mirror of
https://github.com/SHOGGOTH-SECTOR/sica-fondt.git
synced 2026-08-01 08:30:20 +00:00
24f816b6a3
Place useful parts of the surrounding repos into sica-fondt by layer, per the
body model (Ada = membrane; brain/endocrine/capabilities/knowledge non-Ada):
- brain/ LLM reasoning + providers (dapr, hermes, MoMoA)
- capabilities/ REPRAG sidecars: hermes tools/skills, dapr tools, parallel
dispatch, A51 channels, and the OSINT cluster
- knowledge/ LORAG corpus: 754 cyber-skills, agency personas, secure-coding,
MITRE ATT&CK data
- reference/ defensive threat-reference (C3, shhbruh doc) + AdaYaml parser
License handling: AGPL sources (worldosint, advanced_evolution, mercury,
Reticulum) and GPL DeTTECT are SPEC-only clean-room/port descriptions — no
copyleft code copied. MIT/Apache/data parts copied as working trees.
Safety: shhbruh escape/persistence material and C3 covert-C2 kept as reference
only, not wired into the running organism. See CONSOLIDATION.md.
https://claude.ai/code/session_01UehUqEXXJJCsHoA4voCU5c
62 lines
3.5 KiB
Markdown
62 lines
3.5 KiB
Markdown
# Standards and References - Beaconing Frequency Analysis
|
|
|
|
## MITRE ATT&CK Command and Control (TA0011)
|
|
|
|
| Technique | Name | Beacon Indicators |
|
|
|-----------|------|-------------------|
|
|
| T1071.001 | Web Protocols | HTTP/HTTPS periodic connections with regular intervals |
|
|
| T1071.004 | DNS | DNS query patterns, tunneling with high entropy subdomains |
|
|
| T1573.001 | Symmetric Cryptography | Encrypted C2 channels with consistent packet sizes |
|
|
| T1573.002 | Asymmetric Cryptography | TLS C2 with custom or self-signed certificates |
|
|
| T1572 | Protocol Tunneling | DNS-over-HTTPS, ICMP tunneling with periodic patterns |
|
|
| T1568.002 | Domain Generation Algorithms | Algorithmically generated domains with high entropy |
|
|
| T1568.001 | Fast Flux DNS | Rapidly rotating IP addresses for C2 infrastructure |
|
|
| T1132.001 | Standard Encoding | Base64/hex encoded data in C2 traffic |
|
|
| T1095 | Non-Application Layer Protocol | ICMP, raw TCP/UDP for covert C2 |
|
|
| T1090 | Proxy | Multi-hop C2 infrastructure obscuring origin |
|
|
| T1102 | Web Service | C2 over legitimate cloud services |
|
|
|
|
## Beaconing Detection Thresholds
|
|
|
|
| Metric | Threshold | Rationale |
|
|
|--------|-----------|-----------|
|
|
| Coefficient of Variation (CV) | < 0.20 | Strong indicator of periodic automated communication |
|
|
| Minimum Beacon Interval | > 30 seconds | Below this may be streaming or polling traffic |
|
|
| Maximum Beacon Interval | < 86400 seconds | Beyond 24 hours reduces statistical significance |
|
|
| Minimum Connection Count | > 50 per 24 hours | Needed for reliable statistical analysis |
|
|
| Data Size CV | < 0.30 | Consistent payloads suggest automated heartbeats |
|
|
| Domain Age | < 30 days | Newly registered domains associated with C2 infrastructure |
|
|
|
|
## Known C2 Framework Default Beacon Profiles
|
|
|
|
| Framework | Default Interval | Default Jitter | Protocols | Detection Notes |
|
|
|-----------|-----------------|----------------|-----------|-----------------|
|
|
| Cobalt Strike | 60s | 0-50% | HTTPS, DNS | Malleable C2 profiles can change all defaults |
|
|
| Sliver | 60s | 0-30% | HTTPS, mTLS, WireGuard, DNS | Supports domain fronting |
|
|
| Brute Ratel C4 | 60s | 10-30% | HTTPS, DNS, SMB | Designed to evade EDR detection |
|
|
| Metasploit Meterpreter | 5s | 0% | TCP, HTTP/S | Highly configurable via handlers |
|
|
| Havoc | 5s | 0-20% | HTTPS | Demon agent with sleep obfuscation |
|
|
| Mythic | Configurable | Configurable | HTTP/S, TCP, WebSocket | Agent-dependent behavior |
|
|
| Covenant | 10s | 10% | HTTP/S | .NET-based C2 framework |
|
|
| Empire/Starkiller | 5s | 0-20% | HTTP/S | Python-based listeners |
|
|
|
|
## Statistical Methods for Beacon Detection
|
|
|
|
| Method | Description | Best For |
|
|
|--------|-------------|----------|
|
|
| Coefficient of Variation | stdev/mean of intervals | Regular beacons with low jitter |
|
|
| Fast Fourier Transform (FFT) | Frequency domain analysis | Detecting periodic signals in noisy data |
|
|
| Autocorrelation | Self-correlation at various lags | Identifying repeating patterns |
|
|
| Median Absolute Deviation | Robust measure of variability | Beacon detection resistant to outliers |
|
|
| Kullback-Leibler Divergence | Distribution comparison | Comparing observed intervals to uniform distribution |
|
|
|
|
## RITA Beacon Scoring Algorithm
|
|
|
|
RITA scores beacons on a 0-1 scale using:
|
|
- **Timestamp score**: Regularity of connection intervals
|
|
- **Data size score**: Consistency of bytes transferred
|
|
- **Connection count**: Volume of connections in analysis window
|
|
- **Duration**: How long the beaconing pattern has persisted
|
|
|
|
Composite score above 0.70 is considered high-confidence beaconing.
|