from legitimate |
| First-time sender to VIP | Medium | No prior communication history |
| Urgency keywords | Medium | "urgent", "immediately", "wire transfer", "confidential" |
| Reply-to mismatch | High | Reply-to differs from From address |
| External sender with internal branding | High | Email mimics internal templates |
| Newly registered domain | High | Sending domain < 30 days old |
| Authentication failure | High | SPF/DKIM/DMARC fail |