mirror of
https://github.com/SHOGGOTH-SECTOR/sica-fondt.git
synced 2026-08-01 08:30:20 +00:00
24f816b6a3
Place useful parts of the surrounding repos into sica-fondt by layer, per the
body model (Ada = membrane; brain/endocrine/capabilities/knowledge non-Ada):
- brain/ LLM reasoning + providers (dapr, hermes, MoMoA)
- capabilities/ REPRAG sidecars: hermes tools/skills, dapr tools, parallel
dispatch, A51 channels, and the OSINT cluster
- knowledge/ LORAG corpus: 754 cyber-skills, agency personas, secure-coding,
MITRE ATT&CK data
- reference/ defensive threat-reference (C3, shhbruh doc) + AdaYaml parser
License handling: AGPL sources (worldosint, advanced_evolution, mercury,
Reticulum) and GPL DeTTECT are SPEC-only clean-room/port descriptions — no
copyleft code copied. MIT/Apache/data parts copied as working trees.
Safety: shhbruh escape/persistence material and C3 covert-C2 kept as reference
only, not wired into the running organism. See CONSOLIDATION.md.
https://claude.ai/code/session_01UehUqEXXJJCsHoA4voCU5c
3.2 KiB
3.2 KiB
Standards and References - T1055 Process Injection Detection
MITRE ATT&CK Process Injection Sub-Techniques
| Sub-Technique | Name | API Calls | Sysmon Detection |
|---|---|---|---|
| T1055.001 | Dynamic-link Library Injection | VirtualAllocEx, WriteProcessMemory, CreateRemoteThread | Event 8, 10 |
| T1055.002 | Portable Executable Injection | VirtualAllocEx, WriteProcessMemory, SetThreadContext | Event 10 |
| T1055.003 | Thread Execution Hijacking | SuspendThread, SetThreadContext, ResumeThread | Event 10 |
| T1055.004 | Asynchronous Procedure Call | OpenThread, QueueUserAPC | Event 10 |
| T1055.005 | Thread Local Storage | TLS callback manipulation | Event 10 |
| T1055.012 | Process Hollowing | CreateProcess (SUSPENDED), NtUnmapViewOfSection, WriteProcessMemory | Event 25, 10 |
| T1055.013 | Process Doppelganging | NtCreateTransaction, NtCreateSection, NtRollbackTransaction | Event 25 |
| T1055.015 | ListPlanting | SendMessage to set list item text | Limited Sysmon coverage |
Critical Sysmon Events for Injection Detection
| Event ID | Name | Detection Value |
|---|---|---|
| 1 | Process Create | Baseline the originating process |
| 7 | Image Loaded | Detect DLL injection from unusual paths |
| 8 | CreateRemoteThread | Primary injection indicator |
| 10 | ProcessAccess | Cross-process handle acquisition |
| 25 | ProcessTampering | Process hollowing detection (Sysmon 13+) |
ProcessAccess Granted Access Masks
| Access Mask | Permissions | Risk |
|---|---|---|
| 0x1FFFFF | PROCESS_ALL_ACCESS | Critical - full process control |
| 0x1F3FFF | Nearly all access rights | Critical |
| 0x0040 | PROCESS_VM_READ | Medium - credential dumping |
| 0x0020 | PROCESS_VM_WRITE | High - memory modification |
| 0x0008 | PROCESS_VM_OPERATION | High - memory allocation |
| 0x0002 | PROCESS_CREATE_THREAD | High - thread creation |
| 0x143A | Combination used by Mimikatz | Critical |
Common Injection Targets
| Process | Why Targeted |
|---|---|
| svchost.exe | Many instances, network access, elevated privileges |
| explorer.exe | User context, always running, network access |
| lsass.exe | Credential access (T1003 overlap) |
| winlogon.exe | SYSTEM privileges, always running |
| spoolsv.exe | SYSTEM privileges, rarely monitored |
| dllhost.exe | COM surrogate, frequently overlooked |
| RuntimeBroker.exe | Common in modern Windows, rarely scrutinized |
Recommended Sysmon Configuration for Injection Detection
<Sysmon schemaversion="4.90">
<EventFiltering>
<RuleGroup name="ProcessInjection" groupRelation="or">
<CreateRemoteThread onmatch="exclude">
<SourceImage condition="is">C:\Windows\System32\csrss.exe</SourceImage>
</CreateRemoteThread>
<ProcessAccess onmatch="include">
<GrantedAccess condition="is">0x1FFFFF</GrantedAccess>
<GrantedAccess condition="is">0x1F3FFF</GrantedAccess>
<GrantedAccess condition="is">0x143A</GrantedAccess>
</ProcessAccess>
<ProcessTampering onmatch="include">
<Type condition="is">Image is replaced</Type>
</ProcessTampering>
</RuleGroup>
</EventFiltering>
</Sysmon>