mirror of
https://github.com/SHOGGOTH-SECTOR/sica-fondt.git
synced 2026-08-01 08:30:20 +00:00
24f816b6a3
Place useful parts of the surrounding repos into sica-fondt by layer, per the
body model (Ada = membrane; brain/endocrine/capabilities/knowledge non-Ada):
- brain/ LLM reasoning + providers (dapr, hermes, MoMoA)
- capabilities/ REPRAG sidecars: hermes tools/skills, dapr tools, parallel
dispatch, A51 channels, and the OSINT cluster
- knowledge/ LORAG corpus: 754 cyber-skills, agency personas, secure-coding,
MITRE ATT&CK data
- reference/ defensive threat-reference (C3, shhbruh doc) + AdaYaml parser
License handling: AGPL sources (worldosint, advanced_evolution, mercury,
Reticulum) and GPL DeTTECT are SPEC-only clean-room/port descriptions — no
copyleft code copied. MIT/Apache/data parts copied as working trees.
Safety: shhbruh escape/persistence material and C3 covert-C2 kept as reference
only, not wired into the running organism. See CONSOLIDATION.md.
https://claude.ai/code/session_01UehUqEXXJJCsHoA4voCU5c
1.8 KiB
1.8 KiB
API Reference: Hunting for Spearphishing Indicators
Email Header Analysis
import email
from email import policy
msg = email.message_from_file(open("suspect.eml"), policy=policy.default)
print(msg["From"], msg["Return-Path"], msg["Received"])
print(msg["Authentication-Results"]) # SPF/DKIM/DMARC
Suspicious Attachment Types
| Extension | Risk | Technique |
|---|---|---|
.exe, .scr, .dll |
CRITICAL | T1566.001 |
.xlsm, .docm |
HIGH | T1566.001 (macros) |
.iso, .img, .lnk |
HIGH | T1566.001 (MOTW bypass) |
.html, .htm |
HIGH | HTML Smuggling |
.zip, .rar |
MEDIUM | Archive with payload |
Splunk SPL - Phishing Detection
index=email sourcetype=exchange
| where match(attachment_name, "(?i)\.(exe|scr|iso|lnk|docm|xlsm|hta)$")
| stats count by sender, recipient, attachment_name, subject
| where count > 3
KQL - Microsoft Defender for Office 365
EmailAttachmentInfo
| where FileType in ("exe", "scr", "iso", "lnk", "docm", "xlsm")
| join kind=inner EmailEvents on NetworkMessageId
| project Timestamp, SenderFromAddress, RecipientEmailAddress, Subject, FileName
Phishing URL Patterns
patterns = [
r"https?://bit\.ly/", # URL shorteners
r"https?://\d+\.\d+\.\d+\.\d+", # IP-based URLs
r"https?://[^/]*login[^/]*\.", # Credential harvesting
r"https?://[^/]*\.(top|xyz)/", # Suspicious TLDs
]
SPF/DKIM/DMARC Validation
import spf
result, _, _ = spf.check2(ip="1.2.3.4", sender="user@example.com", helo="mail.example.com")
# result: 'pass', 'fail', 'softfail', 'neutral', 'none'
References
- MITRE T1566: https://attack.mitre.org/techniques/T1566/
- pyspf: https://pypi.org/project/pyspf/
- python email: https://docs.python.org/3/library/email.html