mirror of
https://github.com/SHOGGOTH-SECTOR/sica-fondt.git
synced 2026-08-01 16:40:24 +00:00
24f816b6a3
Place useful parts of the surrounding repos into sica-fondt by layer, per the
body model (Ada = membrane; brain/endocrine/capabilities/knowledge non-Ada):
- brain/ LLM reasoning + providers (dapr, hermes, MoMoA)
- capabilities/ REPRAG sidecars: hermes tools/skills, dapr tools, parallel
dispatch, A51 channels, and the OSINT cluster
- knowledge/ LORAG corpus: 754 cyber-skills, agency personas, secure-coding,
MITRE ATT&CK data
- reference/ defensive threat-reference (C3, shhbruh doc) + AdaYaml parser
License handling: AGPL sources (worldosint, advanced_evolution, mercury,
Reticulum) and GPL DeTTECT are SPEC-only clean-room/port descriptions — no
copyleft code copied. MIT/Apache/data parts copied as working trees.
Safety: shhbruh escape/persistence material and C3 covert-C2 kept as reference
only, not wired into the running organism. See CONSOLIDATION.md.
https://claude.ai/code/session_01UehUqEXXJJCsHoA4voCU5c
2.1 KiB
2.1 KiB
API Reference: Hunting Advanced Persistent Threats
Libraries
attackcti (MITRE ATT&CK CTI Library)
- Install:
pip install attackcti - Docs: https://attackcti.readthedocs.io/
attack_client()-- Initialize the ATT&CK STIX/TAXII clientget_groups()-- Retrieve all threat actor groups from ATT&CKget_techniques_used_by_group(group)-- Get techniques mapped to a specific groupget_techniques()-- List all ATT&CK techniquesget_mitigations()-- List all mitigations
mitreattack-python (ATT&CK STIX Data)
- Install:
pip install mitreattack-python - Docs: https://mitreattack-python.readthedocs.io/
MitreAttackData(stix_filepath)-- Load ATT&CK STIX bundleget_groups()-- All threat groupsget_techniques_used_by_group(group_stix_id)-- Techniques per groupget_attack_campaigns()-- Known campaigns
osquery
- Docs: https://osquery.readthedocs.io/
scheduled_tasks-- Windows scheduled tasks tableprocesses-- Running process informationprocess_open_sockets-- Network connections per processautoexec-- Auto-start execution pointsfile-- File metadata queries
Key ATT&CK Technique IDs
| ID | Name | Relevance |
|---|---|---|
| T1059 | Command and Scripting Interpreter | Process-based hunting |
| T1053 | Scheduled Task/Job | Persistence detection |
| T1071 | Application Layer Protocol | C2 communication |
| T1055 | Process Injection | In-memory threats |
| T1003 | OS Credential Dumping | Credential theft |
| T1566 | Phishing | Initial access vector |
| T1218 | Signed Binary Proxy Execution | Defense evasion |
Sigma Rule Format
- Spec: https://sigmahq.io/docs/basics/rules.html
- Fields:
title,status,logsource,detection,level - Converters:
sigma-cliconverts to Splunk SPL, Elastic EQL, Sentinel KQL
External References
- MITRE ATT&CK Groups: https://attack.mitre.org/groups/
- ATT&CK Navigator: https://mitre-attack.github.io/attack-navigator/
- Velociraptor VQL: https://docs.velociraptor.app/docs/vql/
- Zeek Documentation: https://docs.zeek.org/en/current/